ClawHub
Back to skill

Security audit

Bring Rezepte

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its Bring shopping-list purpose, but it has a real account-token leak risk and weaker credential handling that should be reviewed before installation.

Review or fix the unrestricted --content-url behavior before installing, and only fetch official Bring template-content URLs. Provide Bring credentials through a protected environment or secret manager rather than --password, keep list modifications behind explicit confirmation, and install using the committed lockfile.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bring_list.js:373
Finding

Authenticated Bring Headers Can Be Exfiltrated to an Arbitrary Host

Content
View full analysis
s.trim()) .filter(Boolean); const allItems = []; for (const url of urls) { const content = await fetchContent(url, bring.headers); const items = extractItemsFromContent(content); allItems.push(...items); } ``` The sensitivity of `bring.headers` is confirmed by `references/bring-inspirations.md:12-18`: ```md 2. Set headers for subsequent calls: - `X-BRING-API-KEY`: `` - `X-BRING-CLIENT`: `webApp` - `X-BRING-CLIENT-SOURCE`: `webApp` - `X-BRING-COUNTRY`: `DE` (use user locale country if known) - `X-BRING-USER-UUID`: `` - `Authorization`: `Bearer ` ``` ### Technical Analysis The `--content-url` option accepts a caller-controlled, comma-separated collection of URLs. The code does not validate the URL scheme, hostname, port, or path before passing each URL to `fetchContent`. After the Skill logs into the Bring service, it passes the complete `bring.headers` object to `fetch`. According to the bundled API reference, that object contains an OAuth-style bearer access token and the user's Bring UUID. Consequently, a direct URL pointing to an attacker-controlled server receives headers intended only for the Bring API. The declared functionality only requires authenticated requests to Bring template endpoints such as: ```text https://api.getbring.com/rest/v2/bring ...[truncated 1942 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/bring_list.js:112
Finding

Bring Account Password Can Be Supplied Through Exposed Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill uses sensitive capabilities including environment-provided credentials and network access, but does not declare an explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where the runtime may permit broader tool use than intended, making it harder to enforce least privilege and increasing the risk of accidental or unauthorized external actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation guidance is broad enough to trigger on general meal-planning and shopping-related requests, which can cause the agent to invoke a credentialed, networked skill in situations where the user did not clearly ask for Bring account actions. Because the skill can list shopping lists and add items after follow-up prompts, over-triggering increases the chance of unnecessary data access and unintended account modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation instructs the agent to add items to a Bring shopping list but provides no requirement for explicit user confirmation before modifying persistent user data. In an agent setting, this can lead to unauthorized or accidental list changes, especially when recipe suggestions are generated or selected automatically from external content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script accepts Bring account credentials via --email and --password CLI flags, which commonly exposes secrets through shell history, process listings, job-control logs, and orchestration telemetry. Because this skill’s purpose is recipe inspiration and URL parsing, taking raw credentials on the command line is not necessary and increases the chance of accidental credential disclosure rather than serving a security need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code logs into an external Bring service with user credentials and later sends recipe URLs to the service via API calls, but the file provides no comment, docstring, or user-facing notice explaining that credentials and supplied URLs will be transmitted over the network. For a code file, these network and credential-handling operations meet the safety-critical criteria and lack visible disclosure in the file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script loads executable code from BRING_NODE_API_PATH via require(envPath), allowing whoever controls the environment to substitute an arbitrary module. In an agent or automation context, environment variables are often configurable by deployment tooling or wrappers, so this becomes a code-execution hook unrelated to normal shopping-list functionality.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
// Create the list via the Bring API (POST with form-urlencoded)
    const userUuid = bring.uuid || bring.headers["X-BRING-USER-UUID"];
    const baseUrl = bring.url || "https://api.getbring.com/rest/v2/";
    const createUrl = `${baseUrl}bringusers/${userUuid}/lists`;

    const formBody = new URLSearchParams({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
// Create the list via the Bring API (POST with form-urlencoded)
    const userUuid = bring.uuid || bring.headers["X-BRING-USER-UUID"];
    const baseUrl = bring.url || "https://api.getbring.com/rest/v2/";
    const createUrl = `${baseUrl}bringusers/${userUuid}/lists`;

    const formBody = new URLSearchParams({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bring-inspirations.md (reported line 9)May include surrounding context.

md
// Create the list via the Bring API (POST with form-urlencoded)
    const userUuid = bring.uuid || bring.headers["X-BRING-USER-UUID"];
    const baseUrl = bring.url || "https://api.getbring.com/rest/v2/";
    const createUrl = `${baseUrl}bringusers/${userUuid}/lists`;

    const formBody = new URLSearchParams({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bring-inspirations.md (reported line 37)May include surrounding context.

md
// Create the list via the Bring API (POST with form-urlencoded)
    const userUuid = bring.uuid || bring.headers["X-BRING-USER-UUID"];
    const baseUrl = bring.url || "https://api.getbring.com/rest/v2/";
    const createUrl = `${baseUrl}bringusers/${userUuid}/lists`;

    const formBody = new URLSearchParams({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bring_list.js (reported line 166)May include surrounding context.

js
// Create the list via the Bring API (POST with form-urlencoded)
    const userUuid = bring.uuid || bring.headers["X-BRING-USER-UUID"];
    const baseUrl = bring.url || "https://api.getbring.com/rest/v2/";
    const createUrl = `${baseUrl}bringusers/${userUuid}/lists`;

    const formBody = new URLSearchParams({

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction 'Keep the skill output in German for Germany by default' imposes a language/locale preference in natural language without stating that the user may choose another language. The policy allows locale constraints when justified or opt-in is offered, but neither is present here.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency version is specified with a caret range (^2.0.1), which allows newer compatible releases to be installed automatically. This creates supply-chain risk because a compromised or malicious upstream release could be pulled in without code changes, and this skill interacts with shopping-list/account functionality where a dependency compromise could affect user data or perform unauthorized actions.

Content

Scanner excerpt · scripts/package.json (reported line 4)May include surrounding context.

json
{
  "type": "commonjs",
  "dependencies": {
    "bring-shopping": "^2.0.1"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/bring_list.js:5