ClawHub
Back to skill

Security audit

Proxyllm Account

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it deserves review because it can create and configure a paid external LLM gateway account, handle powerful tokens, and optionally run an unpinned package.

Install only if you specifically want an agent to set up ProxyLLM. Require explicit confirmation before signup, OTP use, checkout handoff, token storage, routing-key creation, provider-lane wiring, or Codex subscription connection. Treat `sk_` and `pllm_` values as secrets, set budgets on routing keys, and avoid the unpinned `npx -y` MCP path unless you pin and review the package or run it in a constrained sandbox.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:103
Finding

Unpinned Third-Party Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-104
Vulnerability Type: Unpinned and unverified dependency execution
Risk Level: High

Vulnerable Code:

markdown
Prefer MCP? The same surface is one server away:
`npx -y proxyllm-mcp` (official registry: `ai.proxyllm/proxyllm-mcp`).

Technical Analysis

The documented npx -y proxyllm-mcp command downloads and executes the package currently resolved by the npm registry. It does not specify an exact version, verify an integrity hash, use a reviewed lockfile, or require confirmation before installation. The -y option automatically accepts installation prompts.

Consequently, the code executed on a user's system can change after this skill has been audited. A compromised npm publisher account, compromised package, malicious future release, or registry-level supply-chain incident could cause arbitrary package code to run. The separate “official registry” statement does not cryptographically bind the npm artifact to a trusted source or version.

Attack Path

  1. An attacker compromises the proxyllm-mcp package, its publisher account, or a relevant distribution channel.
  2. The attacker publishes a malicious package release under the package name used by the documented command.
  3. An operator or agent follows the skill instructions and invokes npx -y proxyllm-mcp.
  4. npx resolves and downloads the current package release without enforcing a previously audited version or integrity value.
  5. Package installation hooks or runtime code execute with the privileges and environment of the invoking user.
  6. The malicious package can access resources available to that user, including readable files, environment variables, credentials, and reachable services.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running npx. The affected scope may include the user's files, environ ...[truncated 523 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version, for example npx --yes proxyllm-mcp@<exact-version>, rather than resolving the latest release.
  2. Maintain a lockfile and verify the package artifact against a trusted integrity hash before execution.
  3. Review the package contents, dependency tree, lifecycle scripts, and published provenance for every intended upgrade.
  4. Disable package lifecycle scripts where operationally feasible and avoid automatically accepting installation prompts.
  5. Prefer a locally installed, reviewed dependency invoked through a locked project configuration instead of downloading code at runtime.
  6. Execute the MCP server in a sandbox or container with minimal filesystem permissions, restricted network access, a sanitized environment, and no unrelated credentials.
  7. Document the expected package publisher, exact version, checksum, and trusted distribution source so operators can verify authenticity.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description is broad enough to trigger on generic requests like setting up LLM access, reducing API spend, or adding provider fallback, which can cause the agent to initiate account creation and payment-adjacent workflows without a narrowly scoped user request. Because this skill provisions external accounts and handles billing flow handoff, over-broad activation increases the chance of unintended sensitive actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Step 1: sign up with your operator's email

bash
curl -X POST "https://proxyllm.ai/api/auth?action=agent-signup" \
  -H "Content-Type: application/json" \
  -d '{"email": "OPERATOR_EMAIL", "source": "clawhub"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the agent to store and use a full management token (sk_...) and later a routing key (pllm_...) but does not foreground the credential sensitivity or warn against exposing these tokens in chat, logs, or downstream tools. Since the account token is a full management credential and is returned only once, leakage would allow unauthorized account administration, lane wiring, and usage visibility.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

  1. Poll until the plan flips, then continue:
bash
curl -s https://api.proxyllm.ai/v1/organizations/me \
  -H "Authorization: Bearer $SK_TOKEN"   # plan: "free" -> "pro"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

  1. Poll until the plan flips, then continue:
bash
curl -s https://api.proxyllm.ai/v1/organizations/me \
  -H "Authorization: Bearer $SK_TOKEN"   # plan: "free" -> "pro"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

  1. Poll until the plan flips, then continue:
bash
curl -s https://api.proxyllm.ai/v1/organizations/me \
  -H "Authorization: Bearer $SK_TOKEN"   # plan: "free" -> "pro"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

  1. Poll until the plan flips, then continue:
bash
curl -s https://api.proxyllm.ai/v1/organizations/me \
  -H "Authorization: Bearer $SK_TOKEN"   # plan: "free" -> "pro"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

  1. Poll until the plan flips, then continue:
bash
curl -s https://api.proxyllm.ai/v1/organizations/me \
  -H "Authorization: Bearer $SK_TOKEN"   # plan: "free" -> "pro"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

  1. Poll until the plan flips, then continue:
bash
curl -s https://api.proxyllm.ai/v1/organizations/me \
  -H "Authorization: Bearer $SK_TOKEN"   # plan: "free" -> "pro"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

  1. Poll until the plan flips, then continue:
bash
curl -s https://api.proxyllm.ai/v1/organizations/me \
  -H "Authorization: Bearer $SK_TOKEN"   # plan: "free" -> "pro"

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill recommends executing npx -y proxyllm-mcp without pinning a specific package version or integrity, which allows execution of whatever code is currently published under that package name. This creates a supply-chain risk: a malicious update, account compromise, or typo-squatted replacement could cause arbitrary code execution on the operator's machine.

Content

No source excerpt is available for this finding.