ClawHub
Back to skill

Security audit

WebUntis

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide read-only WebUntis timetable access, but it has credential-handling weaknesses users should review before installing.

Install only if you are comfortable giving the skill a dedicated WebUntis account, preferably read-only with a unique password. Configure only HTTPS WebUntis URLs, avoid the --pass option, and provide credentials through protected environment variables or a secret manager.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/webuntis.py:62
Finding

WebUntis Credentials Can Be Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/webuntis.py:224
Finding

Password Can Be Exposed through a Command-Line Argument

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requires access to environment variables and the network, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a least-privilege gap: the runtime may grant broader capabilities than necessary, making credential exposure or unintended outbound access harder to constrain and audit.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/webuntis.py (reported line 63)May include surrounding context.

python
self.timeout = timeout
        self.session = requests.Session()
        self._rpc_id = 1
        self.last_auth = None
        self._cache = {}

    @property