ClawHub
Back to skill

Security audit

Stripemeter

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent Stripe billing documentation, but its quick start tells users to clone and run mutable remote code with Docker and pnpm without pinning or verification.

Install only if you are comfortable auditing the referenced stripemeter repository first. Pin a reviewed commit, inspect Docker Compose files, package scripts, migrations, and dependency lockfiles before running the quick start, use test Stripe keys or narrowly scoped credentials, change any Grafana default password, and avoid exposing the local services beyond your machine.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:13
Finding

Unpinned Remote Repository Is Downloaded and Executed Locally

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–15
Vulnerability Type: Remote payload retrieval and supply-chain execution
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/geminimir/stripemeter && cd stripemeter
cp .env.example .env && docker compose up -d && pnpm -r build
pnpm db:migrate && pnpm dev

Technical Analysis

The quick-start workflow clones the mutable default branch of an external Git repository and immediately executes content obtained from it. No immutable commit or release tag, checksum, cryptographic signature, or provenance verification is specified.

The subsequent commands create several execution channels for remotely controlled content:

  • docker compose up -d processes downloaded Compose configuration and starts referenced images.
  • pnpm -r build may execute package lifecycle and build scripts.
  • pnpm db:migrate runs downloaded migration logic with database access.
  • pnpm dev starts the downloaded application.

The external repository and its dependencies are not included in the audited artifact, so their safety cannot be established from this project. The effective payload may also change after this Skill has been reviewed.

Attack Path

  1. An attacker compromises the referenced repository, its maintainer account, a dependency, or a container image.
  2. The attacker places malicious logic in a package lifecycle script, build command, migration, application startup path, Compose configuration, or referenced image.
  3. A user follows the documented quick-start instructions and clones the current default branch.
  4. Docker or pnpm executes the attacker-controlled content without an integrity or provenance check.
  5. The malicious process accesses resources available to the user's account or containers, potentially including environment files, Stripe credentials, database credentials, Redis credentials, source code, and reachable services.

Impact Assessment

Successful ...[truncated 727 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the repository to a reviewed, immutable commit hash rather than relying on its default branch:

    bash
    git clone https://github.com/geminimir/stripemeter
cd stripemeter
git checkout --detach VERIFIED_COMMIT_SHA

  2. Publish the expected commit identifier through a trusted channel and verify signed commits or release tags.

  3. Pin container images by immutable digest and verify image signatures or attestations before startup.

  4. Require a committed lockfile and install dependencies with frozen-lockfile enforcement.

  5. Audit package lifecycle scripts, migration files, Dockerfiles, Compose files, volume mounts, capabilities, and network exposure before execution.

  6. Run the stack under a dedicated, unprivileged account and use rootless containers where possible.

  7. Do not mount the Docker socket, broad host directories, SSH agents, cloud credentials, or unrelated secrets into containers.

  8. Supply narrowly scoped development credentials only after the downloaded source has been verified.

  9. Separate build, migration, and startup steps so users can review each stage before execution.

T09 · Insecure Skill Coding Practices

Warning
Location
RECONCILIATION.md:34
Finding

Monitoring Stack Documents a Fixed Default Administrator Credential

Content
View full analysis

Vulnerability Details

File Location: RECONCILIATION.md, lines 34–36
Vulnerability Type: Default administrative credentials
Risk Level: Medium

Vulnerable Code

bash
docker compose -f docker-compose.prod.yml --profile monitoring up -d
# Prometheus: http://localhost:${PROMETHEUS_PORT:-9090}
# Grafana:    http://localhost:${GRAFANA_PORT:-3001}  (admin/admin by default)

Technical Analysis

The runbook documents a fixed Grafana administrator credential of admin/admin. Default credentials are widely known and can be used immediately if the service is reachable.

Although the example URL uses localhost, the audited documentation does not establish that the downloaded Compose configuration binds the service exclusively to loopback. Container port publication, remote development environments, reverse proxies, tunnels, or host firewall configuration could make the service reachable by other systems.

The referenced Compose file is not part of the audited artifact, so it is not possible to verify whether startup requires credential rotation, restricts network exposure, or disables the default account.

Attack Path

  1. An operator starts the optional monitoring stack without changing the documented default credential.
  2. Grafana becomes reachable through a published host port, reverse proxy, development tunnel, shared workstation, or insufficiently restricted network interface.
  3. An attacker discovers the exposed Grafana endpoint.
  4. The attacker authenticates using admin/admin.
  5. The attacker gains the administrative functions permitted by that Grafana deployment and can inspect or modify available monitoring resources.

Impact Assessment

The immediate impact is unauthorized Grafana administrative access. Depending on the deployment and configured integrations, the scope could include:

  • Viewing operational dashboards and potentially sensitive metric labels.
  • Modifying dashboards, users, data sources, alerting configurat ...[truncated 392 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the fixed default credential from the deployment workflow.
  2. Generate a unique, high-entropy administrator password during initialization and provide it through a secret manager or protected secret file.
  3. Make startup fail when a known default password remains configured.
  4. Bind Grafana to loopback or a private management network by default.
  5. Require authenticated TLS termination before allowing remote access.
  6. Restrict ingress with host firewalls, security groups, or network policies.
  7. Use a non-administrator account for routine dashboard access and reserve administrator privileges for configuration changes.
  8. Rotate any deployment that has used admin/admin and review authentication and administration logs for unauthorized access.
  9. Ensure credentials are not stored in source control, shell history, Compose files, or plaintext environment files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

bash
git clone https://github.com/geminimir/stripemeter && cd stripemeter
cp .env.example .env && docker compose up -d && pnpm -r build
pnpm db:migrate && pnpm dev

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
- [Simulator Guide](docs/simulator-getting-started.md)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · RECONCILIATION.md (reported line 98)May include surrounding context.

bash
# Dry-run last 24h for one metric
curl -s -X POST http://localhost:3000/v1/replay \
  -H 'Content-Type: application/json' \
  -d '{
    "tenantId": "demo",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · RECONCILIATION.md (reported line 109)May include surrounding context.

bash
# Dry-run last 24h for one metric
curl -s -X POST http://localhost:3000/v1/replay \
  -H 'Content-Type: application/json' \
  -d '{
    "tenantId": "demo",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · RECONCILIATION.md (reported line 130)May include surrounding context.

bash
# Dry-run last 24h for one metric
curl -s -X POST http://localhost:3000/v1/replay \
  -H 'Content-Type: application/json' \
  -d '{
    "tenantId": "demo",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · RECONCILIATION.md (reported line 148)May include surrounding context.

curl -s "http://localhost:3000/v1/reconciliation/summary?tenantId=demo&metric=requests" | jq .

Optionally trigger a reconciliation cycle

curl -s -X POST http://localhost:3000/v1/reconciliation/run -H 'Content-Type: application/json'
-d '{"tenantId":"demo"}' | jq .

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Ingest Events

bash
curl -X POST http://localhost:3000/v1/events/ingest \
  -H "Content-Type: application/json" \
  -d '{
    "events": [{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

Replay Late Events

bash
curl -X POST http://localhost:3000/v1/replay \
  -H "Content-Type: application/json" \
  -d '{"tenantId": "X", "dryRun": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/api/ingest.md (reported line 52)May include surrounding context.

Examples

bash
# Send a single event with idempotency
curl -X POST http://localhost:3000/v1/events/ingest \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: my-batch-123" \
  -d '{

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The quickstart instructs users to write output to results/ and to --record expected artifacts next to scenarios, which modifies local files, but the surrounding text does not explicitly warn that these commands create or overwrite artifacts on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.