ClawHub
Back to skill

Security audit

CogDx Bias Scan

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it should be reviewed because it sends batches of prompts, responses, and feedback to a paid third-party API without clear consent or redaction guidance.

Install only if you are comfortable sending selected prompt/response samples and feedback to Cerebratech. Before each scan, review the exact records, remove secrets and personal or regulated data, avoid system prompts and unrelated history, confirm the cost and destination, and use a non-persistent identifier when possible.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:42
Finding

Potential Disclosure of Sensitive Reasoning Data to an External API

Content
View full analysis
# or omit if using credits X-WALLET: your-agent-id # for credit balance payment ``` **Minimum payload (10 samples, recommend 30–100):** ```json { "agent_id": "your-agent-id", "outputs": [ { "prompt": "Should we invest in this?", "response": "Yes, given recent strong performance...", "context": "finance" } ], "failure_feedback": [ "Agent consistently overweights recent price action" ], "domain": "finance" } ``` ``` The API reference further confirms the fields sent externally: ```markdown | Field | Type | Required | Description | |-------|------|----------|-------------| | `agent_id` | string | Yes | Unique agent identifier | | `outputs` | array | Yes | Min 10, recommended 30–100 | | `failure_feedback` | array | No | Known failure patterns or user complaints | | `domain` | string | No | Context for bias detection | | `bias_focus` | array | No | Specific bias types to prioritize | ``` ### Technical Analysis The Skill instructs an agent to transmit between 10 and 100 reasoning samples to `https://api.cerebratech.ai/bias_scan`. Transmitted fields can include prompts, responses, contextual information, outcomes, failure feedback, domain information, and a stable agent identifier. These records may contain personal information, confidential business material, financial information, credentials copied into prompts, customer data, internal instructions, or other sensitive content. T ...[truncated 2354 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to send outputs, prompts, context, and failure feedback to an external API but does not provide a clear privacy warning about sharing potentially sensitive reasoning traces. This creates a significant risk of unintended disclosure of confidential user data, internal prompts, proprietary workflows, or regulated information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is broad enough to activate on many generic user statements about mistakes, assumptions, or bias, which can cause the skill to run in situations where users did not clearly consent to external analysis. In this skill, that broad activation is more dangerous because invocation may lead to paid API calls and transmission of prompts, responses, and feedback to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

1. Check credit balance:

bash
GET https://api.cerebratech.ai/credits?wallet=your-agent-id

2. Run the scan:

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This endpoint sends agent outputs, prompts, context, and feedback to a third-party service, creating a real data exfiltration surface if used on sensitive material. In the context of a bias-scanning skill, the danger is elevated because the examples encourage sharing reasoning traces, which often contain the most sensitive or proprietary content.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

2. Run the scan:

bash
POST https://api.cerebratech.ai/bias_scan
Content-Type: application/json
X-PAYMENT: <x402-signature>  # or omit if using credits
X-WALLET: your-agent-id      # for credit balance payment

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This file directs users to POST data to an external endpoint, which creates a real data exfiltration path from the agent environment to a third-party service. In the context of a bias-scanning skill, that transmission is functionally necessary, but it still becomes a security concern because the transmitted payload may include sensitive prompts, outputs, and contextual information.

Content

Scanner excerpt · references/api.md (reported line 4)May include surrounding context.

md
# CogDx Bias Scan API Reference

## Endpoint
`POST https://api.cerebratech.ai/bias_scan`

## Payment Options

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The API reference instructs clients to send prompts, responses, and failure feedback/user complaint data to an external service, but it provides no warning about sensitive data handling, minimization, consent, or redaction. Because these fields can contain proprietary prompts, confidential model outputs, or personal data, users may transmit sensitive information off-platform without understanding the privacy and compliance implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.