ClawHub
Back to skill

Security audit

CogDx Health Check (Free)

Security checks for vulnerabilities and agentic risk

Overview

This skill is review-worthy because it sends recent prompts and responses to a third-party diagnostic API without clear consent, redaction, or privacy handling instructions.

Only install or use this skill if you are comfortable sending selected recent prompts and responses to Cerebratech. Before use, avoid confidential workspaces, secrets, personal data, customer data, regulated content, and proprietary code unless the publisher provides clear consent, redaction, retention, and deletion guarantees.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:28
Finding

Unprotected Disclosure of Conversation Content to a Third-Party Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–49
Vulnerability Type: Sensitive Data Disclosure
Risk Level: Medium

Complete Code Snippet:

markdown
## API Call

```bash
POST https://api.cerebratech.ai/cogdx-health
Content-Type: application/json

Payload:

json
{
  "agent_id": "your-agent-id",
  "outputs": [
    {
      "prompt": "...",
      "response": "...",
      "stated_confidence": 0.85,
      "correct": true,
      "complexity": "complex"
    }
  ]
}

Minimum: 10 outputs. Recommended: 20.

text

The same external endpoint and required prompt/response fields are corroborated in `references/api.md`, lines 3–21.

### Technical Analysis

The skill instructs an agent to collect and transmit 10–20 recent prompts and responses to `https://api.cerebratech.ai/cogdx-health`. These records can contain credentials, personal information, proprietary code, confidential business data, or private conversation context.

The documented flow does not require informed user approval for the exact payload, manual sample selection, content minimization, secret or PII redaction, anonymization, or a review step before transmission. The required `agent_id` may also allow separate submissions to be correlated over time. Although HTTPS protects data in transit, it does not prevent the receiving third party from accessing or retaining the submitted plaintext content.

### Attack Path

1. A user invokes the skill through a phrase such as “health check” or “check my reasoning.”
2. The agent selects at least ten recent outputs, including their original prompts and responses.
3. One or more selected records contain confidential data from prior interactions.
4. The agent places those records and an agent identifier into the documented JSON payload.
5. The payload is transmitted to the third-party Cerebratech API.
6. The external service receives the sensitive conten
...[truncated 884 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed confirmation immediately before each request, showing the destination, purpose, and exact records to be transmitted.
  2. Let users manually select or exclude samples rather than automatically collecting recent conversation history.
  3. Apply local secret scanning and redact credentials, authentication tokens, personal information, proprietary source code, and other confidential values before transmission.
  4. Minimize submitted content by extracting only the features required for calibration analysis or perform the analysis locally where feasible.
  5. Replace persistent agent identifiers with random, per-request pseudonymous identifiers unless correlation is strictly necessary and separately authorized.
  6. Document the service’s data retention, deletion, secondary-use, access-control, and privacy policies in the skill.
  7. Provide a final payload preview and require approval after redaction but before network transmission.
  8. Reject submissions when sensitive content cannot be reliably removed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill advertises activation on very broad phrases like 'health check', 'quick diagnostic', and 'what's wrong with me', which can match ordinary user conversation rather than an explicit request to invoke this external diagnostic workflow. In this skill's context, broad triggering is especially risky because activation leads to sending 10–20 recent outputs, including prompts and responses, to a third-party service, creating a realistic path for unintended data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs the agent to send recent outputs, prompts, responses, confidence scores, and correctness data to an external API without a prominent warning or consent mechanism. Because these 'recent outputs' may contain sensitive user content, internal reasoning artifacts, or confidential workflow data, omission of a clear disclosure materially increases the chance of covert exfiltration.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The core behavior of the skill is to transmit recent prompts and responses to an external service for analysis, which is a direct data-sharing action. Even if intended for diagnostics, this is dangerous because the sampled interactions can contain personal data, secrets, proprietary information, or regulated content that the agent should not disclose without authorization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The file contains an external API endpoint and directs the agent to POST diagnostic data to it. External transmission is not inherently malicious, but in this case it becomes security-relevant because the payload includes conversation-derived content and model assessment metadata, increasing confidentiality and privacy risk.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

API Call

bash
POST https://api.cerebratech.ai/cogdx-health
Content-Type: application/json

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This skill depends on transmitting agent outputs to an external domain, which is inherently a trust-boundary crossing. In the context of a diagnostic skill that requests 10–20 recent outputs, the external call is more dangerous because the payload is likely to include sensitive conversation content, making exfiltration possible if the endpoint is untrusted, compromised, or used without adequate disclosure.

Content

Scanner excerpt · references/api.md (reported line 4)May include surrounding context.

md
# CogDx Health Check API Reference

## Endpoint
`POST https://api.cerebratech.ai/cogdx-health`

## Request Schema

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The API reference instructs agents to send recent prompts and responses to a third-party endpoint, but it provides no privacy notice, data minimization guidance, or handling restrictions. Because prompts and responses often contain sensitive user data, secrets, internal reasoning artifacts, or proprietary content, this omission creates a real risk of unintended data exfiltration and unsafe downstream sharing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.