ClawHub
Back to skill

Security audit

pref0

Security checks for vulnerabilities and agentic risk

Overview

The skill's preference-learning purpose is clear, but it asks agents to send full conversations and stable user identifiers to pref0 and to apply returned prompt text as future instructions.

Review this before installing. Use it only if users knowingly opt in to sending conversations to pref0, prefer pseudonymous user IDs, avoid sending secrets or sensitive conversations, and render only validated structured preferences instead of directly injecting the returned prompt into system instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:119
Finding

Excessive Disclosure of Identifiable Conversation Data to an External Service

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:121
Finding

Untrusted Remote Prompt Is Injected Directly into the System-Prompt Context

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
notes.txt:1
Finding

Unpinned Package Is Installed Globally from the npm Registry

Content
View full analysis
Remediation
View remediation
`. - Verify package provenance, publisher identity, signatures, and registry source. - Record and verify the expected package integrity digest. - Prefer a project-local or isolated installation over a global installation. - Avoid running npm or the CLI with administrator or root privileges. - Disable lifecycle scripts where operationally possible, then explicitly review any required scripts. - Use an allowlisted registry and reject unexpected registry configuration. - Test upgrades in an isolated environment before updating the documented version. - Protect login tokens with narrowly scoped permissions and rotate them if an installed package is suspected of compromise. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
### After a conversation ends → Track it

After finishing a conversation (or at natural breakpoints), send the messages to pref0 so it can extract preferences. This is especially valuable when the user **corrects** you (e.g., "use pnpm, not npm") or states explicit preferences (e.g., "always use metric units").

### Before responding to a user → Fetch their preferences

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
Each preference includes `evidence` (the quote that triggered extraction), `firstSeen` (when first learned), and `lastSeen` (when last reinforced). The `prompt` field is a ready-to-use string you can append directly to your system prompt.

### Delete a user profile (DELETE /v1/profiles/:userId)

Reset a user's learned preferences. Use for preference resets or data deletion requests.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs agents to send conversation messages to a third-party API after conversations end, but it provides no requirement for informed user consent, privacy notice, minimization, or redaction. This creates a real privacy risk because conversations may contain sensitive or regulated data that is unnecessarily disclosed to an external service.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill promotes storing and retransmitting full conversation history plus quoted user statements across sessions to build persistent profiles. This creates durable cross-session data exposure and increases the chance that sensitive content, secrets, or regulated information is retained and resurfaced beyond the original context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This endpoint sends conversation content to an external domain using an API key, which is a genuine external transmission path for potentially sensitive user data. In this skill's context, the danger is not mere network use but that the transmitted payload contains conversation history intended for profiling.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Send a conversation so pref0 can learn from it. It extracts corrections, explicit preferences, and behavioral patterns automatically.

bash
curl -X POST https://api.pref0.com/v1/track \
  -H "Authorization: Bearer $PREF0_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This endpoint sends conversation content to an external domain using an API key, which is a genuine external transmission path for potentially sensitive user data. In this skill's context, the danger is not mere network use but that the transmitted payload contains conversation history intended for profiling.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Send a conversation so pref0 can learn from it. It extracts corrections, explicit preferences, and behavioral patterns automatically.

bash
curl -X POST https://api.pref0.com/v1/track \
  -H "Authorization: Bearer $PREF0_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Ssd 1

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill says the external service returns a natural-language 'prompt' that is 'ready-to-use' and can be appended directly to the system prompt. Directly injecting externally generated text into the system prompt creates a prompt-injection/control-plane risk, because malicious or malformed stored content could alter model behavior across future sessions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Retrieve the user's learned preference profile. Use ?minConfidence=0.5 to only get well-learned preferences suitable for system prompt injection.

bash
curl https://api.pref0.com/v1/profiles/<user-id>?minConfidence=0.5 \
  -H "Authorization: Bearer $PREF0_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Retrieve the user's learned preference profile. Use ?minConfidence=0.5 to only get well-learned preferences suitable for system prompt injection.

bash
curl https://api.pref0.com/v1/profiles/<user-id>?minConfidence=0.5 \
  -H "Authorization: Bearer $PREF0_API_KEY"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow recommends stable identifiers such as email or phone number for the external profile service without warning about the sensitivity of those identifiers or suggesting pseudonymous alternatives. Using direct personal identifiers increases privacy, correlation, and compliance risk if the external service is breached or misused.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The integration workflow explicitly instructs sending the full message history to an external service at the end of a session. Full-history export materially increases privacy and data-governance risk because it transfers far more user content than is needed to capture simple preferences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.