ClawHub
Back to skill

Security audit

Octolens

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate Octolens API helper, but it under-declares network/code execution needs and includes unsafe installation and API-key handling guidance.

Install only after reviewing the unsafe setup guidance. Do not run the curl-to-sudo NodeSource command as written; provision Node.js through a trusted package manager or verified installer. Treat Octolens API keys as secrets, prefer environment variables or a secret manager over command-line arguments, and expect query filters plus returned mention data to be sent to and processed by Octolens.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/README.md:13
Finding

Unverified Remote Script Executed with Root Privileges

Content
View full analysis

Vulnerability Details

File Location: scripts/README.md:13-16
Vulnerability Type: Remote payload retrieval and privileged execution
Risk Level: Critical

Vulnerable Code

bash
# Install Node.js if needed (Ubuntu/Debian)
curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
sudo apt-get install -y nodejs

Technical Analysis

The documented installation procedure downloads a mutable shell script from an external server and pipes it directly into sudo bash. The downloaded payload is neither included in the audited project nor pinned to a cryptographic digest or verified signature. Consequently, the code that ultimately executes can change after the Skill has been reviewed.

The sudo invocation causes the remote payload to run with root privileges. Any compromise of the hosting infrastructure, delivery path, DNS resolution, certificate trust chain, or published setup script could therefore turn this prerequisite command into arbitrary privileged code execution.

This behavior exceeds the minimum privileges necessary for the Skill’s declared functionality. The Skill only needs an existing Node.js 18-or-later runtime and network access to the Octolens API; it does not inherently require arbitrary remote code to execute as root.

Attack Path

  1. A user follows the Node.js installation instructions in scripts/README.md.
  2. curl retrieves the current response from https://deb.nodesource.com/setup_18.x.
  3. The response is passed directly to sudo -E bash without local inspection or integrity verification.
  4. If the remote response or its delivery mechanism has been compromised, attacker-controlled shell commands execute as root.
  5. The payload can modify system files, install software, access root-readable information, create accounts, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution with root privileges on the m ...[truncated 637 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the pipe-to-shell installation command from the documentation.
  2. Prefer Node.js packages supplied through the operating system’s authenticated package repositories.
  3. If an external repository must be configured, document explicit, reviewable steps rather than executing a remotely supplied setup script.
  4. Pin downloaded artifacts to a specific version and verify a publisher signature or an independently published SHA-256 digest before execution.
  5. Download scripts to a local file, inspect them, and only then execute the verified artifact.
  6. Avoid root execution where possible. Use elevated privileges only for individual package-management operations that require them.
  7. Recommend that users provision Node.js separately from running the Skill, keeping runtime installation outside the Skill’s normal workflow.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch-mentions.js:33
Finding

Octolens API Keys Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch-mentions.js:33-42; the same credential pattern also appears in scripts/list-keywords.js:29-35, scripts/list-views.js:29-35, scripts/query-mentions.js:33-42, scripts/advanced-query.js:53-61, SKILL.md:208-230, and scripts/README.md:24-122
Vulnerability Type: Insecure secret handling through process arguments
Risk Level: Medium

Vulnerable Code

javascript
async function main() {
  const args = process.argv.slice(2);
  const apiKey = args[0];
  const limit = args[1] || 20;
  const includeAll = args[2] || false;

  if (!apiKey) {
    console.error('Error: API key required');
    console.error(`Usage: ${process.argv[1]} YOUR_API_KEY [limit] [includeAll]`);

The corresponding documented invocation is:

bash
node scripts/fetch-mentions.js YOUR_API_KEY [limit] [includeAll]

Equivalent command-line API-key handling is implemented by all five bundled JavaScript executables.

Technical Analysis

The scripts require the Octolens bearer token as the first command-line argument and retrieve it from process.argv. Supplying credentials this way can expose them through:

  • Interactive shell history.
  • Process listings or process-inspection interfaces while the script is running.
  • Endpoint monitoring and command telemetry.
  • Debugging, auditing, or crash-collection systems that record command lines.
  • Automation logs that capture invoked commands.

The scripts use the token in an Authorization: Bearer header and send it only to the fixed, declared HTTPS origin https://app.octolens.com/api/v1. The audit found no unrelated receiver or deliberate token exfiltration. Authentication to Octolens is necessary for the declared functionality, but exposing the token through command-line arguments is not necessary.

Attack Path

  1. A user follows the documentation and substitutes a real Octolens API key for YOUR_API_KEY. ...[truncated 1151 chars]
Remediation
View remediation

Remediation Suggestions

  1. Stop accepting API keys as command-line arguments.
  2. Read the key from a protected environment variable such as OCTOLENS_API_KEY, while warning users not to place it in committed environment files:
    javascript
    const apiKey = process.env.OCTOLENS_API_KEY;
  3. For interactive use, support a hidden prompt that does not echo the token or save it in shell history.
  4. For automated environments, integrate with the platform’s secret manager and inject the credential only at runtime.
  5. Update SKILL.md, scripts/README.md, and all examples so commands never contain literal credentials.
  6. Avoid logging the token, request headers, complete environment, or process arguments.
  7. Recommend short-lived, revocable, least-privilege API tokens and document prompt rotation after suspected exposure.
  8. Where supported, restrict tokens to read-only Octolens endpoints and the minimum required organization scope.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code does interact with the Octolens mentions endpoint, so it is related to fetching mentions. However, the declared description substantially overstates the implemented capabilities. The script only retrieves mentions with two simple parameters: limit and includeAll. It does not expose or implement the advertised analysis features, source/platform filters, keyword logic, date ranges, follower thresholds, or bookmark handling. Therefore, the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a broad mention-querying and analysis capability over Octolens data. The supplied code only lists keywords from the /keywords endpoint and outputs the raw JSON. While keywords are related to tracking, the script does not fetch mentions, analyze sentiment or engagement, apply filters, or implement the complex query features described. This is a material mismatch in primary purpose and supported capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose centers on fetching and analyzing brand mentions across platforms with rich filtering and analytics capabilities. The supplied code only calls the Octolens /views endpoint to retrieve saved views and output them. This is a materially different primary purpose and omits the core described behaviors such as mention queries, source filtering, sentiment, engagement, and boolean/date/follower filtering. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Scope Creep

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The declared allowed tools are only 'Node Read', yet the skill instructs both network access and Node.js script execution. This mismatch undermines policy enforcement and informed consent: an operator may approve the skill believing it is read-only while it actually transmits data externally and expects code execution. In a security-sensitive environment, capability misrepresentation is dangerous even if the target API is legitimate.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The README instructs users to pipe content fetched over the network directly into sudo bash, creating a classic command-chaining/supply-chain execution risk. If the remote source, transport, DNS, or local environment is compromised, arbitrary code would run as root; documentation that normalizes this pattern materially increases user exposure even if the author likely intended convenience.

Content

Scanner excerpt · scripts/README.md (reported line 15)May include surrounding context.

brew install node

Install Node.js if needed (Ubuntu/Debian)

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs

text

Lp1

High
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The script performs outbound network requests with fetch to the Octolens API, but the static finding indicates this capability is not declared in permissions. Undeclared network access is a real security/governance issue because it expands the skill's effective capabilities beyond what reviewers and users expect, and could enable unapproved data exfiltration if the code were modified or reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill asks for an API key and sends brand-query filters and mention data to a third-party service, but it does not provide a clear privacy/transmission warning to the user. Users may inadvertently transmit sensitive brand-monitoring terms, internal campaign names, or retrieved content off-platform without informed consent. The context makes this more serious because marketing, incident-response, or product-code-name queries can be sensitive.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest presents this as a query/analysis skill, but the instructions direct the agent to run Node.js helper scripts. That expands the execution surface from simple data access to local code execution, which can be abused if the scripts are modified, unsafe, or invoke additional commands. In an agent setting, hidden execution expectations materially increase security risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This code performs an external POST request to Octolens and includes a bearer token plus user-supplied query data. External transmission is expected for an API integration, but it is still security-relevant because it moves potentially sensitive search criteria and results to a third party. The danger is amplified by the missing disclosure and the manifest/tool mismatch.

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

Alternative (using fetch API directly):

javascript
const response = await fetch('https://app.octolens.com/api/v1/mentions', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${API_KEY}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This is another instance of external POST transmission to Octolens with authentication and structured filters. Although normal for the feature, it remains a true security finding because sensitive monitoring logic and returned data can leave the local trust boundary. The advanced-query example may also encourage sending more detailed or revealing filters than users realize.

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

Alternative (using fetch API directly):

javascript
const response = await fetch('https://app.octolens.com/api/v1/mentions', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${API_KEY}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 25)May include surrounding context.

Fetch the 20 most recent mentions:

bash
curl -X POST "https://app.octolens.com/api/v1/mentions" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This example hard-codes "language": ["en"] for developer community mentions, which forces a specific locale in natural-language guidance. Under SQP-3, language or locale restrictions should not be imposed without user opt-in or clear justification, and no such choice or rationale is provided here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The example appends fetched mention records to a local file without warning that the data may contain personal or sensitive social-media content. This can lead users to persist collected data insecurely, increasing privacy, retention, and unauthorized-access risk on shared systems or developer workstations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 487)May include surrounding context.

md
while true; do
  if [ -z "$CURSOR" ]; then
    RESPONSE=$(curl -s -X POST "https://app.octolens.com/api/v1/mentions" \
      -H "Authorization: Bearer ${API_KEY}" \
      -H "Content-Type: application/json" \
      -d '{"limit": 100}')

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This bulk export example saves mention data to disk with no guidance on privacy or data-handling obligations. Because the workflow is designed for repeated collection, it increases the chance of accumulating large volumes of user-generated content that may be mishandled or retained longer than intended.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 539)May include surrounding context.

md
echo "Fetching sentiment data..."

POSITIVE=$(curl -s -X POST "https://app.octolens.com/api/v1/mentions" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"limit": 100, "filters": {"sentiment": ["positive"]}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 545)May include surrounding context.

md
echo "Fetching sentiment data..."

POSITIVE=$(curl -s -X POST "https://app.octolens.com/api/v1/mentions" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"limit": 100, "filters": {"sentiment": ["positive"]}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 551)May include surrounding context.

md
echo "Fetching sentiment data..."

POSITIVE=$(curl -s -X POST "https://app.octolens.com/api/v1/mentions" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"limit": 100, "filters": {"sentiment": ["positive"]}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 576)May include surrounding context.

md
echo "Fetching sentiment data..."

POSITIVE=$(curl -s -X POST "https://app.octolens.com/api/v1/mentions" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"limit": 100, "filters": {"sentiment": ["positive"]}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 600)May include surrounding context.

md
echo "Fetching sentiment data..."

POSITIVE=$(curl -s -X POST "https://app.octolens.com/api/v1/mentions" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"limit": 100, "filters": {"sentiment": ["positive"]}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/FILTERS.md (reported line 610)May include surrounding context.

API Request Examples

cURL Example

bash
curl -X POST "https://app.octolens.com/api/v1/mentions" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/FILTERS.md (reported line 649)May include surrounding context.

} }

response = requests.post(url, json=payload, headers=headers) data = response.json()

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/README.md (reported line 15)May include surrounding context.

brew install node

Install Node.js if needed (Ubuntu/Debian)

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/README.md (reported line 16)May include surrounding context.

brew install node

Install Node.js if needed (Ubuntu/Debian)

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/README.md (reported line 15)May include surrounding context.

brew install node

Install Node.js if needed (Ubuntu/Debian)

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - sudo apt-get install -y nodejs

text

Static analysis

No suspicious patterns detected.