ClawHub
Back to skill

Security audit

Sahabat Bumil 🤰

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate Indonesia-focused pregnancy guide, but its main manual install instructions point to a noncanonical GitHub repository before running pip.

Prefer the ClawHub install path or verify that any manual clone uses the canonical defzky/openclaw-sahabat-bumil repository, not the yourusername placeholder. Install dependencies in a virtual environment, treat the pregnancy/BPJS/MBG information as general reference only, verify current details with doctors, hospitals, BPJS, Puskesmas, or official government sources, and do not submit identity or medical documents through chat unless a trusted workflow clearly explains collection and retention.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:66
Finding

Noncanonical Repository Used as a Trusted Installation Source

Content
View full analysis
Remediation
View remediation
--hash=sha256: ``` Then install with: ```bash pip3 install --require-hashes -r requirements.txt ``` 5. Remove `requests` entirely if it remains unused by runtime code. The audited Python modules do not import it, so retaining it unnecessarily expands the supply-chain attack surface. 6. Recommend installation inside a dedicated virtual environment instead of the user's global Python environment: ```bash python3 -m venv .venv . .venv/bin/activate pip install --require-hashes -r requirements.txt ``` 7. Add release signing, checksums, or provenance verification so users can confirm that the downloaded source matches an officially reviewed release. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README presents pregnancy, symptom, exercise, nutrition, and healthcare guidance as actionable support without a clear disclaimer that the content is informational only and not a substitute for licensed medical advice. In a health-focused skill aimed at pregnant users, omission of that warning can cause users to rely on incomplete or outdated guidance and delay professional care, increasing the chance of physical harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The README instructs users to bring sensitive personal documents such as KTP, KK, Buku KIA, and pregnancy certificates for MBG registration, but it does not explain whether the skill stores, transmits, or avoids collecting this data. In a context involving government-benefit enrollment and health status, lack of privacy/data-handling guidance can mislead users into oversharing sensitive identity and medical information through the skill or related channels.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 457)May include surrounding context.

md
If you find this project helpful, please give it a star! ⭐

[![Star History Chart](https://api.star-history.com/svg?repos=defzky/openclaw-sahabat-bumil&type=Date)](https://star-history.com/#defzky/openclaw-sahabat-bumil&Date)

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script performs an unconditional recursive deletion with rm -rf $PACKAGE_DIR before recreating the directory, with no confirmation, safety checks, or quoting. If PACKAGE_DIR is empty, modified unexpectedly, or contains shell-special characters/spaces, this can delete unintended paths and cause data loss on the operator's system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script writes a manifest claiming the packaged skill provides health and wellness guidance for pregnancy, while the code in this file performs only packaging operations such as copying files, creating archives, and preparing submission artifacts. This is a semantic mismatch between the declared skill behavior and what this file actually does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module is explicitly scoped to Jakarta and Indonesia, but it hard-codes that locale into all costs, BPJS assumptions, hospital lists, and maternity-leave guidance without any mechanism to confirm the user's jurisdiction. If used by someone outside Jakarta or in a different legal/insurance context, the advice may be materially wrong, leading to financial misplanning or false assumptions about healthcare access and benefits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The functions in this range return prescriptive medical, insurance, and employment-benefit guidance as if it were current and generally applicable, but they do not warn users that coverage rules, maternity-leave law, reimbursement practices, and hospital policies can change or vary by employer and provider. In a financial-planning skill for pregnant users, stale or overgeneralized guidance could cause harmful decisions such as relying on nonexistent coverage, misunderstanding legal leave entitlements, or underbudgeting for care.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file includes multiple user-facing guidance blocks in English, including the warung safety and young-mom nutrition sections, while the skill is explicitly about Indonesian pregnancy nutrition. This can violate a language/locale policy requiring user choice because the content forces one language without offering an Indonesian or selectable alternative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill provides pregnancy-care hospital, BPJS, prenatal class, and OBGYN guidance without any visible disclaimer that the information may be outdated or that it should not replace professional medical advice. In a healthcare context, users may rely on stale pricing, insurance acceptance, facility availability, or implied care recommendations when making time-sensitive maternal health decisions, which can lead to unsafe delays or inappropriate care choices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code embeds user-facing program information and responses in Indonesian, but there is no indication that the skill is region- or language-limited, nor any option for users to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module description states that the skill integrates Jakarta hospitals and Indonesian nutrition, framing the assistant around a specific locale by default. This locale constraint is not presented as optional or user-selectable, which can violate language/locale policy expectations for general-purpose skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The help output labels hospitals as '(Jakarta)' and nutrition as '(Indonesian)' while the broader assistant framing invites general conversation. Because the skill does not first confirm that the user wants Indonesia-specific guidance, it imposes a locale-specific experience by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The changelog lists region- and locale-specific features such as an Indonesian foods guide and BPJS coverage guide, but provides no indication that these are optional, user-selected, or limited to a clearly documented regional context. Under the policy for natural-language violations, locale-specific behavior should either be opt-in or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The README repeatedly frames the skill as being specifically for Indonesian moms and the configuration example sets SAHABAT_BUMIL_LANG="id", which suggests a default locale preference. While English is mentioned as a possible setting later, the overall natural-language description does not clearly present language choice as an upfront user option, which may conflict with locale-choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill is framed as specifically for 'Indonesian moms' and the description emphasizes Indonesian context and audience. While a later configuration option allows 'id or en', the primary natural-language description does not clearly present language choice up front, which can be read as forcing a locale/language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest description explicitly positions the skill as an "Indonesian Pregnancy Guide," and multiple tags/features reinforce a fixed Indonesian locale. Under the policy, language or locale constraints should either be user-selectable or clearly justified as region-specific; this manifest does not provide that justification or opt-in language.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · package-for-clawhub.sh (reported line 44)May include surrounding context.

sh
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as requests>=2.28.0, which allows installation of many future versions and does not ensure a reproducible, reviewed package set. This is dangerous because builds may silently pick up a vulnerable or incompatible release, making security posture unpredictable over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Because requests is not pinned, it is not possible to verify from this manifest whether the installed version is affected by known advisories. The danger is supply-chain uncertainty: deployments may resolve to different versions, including ones with disclosed security flaws, depending on when and where installation occurs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation presents trimester and dietary_preference as meaningful inputs for obtaining recommendations, implying the returned recommendations are tailored to those parameters. The implementation ignores both arguments and returns the same static safe foods, foods to avoid, and trimester nutrition data every time.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The docstring says this function searches recipes using both trimester and difficulty, listing difficulty values in the arguments. In the implementation, only trimester is used and the difficulty argument has no effect, so the inline documentation describes behavior the code does not perform.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The help text says '/mbg schedule - Distribution schedule tracker', which implies some tracking capability. In reality, the mapped function only formats and returns fixed schedule information from a hardcoded data structure and performs no user-specific or dynamic tracking.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.