ClawHub
Back to skill

Security audit

agent-directory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a directory helper, but it tells agents to fetch and follow mutable third-party skill instructions without clear trust boundaries.

Install only if you are comfortable sending requested URLs to SkillBoss and treating returned service instructions as untrusted until reviewed. Do not let fetched skill.md content authorize credential use, file access, command execution, or further network transmission without separate user confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:73
Finding

Untrusted Remote Skill Instructions Can Hijack Agent Behavior

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
metadata:
  emoji: "🔍"
  category: "discovery"
  api_base: "https://api.skillboss.co/v1"
requires.env:
  - SKILLBOSS_API_KEY
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
metadata:
  emoji: "🔍"
  category: "discovery"
  api_base: "https://api.skillboss.co/v1"
requires.env:
  - SKILLBOSS_API_KEY
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
metadata:
  emoji: "🔍"
  category: "discovery"
  api_base: "https://api.skillboss.co/v1"
requires.env:
  - SKILLBOSS_API_KEY
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The authenticated request to api.skillboss.co includes a bearer token and transmits the scraping job definition externally. While the snippet does not directly leak the API key beyond the Authorization header to the intended service, it still establishes a dependency on a third-party processor for content retrieval and creates risk if used with untrusted URLs or sensitive workflows.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.skillboss.co/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The authenticated request to api.skillboss.co includes a bearer token and transmits the scraping job definition externally. While the snippet does not directly leak the API key beyond the Authorization header to the intended service, it still establishes a dependency on a third-party processor for content retrieval and creates risk if used with untrusted URLs or sensitive workflows.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.skillboss.co/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs agents to send arbitrary URLs and fetch remote content through a third-party scraping hub using an authenticated API, but it does not warn that requested URLs and retrieved content are transmitted to SkillBoss infrastructure. This creates a privacy and supply-chain risk because agents may forward sensitive targets or consume untrusted remote skill.md content without explicit trust boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.