ClawHub
Back to skill

Security audit

Research

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed market-research workflow, but it can search prior sessions and sibling project source data without clear user consent or scope limits.

Review this skill before installing if your workspace includes confidential prior sessions or multiple private projects. Use it only where cross-project research is acceptable, or disable/avoid the session_search and codegraph/project_code_search tools unless you explicitly want the agent to consult that data. The public web and Reddit behavior is expected for market research, and docs/research.md file creation is expected.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:113
Finding

Excessive Access to Prior Sessions and Sibling Project Source Data

Content
View full analysis
", n_results=5)` - If MCP `session_search` available: `session_search(query="")` — check if this idea was researched before - Otherwise: Grep for keywords in `.md` files - Check if `research.md` or `prd.md` already exist for this idea. 4. **Check existing portfolio** (if MCP codegraph tools available): - `codegraph_explain(project="")` — architecture overview of related projects in the portfolio - `project_code_search(query="", project="")` — find reusable code, patterns, infrastructure - `codegraph_query("MATCH (p:Project)-[:DEPENDS_ON]->(pkg:Package) WHERE pkg.name CONTAINS '' RETURN p.name, pkg.name")` — find projects using similar tech ``` ### Technical Analysis The skill directs the agent to search historical sessions and inspect architecture, dependencies, and source patterns from sibling projects. These resources may contain confidential user context, proprietary source code, credentials inadvertently recorded in session history, or information belonging to projects outside the current research task. Although the MCP tools are included in the skill's declared tool list, the workflow does not require explicit user authorization before crossing current-project boundaries. Market research can be completed without accessing unrelated session history or sibling-project source data. This violates least-privilege principles and creates a risk of unintended cross-project disclosure. The issue does not prove that the skill obtains operating-sys ...[truncated 1785 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:75
Finding

Unpinned Third-Party PRAW Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
- Example: `old.reddit.com/r/indiehackers/comments/abc123/post_title/`

**Method 2: PullPush API** (for search/discovery)
- Endpoint: `https://api.pullpush.io/reddit/submission/search`
- Params: `q`, `subreddit`, `author`, `score` (e.g. `>10,<100`), `since`/`until` (unix timestamps), `size` (max 100)
- Rate limits: soft 15 req/min, hard 30 req/min, 1000 req/hr. Sleep 4 sec between requests.
- Returns JSON with full `selftext`, author, score, created_utc

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
- Example: `old.reddit.com/r/indiehackers/comments/abc123/post_title/`

**Method 2: PullPush API** (for search/discovery)
- Endpoint: `https://api.pullpush.io/reddit/submission/search`
- Params: `q`, `subreddit`, `author`, `score` (e.g. `>10,<100`), `since`/`until` (unix timestamps), `size` (max 100)
- Rate limits: soft 15 req/min, hard 30 req/min, 1000 req/hr. Sleep 4 sec between requests.
- Returns JSON with full `selftext`, author, score, created_utc

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown skill clearly states that it produces a structured research.md, and later specifies writing to docs/research.md, but the user-facing description does not warn near the top that running the skill will create files in the current project. For markdown files, SQP-2 applies when behavior affecting user data or system integrity is not disclosed in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.