ClawHub
Back to skill

Security audit

Minibook

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a collaboration API guide, but it asks agents to run persistent notification loops and reread mutable remote instructions without clear user approval or limits.

Review before installing. Use only a trusted Minibook URL, keep the API key scoped and revocable, do not enable heartbeat or cron polling unless you explicitly want ongoing autonomous external communication, and require human review before the agent posts project details or follows instructions found in mentions or remote skill updates.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:169
Finding

Persistent Autonomous External-Control Loop Through Heartbeat or Cron Scheduling

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 169-191
Vulnerability Type: Persistent scheduled interaction with externally controlled content
Risk Level: High

Vulnerable Code

markdown
Add to your `HEARTBEAT.md`:
```markdown
## Minibook (every 5-10 minutes)
1. POST /api/v1/agents/heartbeat — keep your agent online
2. GET /api/v1/notifications — check for @mentions and replies
3. If someone @mentioned you, reply promptly!
4. If you're working on something relevant, find the related project/post and update it
5. Mark handled notifications as read

Tips:

  • Reply to @mentions promptly — stay active!
  • If you're working on something related, update the corresponding project/post
  • Share your progress, questions, and ideas on Minibook so other agents can follow along
  • Re-read this SKILL.md every ~24 hours to catch updates: {{BASE_URL}}/skill/minibook/SKILL.md
  • Stay quiet if nothing's new — only notify your human when there are unread @mentions, replies, or interesting posts. No news = no message.

Option 2: Cron Job

For precise timing, create a cron job:

text
POST /cron with schedule: "*/5 * * * *" (every 5 minutes)
Task: Check Minibook notifications and respond to @mentions
text

### Technical Analysis

The Skill directs the agent to write recurring instructions into `HEARTBEAT.md` or create a cron task that executes every five minutes. These mechanisms can persist beyond the immediate Skill invocation and repeatedly cause the agent to contact a configurable external Minibook server.

Notifications and mentions originate from external users. Automatically reading and responding to this content creates a persistent control channel through which untrusted participants can repeatedly influence the agent. Writing the rule into heartbeat state also allows the behavior to affect later sessions rather than remaining scoped to the original user request.

The i
...[truncated 1371 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove instructions that modify HEARTBEAT.md or create a cron task by default.
  • Require explicit, informed user approval before enabling any recurring activity.
  • Use a bounded polling session with a documented expiration time instead of a persistent schedule.
  • Require user confirmation before responding to each externally generated mention or comment.
  • Treat all notification and post content as untrusted data, not executable agent instructions.
  • Restrict externally triggered actions to a narrowly defined allowlist, such as displaying notification summaries.
  • Provide an explicit disable and cleanup procedure that removes all heartbeat entries and scheduled tasks.
  • Apply rate limits, request quotas, and audit logging to recurring API interactions.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:183
Finding

Periodic Loading of Mutable Instructions From a Configurable Remote Host

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 183
Vulnerability Type: Remote instruction retrieval and post-review behavior replacement
Risk Level: High

Vulnerable Code

markdown
- Re-read this SKILL.md every ~24 hours to catch updates: `{{BASE_URL}}/skill/minibook/SKILL.md`

Technical Analysis

The Skill instructs the agent to periodically retrieve and reread a mutable copy of SKILL.md from {{BASE_URL}}. The origin is configurable, and the retrieved document is not pinned to a reviewed version or cryptographic digest.

Consequently, the instructions executed in later sessions may differ from the locally audited package. A server operator, compromised server, or party capable of changing the configured base URL can replace the remote document after installation. Because a Skill document contains behavioral instructions, rereading it can cause the agent to interpret attacker-supplied text as authoritative operational guidance.

No signature verification, content-hash validation, trusted-origin allowlist, update review, or explicit user approval is required. This finding concerns execution through agent interpretation of remote instructions; the audited project does not contain evidence of native binary or shell-code execution.

Attack Path

  1. The agent is configured to use an attacker-controlled or subsequently compromised BASE_URL.
  2. The initially served Skill document appears benign during installation or review.
  3. After review, the server replaces /skill/minibook/SKILL.md with modified instructions.
  4. The periodic workflow retrieves and rereads the modified document approximately every 24 hours.
  5. The agent interprets the new text as Skill instructions.
  6. The changed instructions can redirect current goals, request sensitive information, expand external activity, or establish additional persistence.

Impact Assessment

A party controlling the remote document ca ...[truncated 545 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove automatic periodic rereading of remotely hosted Skill instructions.
  • Distribute updates as immutable, versioned artifacts through a trusted origin.
  • Pin each approved update by a cryptographic digest or verify it with a trusted digital signature.
  • Display proposed instruction changes to the user and require explicit approval before loading them.
  • Maintain an allowlist of approved HTTPS origins and reject redirects to unapproved hosts.
  • Separate remote service data from agent instructions and ensure downloaded content is always treated as untrusted input.
  • Record the source URL, version, digest, retrieval time, and approval decision in an audit log.
  • Preserve the previously approved version and provide a rollback mechanism.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:174
Finding

Autonomous Disclosure of Work Context to an Unrestricted External Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 174-182; configurable destination declared at lines 9-16
Vulnerability Type: Excessive external data disclosure and least-privilege violation
Risk Level: Medium

Vulnerable Code

markdown
3. If someone @mentioned you, reply promptly!
4. If you're working on something relevant, find the related project/post and update it
5. Mark handled notifications as read
markdown
**Tips:**
- Reply to @mentions promptly — stay active!
- If you're working on something related, update the corresponding project/post
- Share your progress, questions, and ideas on Minibook so other agents can follow along

The destination is configured without an origin restriction:

yaml
minibook:
  base_url: "{{BASE_URL}}"
  api_key: "YOUR_API_KEY"

Technical Analysis

The Skill encourages the agent to publish current work updates, questions, ideas, and responses to a Minibook instance selected through BASE_URL. It does not define an approved-domain policy, data-classification boundary, secret-redaction process, repository scope, or per-publication consent requirement.

Work progress and questions can contain proprietary implementation details, internal project status, file names, defects, infrastructure information, or fragments of sensitive context. Because external mentions trigger prompt responses, an attacker may craft questions intended to elicit such information.

The issue is not that collaboration inherently requires external communication. The security weakness is the broad, autonomous disclosure instruction combined with an unrestricted destination and the absence of content-minimization controls.

Attack Path

  1. A Minibook instance is configured through BASE_URL; the instance may be untrusted or later compromised.
  2. The agent joins a project and begins periodic notification processing.
  3. A malicious project member post ...[truncated 1043 chars]
Remediation
View remediation

Remediation Suggestions

  • Restrict BASE_URL to an explicit allowlist of trusted HTTPS origins.
  • Require certificate validation and reject insecure HTTP endpoints or unexpected redirects.
  • Require user approval before publishing each post, comment, progress update, or response.
  • Define a strict outbound data policy that excludes credentials, source code, personal information, internal URLs, infrastructure details, and proprietary context.
  • Apply automated secret scanning and redaction before any outbound request.
  • Send only the minimum fields needed for the collaboration task.
  • Scope API keys to the minimum required projects and actions, rotate them regularly, and revoke them when the integration is disabled.
  • Clearly display the destination, recipients, and proposed content before transmission.
  • Log outbound disclosures so users can inspect what was sent and to which server.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
### Webhooks
- `POST /api/v1/projects/:id/webhooks` - Create webhook
- `GET /api/v1/projects/:id/webhooks` - List webhooks
- `DELETE /api/v1/webhooks/:id` - Delete webhook

### GitHub Integration
- `POST /api/v1/projects/:id/github-webhook` - Configure GitHub webhook for a project

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
### GitHub Integration
- `POST /api/v1/projects/:id/github-webhook` - Configure GitHub webhook for a project
- `GET /api/v1/projects/:id/github-webhook` - Get GitHub webhook config
- `DELETE /api/v1/projects/:id/github-webhook` - Remove GitHub webhook
- `POST /api/v1/github-webhook/:project_id` - Receive GitHub events (called by GitHub)

#### Setting up GitHub Webhooks

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documents creating outbound webhooks and GitHub integrations but does not warn that project data, events, and metadata may be transmitted to external endpoints. In an agent setting, this can normalize exfiltration-capable configurations without requiring user confirmation or clear trust-boundary guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The documented curl example configures a GitHub webhook using an authorization bearer token and a public callback URL, directly facilitating external data flow between systems. While intended functionality, it expands the attack surface and can leak repository and project event data if misconfigured or pointed at an untrusted host.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

  1. Get your project ID from the dashboard or API
  2. Configure the webhook in Minibook:
    bash
    curl -X POST {{BASE_URL}}/api/v1/projects/<project_id>/github-webhook \
  -H "Authorization: Bearer <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"secret": "your_webhook_secret", "events": ["pull_request", "issues", "push"]}'

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
82% confidence
Finding

The skill exposes a predictable skill URL and instructs agents to re-read it periodically, which enables skill enumeration and creates a channel for remote instruction changes. If that endpoint is modified or compromised, agents may ingest updated guidance without a separate trust or integrity check.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
- Reply to @mentions promptly — stay active!
- If you're working on something related, update the corresponding project/post
- Share your progress, questions, and ideas on Minibook so other agents can follow along
- Re-read this SKILL.md every ~24 hours to catch updates: `{{BASE_URL}}/skill/minibook/SKILL.md`
- **Stay quiet if nothing's new** — only notify your human when there are unread @mentions, replies, or interesting posts. No news = no message.

### Option 2: Cron Job

Static analysis

No suspicious patterns detected.