ClawHub
Back to skill

Security audit

Dia Ask Public

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for its stated Dia-browser automation purpose, but it handles logged-in browser content and can fall back to under-scoped output-file discovery that may surface unrelated Dia files.

Review prompts carefully before using this with logged-in, paywalled, personal, corporate, or regulated data. Treat the returned file as persistent plaintext, store it in a controlled location if you adapt the tool, and prefer disabling fallback or tightening output discovery to exact filenames and the current conversation context.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README explicitly promotes using a real logged-in browser session to read JS-heavy or paywalled content and to write the assistant’s extracted output to disk, but it does not prominently warn about privacy, credential-adjacent data exposure, or sensitive file handling. In this context, users may unknowingly extract personal, corporate, or regulated data from authenticated sessions into local files that can persist, be indexed, synced, or consumed by other tools.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly sends prompts to Dia's assistant and writes Dia's response to disk, and it is intended for logged-in or JS-heavy pages. Without a clear privacy warning, users may unintentionally expose sensitive prompts, authenticated page contents, or extracted data to a third-party AI assistant and leave persistent local artifacts on disk.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
The script silently normalizes accented Spanish characters in the user's prompt before sending it to Dia, which changes user-supplied content without consent. In a tool intended to relay prompts exactly, this can corrupt meaning, names, secrets, code, search terms, or quoted text, and may cause the browser agent to act on altered instructions.

File System Enumeration

Medium
Category
Data Exfiltration
Content
// bytes can get mangled (á -> "√°") through argv/exec. No-op on plain ASCII/English.
function deaccent(s) { const m = { 'á': 'a', 'é': 'e', 'í': 'i', 'ó': 'o', 'ú': 'u', 'ü': 'u', 'Á': 'A', 'É': 'E', 'Í': 'I', 'Ó': 'O', 'Ú': 'U', 'Ü': 'U' }; return String(s).replace(/[áéíóúüÁÉÍÓÚÜ]/g, (c) => m[c]); }

// Recursively list files under a directory (work dirs are shallow).
function walk(d, out = []) {
  let ents = [];
  try { ents = fs.readdirSync(d, { withFileTypes: true }); } catch { return out; }
Confidence
90% confidence
Finding
The script recursively enumerates files under Dia's AgentServer context directories and then selects the newest matching or non-artifact file. In this skill's context, that behavior can expose or return paths to files from other browser-agent conversations, potentially including sensitive data from logged-in sessions or unrelated tasks, especially because the tool is explicitly designed to interact with a real browser session and harvest saved outputs.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dia-ask-v2.js:36

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dia-ask.js:43