ClawHub
Back to skill

Security audit

deutero-setup

Security checks for vulnerabilities and agentic risk

Overview

The setup guidance is coherent, but it requires sending vendor feedback without user approval or clear limits on shared information.

Before installing, make vendor feedback optional and require approval of the exact report, excluding credentials, participant information and confidential study details. Prefer OAuth; API keys grant organization-wide access. All bundled files were inspected, but external SDK code, remote service behavior and the absent plugin configuration were not verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The snippet handles incoming interview-completion notifications rather than account creation, connection setup, authentication troubleshooting, or balance verification. Although the description mentions Python SDK access, this webhook-processing workflow is a distinct capability, not merely an implementation detail of establishing that access. No downstream processing is shown beyond the event check.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Although using the Python SDK is consistent with the declared integration context, this snippet performs a study-data operation. It does not demonstrate the declared setup or verification workflow, and study statistics are distinct from account credit balance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

Handling authentication and permission errors supports the declared setup purpose, but the protected operation is client.simulations.run(study_id, persona_id=persona_id), which initiates study work. The description explicitly places setup and verification before study work and does not declare simulation execution as part of this skill. The chunk does not show account creation, connection configuration, or balance verification.

Content

No source excerpt is available for this finding.

MCP Config Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Two methods work, and the right one depends on the client.

OAuth is the better choice wherever the client supports remote MCP authorization — claude.ai connectors, and any client that implements the MCP authorization spec. The user signs in with their Deutero account, no secret is stored in a config file, and they can revoke the client later under Connected Applications in Settings. This plugin's mcp.json declares the endpoint with no credentials for exactly this reason: authorization is the client's job, and a header in a package file is a secret in a shared file.

json
{

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/python-sdk.md (reported line 100)May include surrounding context.

md
| MCP tool | REST |
|---|---|
| `upload_question_image` | `POST /studies/{study_id}/questions/{question_id}/images` (optional `position`) |
| `delete_question_image` | `DELETE /studies/{study_id}/questions/{question_id}/images/{image_id}` |
| `upload_flow_image` | `POST /studies/{study_id}/graph/images` (returns the `url` for a step's `images`) |

**Not in 0.2 yet: branding.** The brand theme, the start screen's hero image and the welcome's start-screen copy came after 0.2. `client.welcome.set` sends only `message` and `consent`, so set the copy fields (`title`, `time_estimate`, `footer`, `continue_label`, `consent_yes_label`, `consent_no_label`, `hero_alt`) with the REST `PUT`:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/python-sdk.md (reported line 110)May include surrounding context.

md
| `get_theme` | `GET /theme` (optional `?study_id=`) |
| `set_theme` | `PUT /theme` (`{"theme": {…}, "custom_css": "…", "study_id": "…"}`; fields left out are unchanged) |
| `set_welcome` with start-screen copy | `PUT /studies/{study_id}/welcome` |
| `upload_welcome_hero` / `delete_welcome_hero` | `POST` / `DELETE /studies/{study_id}/welcome/hero` (`{"image_base64": "…", "alt": "…"}`) |

`plan-interview-research/references/branding.md` has the fields and refusals.

L81 mandates submitting feedback to the Deutero team, extending the skill beyond account setup and connection verification.

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The instruction mandates an outbound feedback submission to the vendor before responding to the user, without requiring consent or defining permitted report contents. In an authenticated research workflow, this could disclose confidential task details, study data or sensitive error context beyond what the user authorized; the source does not establish that such disclosure actually occurs.

Content

No source excerpt is available for this finding.