ClawHub
Back to skill

Security audit

FaxAgent-Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for faxing, but it needs review because it handles sensitive documents and payment links while trusting returned URLs and exposing job tokens in examples.

Review before installing. Only use this skill when you intend to send or track a fax, verify that upload and payment links stay on the expected FaxAgent.ai domain, avoid sharing full tokenized URLs, and do not pass fax tokens on the command line or in logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:155
Finding

Unvalidated Server-Provided URLs Enable Document Exfiltration and Payment Redirection

Content
View full analysis

Vulnerability Details

File Location: skill.md:155-181 and skill.md:270-272
Vulnerability Type: Improper validation of remotely supplied URLs
Risk Level: Medium

Vulnerable Code

text
Parse response:

fax_id, token, upload_url, status_url, preview_url, pay_url

Surface upload_url to the human (token redacted in public contexts).

If cost > 0 and pay_url present:

🧑‍⚖️ Instruct the human to complete payment

❌ Do not auto-pay

Poll status_url until terminal status:

done ✅ or failed ❌
bash
curl -sS -X POST "<UPLOAD_URL>" \
  -H "Content-Type: multipart/form-data" \
  -F "file=@./document.pdf;type=application/pdf" \
  -F "meta={\"cover\":\"Please deliver\"};type=application/json"
text
✅ Surface pay_url to the human for payment.

✅ If explicit payment metadata is provided (wallet address/payment token), you may construct a convenience URL.

Technical Analysis

The Skill instructs the agent to trust upload_url, status_url, preview_url, and pay_url values returned by the remote API. It does not require parsing these URLs or verifying their scheme, hostname, port, path, or redirect destination before presenting or using them.

Consequently, a compromised API, malicious intermediary affecting the API response, or server-side response manipulation could cause the agent to use an attacker-controlled URL. The upload example is particularly sensitive because it transmits a local PDF to the supplied URL. Presenting an unvalidated payment URL can similarly direct the user to a phishing or fraudulent payment page.

Token redaction in public contexts does not resolve this issue because the complete tokenized URL may still be sent to an unauthorized host by the agent or opened by the user.

Attack Path

  1. An attacker compromises the remote API or otherwise gains the ability to manipulate its response.
  2. The response replaces upload_url, `statu ...[truncated 899 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse every server-provided URL before displaying or using it.
  • Require HTTPS and reject embedded credentials, nonstandard ports, malformed URLs, and protocol-relative URLs.
  • Enforce an explicit hostname allowlist, such as the exact trusted faxagent.ai hostname and any separately documented first-party upload or payment hosts.
  • Validate expected path prefixes for upload, status, preview, and payment endpoints.
  • Disable redirects or verify the destination of every redirect against the same allowlist.
  • Do not construct payment URLs from arbitrary remote metadata. Use a fixed trusted payment origin and encode each query parameter safely.
  • Require explicit user confirmation before uploading a document to any URL whose origin differs from the documented service origin.
  • Treat origin validation failures as fatal and display a warning without opening, polling, or uploading to the URL.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:192
Finding

Fax Job Token Exposed Through Command-Line Arguments and Request URLs

Content
View full analysis

Vulnerability Details

File Location: skill.md:192-214
Vulnerability Type: Sensitive token exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
Save as poll-fax-status.sh and run:

bash poll-fax-status.sh <fax_id> <token>
bash
#!/usr/bin/env bash
set -euo pipefail

FAX_ID="${1:?fax_id required}"
TOKEN="${2:?token required}"

STATUS_URL="https://faxagent.ai/api/status?fax_id=${FAX_ID}&token=${TOKEN}"

INTERVAL=5
MAX_LOOP=180 # ~15 minutes max
COUNT=0
prev_status=""

while [ $COUNT -lt $MAX_LOOP ]; do
  out=$(curl -sS "$STATUS_URL") || { echo "Failed to query status"; exit 2; }

Technical Analysis

The polling example accepts the sensitive job token as the script's second command-line argument. Command-line arguments may be recorded in interactive shell history and can be visible through process inspection facilities while the script runs.

The script also interpolates the token into STATUS_URL and passes that complete URL as an argument to curl. This creates another period during which the tokenized URL may be visible in the process list. URLs are also commonly captured by debugging systems, command tracing, proxy logs, monitoring agents, and network-client diagnostics.

These behaviors conflict with the Skill's stated requirement to avoid printing or storing raw tokens.

Attack Path

  1. A user follows the documented command and supplies a valid fax token as a positional argument.
  2. The invoking command is retained in shell history, or another local user or monitoring process inspects the script or curl process arguments.
  3. The observer retrieves the fax identifier and token.
  4. The observer constructs the corresponding status, preview, upload, or human-facing job URL.
  5. Depending on the server's token authorization model, the observer accesses job information or other token-protected fax funct ...[truncated 492 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not accept sensitive tokens as positional command-line arguments.
  • Read the token from protected standard input without terminal echo, for example with read -r -s TOKEN.
  • Alternatively, load it from a temporary credential file with mode 0600, delete the file promptly, and avoid shared temporary paths.
  • Prefer an HTTP authorization header over query-string authentication if the API supports it.
  • If query-string authentication is unavoidable, configure the HTTP client so the complete URL is not exposed in its command-line arguments or diagnostic output.
  • Disable shell tracing around sensitive operations and ensure monitoring, proxy, and application logs redact token query parameters.
  • Clear temporary variables when polling finishes and retain tokens only for the minimum required lifetime.
  • Rotate or invalidate a token immediately if command history or process records may have exposed it.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
90% confidence
Finding

The skill manifest appears malformed and mixes YAML metadata with narrative content and pseudo-sections, which can confuse parsers or downstream agent tooling. In agent ecosystems, malformed or ambiguously structured metadata can enable prompt or tool-metadata poisoning effects, causing the system to misinterpret instructions, trust boundaries, or endpoint definitions.

Content

Scanner excerpt · skill.md (reported line 17)May include surrounding context.

�───────────────────────────────────────────────────────╯

Filename: Fxagent.skills.md
Role: A formal, AI-readable skill spec for integrating with the FaxAgent.ai API.

🧾 Metadata (machine-friendly)

yaml
name: FaxAgent
id: fxagent
version: 1.0
description: >
  Discover, create, upload, and track fax jobs via the FaxAgent.ai API.
  Supports promo tokens and surfaces upload/payment/status URLs to humans.
  Includes safe polling and upload helpers.
activation:
  - "fax"
  - "send fax"
  - "faxagent"
🔎 AI Index (quick scan)
yaml
Copy code
discovery_url: "https://faxagent.ai/api/discovery.json"
submit_endpoint: "POST /api/submit-fax"
status_endpoint: "GET /api/status?fax_id=<fax_id>&token=<token>"
preview_endpoint: "GET /preview/<fax_id>?token=<token>"
human_pages:
  - upload_url
  - status_page_url
  - pay_url
🎯

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation trigger includes the generic term "fax," which is broad enough to match ordinary user conversation and may cause this skill to activate unintentionally. In an agent environment, overly broad activation can route users into external API workflows without clear intent confirmation, increasing the chance of unintended data disclosure or actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 274)May include surrounding context.

md
✅ If explicit payment metadata is provided (wallet address/payment token), you may construct a convenience URL.

❌ Never auto-execute payments.

Example wallet presentation (display-only):

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation examples are conversational and ambiguous, such as "Send a fax to Mary," without defining strict invocation constraints. This makes accidental activation more likely in normal dialogue and can lead the agent to collect PII or initiate external service interactions based on casual language rather than explicit user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file instructs the agent to "show human-friendly hints," but all user-facing examples and operational guidance are implicitly English-only, with no option for user language choice or locale selection. This creates a natural-language policy concern if the skill is expected to operate across users without explicit English opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.