Hoverbot Chatbot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:52 PM UTC
• Version: 1.0.1

Overview

The skill is coherent for setting up a website chatbot, but it asks users to embed unpinned third-party JavaScript and upload business/customer content without enough security and privacy scoping.

Review this before installing or using it on a real site. Only embed the widget on sites where you are authorized to add third-party JavaScript, confirm the apiKey is a publishable widget token rather than a secret credential, enable domain restrictions, and avoid uploading secrets, credentials, customer personal data, regulated records, or confidential documents unless HoverBot's data handling, retention, and access controls meet your requirements.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:43

Finding

Unversioned Third-Party JavaScript Executes in the Website Origin

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43-51, SKILL.md:104-112, examples/add-support-bot.md:25-32, and examples/add-support-bot.md:44-54
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code

html

<script>
  window.HOVERBOT_CONFIG = {
    chatbotId: "your-unique-chatbot-id",
    apiKey: "your-unique-api-key"
  }
</script>
<script async src="https://cdn.hoverbot.ai/widget.js"></script>

The custom-button example similarly loads the same mutable remote resource:

html

<!-- Your own button -->
<button onclick="window.hoverBotWidget.openChat()">
  Chat with us!
</button>

<!-- Widget with hidden default icon -->
<script>
  window.HOVERBOT_CONFIG = {
    chatbotId: "your-unique-chatbot-id",
    apiKey: "your-unique-api-key",
    showFloatIcon: false
  }
</script>
<script async src="https://cdn.hoverbot.ai/widget.js"></script>

Technical Analysis

The documented integration instructs users to execute an unversioned JavaScript resource from an external CDN. The script is not pinned to an immutable version and does not use Subresource Integrity. Consequently, the effective code executed by browsers can change after this Skill has been reviewed.

A remotely loaded script normally runs with the privileges of JavaScript on the embedding page. It can access and modify the page DOM, read non-HTTP-only data available to page scripts, intercept interactions, issue network requests permitted by browser controls, and display deceptive content. The project contains no local malicious implementation, but it creates a significant external supply-chain trust boundary.

Attack Path

1. A website owner follows the Skill and embeds https://cdn.hoverbot.ai/widget.js.
2. The CDN asset, publishing account, build pipeline, DNS configuration, or upstream ...[truncated 1026 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish immutable, explicitly versioned widget assets rather than a mutable widget.js endpoint.
2. Provide a cryptographic Subresource Integrity hash and require crossorigin="anonymous" where supported:

   html

   <script
     async
     src="https://cdn.hoverbot.ai/widget-v1.0.0.js"
     integrity="sha384-REPLACE_WITH_PUBLISHED_HASH"
     crossorigin="anonymous"></script>
   

3. Document a restrictive Content Security Policy that limits script, connection, frame, image, and style sources to the minimum necessary.
4. Isolate the chat interface in a cross-origin sandboxed iframe with the smallest practical set of sandbox permissions.
5. Protect the CDN publishing process with signed releases, multifactor authentication, least-privilege deployment credentials, audit logging, and independent release review.
6. Define a security update process so website operators can explicitly review and adopt new widget versions instead of receiving silent code changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Authentication-Labeled API Key Is Exposed in Public Client-Side Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43-50, SKILL.md:104-112, SKILL.md:120-126, examples/add-support-bot.md:25-32, and examples/add-support-bot.md:44-54
Vulnerability Type: Public exposure of an authentication credential
Risk Level: Medium

Vulnerable Code

html

<script>
  window.HOVERBOT_CONFIG = {
    chatbotId: "your-unique-chatbot-id",
    apiKey: "your-unique-api-key"
  }
</script>
<script async src="https://cdn.hoverbot.ai/widget.js"></script>

The configuration table describes this exposed value as an authentication key:

markdown

| Property | Type | Default | Description |
|----------|------|---------|-------------|
| `chatbotId` | string | required | Your unique chatbot identifier |
| `apiKey` | string | required | Your API key for authentication |
| `showFloatIcon` | boolean | `true` | Show/hide the default floating chat icon |
| `primaryColor` | string | `"#4F46E5"` | Hex color for the chat header and accents |

Technical Analysis

Values embedded in HTML or assigned to window.HOVERBOT_CONFIG cannot be treated as secrets. Any visitor, browser extension, crawler, reverse proxy, or party with access to the delivered page can inspect the source or runtime state and recover the key.

The documentation identifies the value as an API key used for authentication but does not establish that it is a deliberately public, minimally scoped widget token. It also does not make domain allowlisting, token rotation, audience restrictions, or rate limiting mandatory before deployment. Domain management is mentioned as a dashboard capability, but not as a required security control.

If the exposed key authorizes operations beyond public widget initialization, possession of the key may allow unauthorized API calls. Even when domain restrictions exist, weak origin validation or reliance on client-supplied headers could permit replay outside ...[truncated 1161 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the authentication-labeled API key with a clearly named publishable widget identifier or public token that has no administrative privileges.
2. Never expose general-purpose or privileged API secrets in HTML, JavaScript, public repositories, browser storage, or global runtime objects.
3. Restrict public widget tokens server-side by chatbot, operation, audience, approved domain, expiration, and rate limit.
4. Require domain allowlisting as part of the setup process rather than listing it only as an optional dashboard capability.
5. Do not rely solely on client-controlled Origin or Referer values for sensitive authorization. Use defense-in-depth controls and ensure sensitive operations require separate authenticated server-side credentials.
6. Support immediate token rotation and revocation, and document how website owners should respond to suspected abuse.
7. Use short-lived, narrowly scoped session tokens for visitor interactions where practical.
8. Update the documentation to distinguish public embed tokens from secret API keys and explicitly warn users not to place privileged credentials in client-side code.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

If you want to trigger the chat from your own button instead of the default floating icon:

html

<!-- Your own button -->
<button onclick="window.hoverBotWidget.openChat()">
  Chat with us!
</button>

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The suggested invocation phrase "Help me add a customer support chatbot to my website" begins with a very broad everyday phrase ("Help me") and the README does not define stricter trigger boundaries or exclusion conditions. That can make activation criteria ambiguous for agents that rely on natural-language matching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to upload documents, add website URLs, and review conversation history, but it does not warn that these actions may expose sensitive personal, customer, proprietary, or regulated data to a third-party service. In a chatbot/knowledge-base context, this omission is materially risky because users may ingest confidential content or store chats containing PII without considering consent, retention, access control, or compliance obligations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example encourages users to upload documents and website URLs to train a chatbot but does not warn against including confidential, regulated, or otherwise sensitive content. In a knowledge-ingestion workflow, users may reasonably assume all internal documents are appropriate for upload, which can lead to unintended disclosure through chatbot responses or third-party processing of the data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.