ClawHub
Back to skill

Security audit

Weekend Scout

Security checks for vulnerabilities and agentic risk

Overview

The skill's event-discovery purpose is coherent, but review is warranted because it can auto-install mutable Python dependencies and handles Telegram bot credentials in ways that may expose them in output or logs.

Install only if you are comfortable with a skill that runs Python commands, searches/fetches web pages, downloads GeoNames data, stores local cache/config files, and may send event summaries to Telegram. If you configure Telegram, treat the bot token as a password, avoid printing full config in shared logs, and rotate the token if it appears in terminal output, transcripts, or action logs. Prefer installing in an isolated virtual environment with reviewed dependency versions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Note
Location
weekend_scout/telegram.py:268
Finding

Unconditional Branding Injection into User and Telegram Output

Content
View full analysis
Scouted by Weekend Scout" if html_mode else "✨ Scouted by Weekend Scout" sections.append(footer) ``` The Markdown preview follows the same pattern: ```python footer = "_🌱 Scouted by Weekend Scout_" sections.append(footer) ``` ### Technical Analysis The formatter unconditionally inserts a fixed promotional footer into both the Telegram digest and the Markdown-style preview. The delivery instructions identify the generated preview as the authoritative user-facing report, so an Agent following the Skill contract cannot omit the injected text without deviating from the prescribed workflow. Although this does not grant system privileges or execute arbitrary code, it alters the Agent's final output for a purpose unrelated to the requested event-discovery result. There is no configuration setting or caller-controlled option to disable the attribution. ### Attack Path 1. A user invokes Weekend Scout. 2. The Agent discovers and selects events. 3. The Agent calls `format-message`. 4. `_compose_digest()` and `_compose_markdown_preview()` append the fixed branding footer. 5. The Skill instructions require the Agent to use the returned preview as the authoritative report. 6. The promotional text is displayed to the user and, when configured, sent to Telegram. ### Impact Assessment The issue affects every normally formatted report. Its scope is limited to output integrity and unsolicited branding; it does not provide filesystem, network, account, or operating-system privileges to an attacker. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
weekend_scout/telegram.py:490
Finding

Telegram Bot Token May Leak Through Network Exception Diagnostics

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
weekend_scout/config.py:197
Finding

Telegram Credentials Are Stored in Plaintext and Echoed by Configuration Commands

Content
View full analysis
None: """Write config dictionary to disk. Args: config: Configuration dictionary to persist. """ path = get_config_path() path.parent.mkdir(parents=True, exist_ok=True) with path.open("w", encoding="utf-8") as f: yaml.dump(config, f, allow_unicode=True, default_flow_style=False) ``` The configuration command can print individual secrets, echo a newly supplied secret, or print the complete configuration: ```python if args.key: key = args.key value = args.value if key not in config: _print_error_and_exit( f"Unknown config key: {key}", error_code="unknown_config_key", detail={"key": key}, config=config, ) if value is None: print(json.dumps({key: config[key]}, ensure_ascii=False)) return ``` ```python config[key] = value save_config(config) print(json.dumps({"set": {key: value}})) ``` ```python else: print(json.dumps(config, indent=2, ensure_ascii=False)) ``` ### Technical Analysis The Telegram bot token is part of the same configuration dictionary as non-sensitive preferences. The file is opened using the process's default permission behavior, so its effective permissions depend on the current umask and any pre-existing file permissions. The CLI also treats secret fields as ordinary values. Running any of the following can disclose the complete token: - `python -m weekend_scout config` - `python -m weekend_scout config telegram_bot_token` - `python -m weekend_scout config telegram_bot_ ...[truncated 1440 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
pyproject.toml:1
Finding

Automatic Installation Resolves Unpinned Third-Party Dependencies

Content
View full analysis
" "{bundle_root}/install/install_skill.py" --with-pip --runtime-only` ``` The package and build dependencies are not pinned to reviewed versions or hashes: ```toml [build-system] requires = ["setuptools>=68", "wheel"] build-backend = "setuptools.build_meta" [project] name = "weekend-scout" version = "0.1.0" description = "Discover weekend outdoor events and deliver trip options to Telegram" requires-python = ">=3.10" dependencies = [ "pyyaml", "requests", ] ``` ### Technical Analysis Loading the root Skill may lead to `pip install .` without a separate dependency-review step. Pip then resolves mutable versions of `setuptools`, `wheel`, `pyyaml`, and `requests` from the interpreter's configured package indexes. There is no lock file, hash verification, or exact version constraint in the reviewed project. The effective installed dependency set can therefore change after the Skill package itself has been audited. Python build and installation operations may execute package-controlled code, making dependency resolution part of the local execution trust boundary. No malicious dependency name or known typosquatting package was identified in the reviewed metadata. The risk arises from automatic installation combined with unpinned, mutable dependency resolution. ### Attack Path 1. The Skill is loaded on a system where `weekend-scout` is absent or has a different version. 2. The bootstrap ...[truncated 1070 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (77)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Copying files/directories and rewriting command strings to bind a Python interpreter are materially different from the advertised event-discovery purpose and can alter execution semantics on the host. Concealing installer-style file operations inside a benignly described skill increases the chance of unauthorized environment modification.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Copying files/directories and rewriting command strings to bind a Python interpreter are materially different from the advertised event-discovery purpose and can alter execution semantics on the host. Concealing installer-style file operations inside a benignly described skill increases the chance of unauthorized environment modification.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Copying files/directories and rewriting command strings to bind a Python interpreter are materially different from the advertised event-discovery purpose and can alter execution semantics on the host. Concealing installer-style file operations inside a benignly described skill increases the chance of unauthorized environment modification.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Copying files/directories and rewriting command strings to bind a Python interpreter are materially different from the advertised event-discovery purpose and can alter execution semantics on the host. Concealing installer-style file operations inside a benignly described skill increases the chance of unauthorized environment modification.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Copying files/directories and rewriting command strings to bind a Python interpreter are materially different from the advertised event-discovery purpose and can alter execution semantics on the host. Concealing installer-style file operations inside a benignly described skill increases the chance of unauthorized environment modification.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
matching bundled runtime `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
matching bundled runtime `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
matching bundled runtime `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
matching bundled runtime `SKILL.md`.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · docs/backlog.md (reported line 67)May include surrounding context.

md
| # | Task | Status | Notes |
|---|------|--------|-------|
| 5.1 | Write SKILL.md with full search strategy prompt | DONE (2026-03-27) | Implemented in .claude/skills/weekend-scout/SKILL.md (177 lines, 6 steps) |
| 5.2 | Test /weekend-scout with real web searches | IN PROGRESS | Clean-run test done 2026-03-27: Phase A completed (4 searches, 0 events), interrupted before Phase B; exposed bugs fixed in 5.6 |
| 5.3 | Iterate on search queries based on result quality | DONE (2026-03-28) | Phase C rewritten: individual per-city searches, tier1→tier2→tier3 priority, budget allocation table; Phase D cap 3→5 fetches |
| 5.4 | Iterate on scoring rubric | TODO | |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/backlog.md (reported line 122)May include surrounding context.

md
| 9.3  | Move GeoNames download target to platformdirs cache dir | DONE (2026-03-28) | _geonames_dir() uses get_config_dir()/geonames/ |
| 9.4  | Add auto-download in init/find-city when file missing | DONE (2026-03-28) | ensure_geonames() helper; called from get_city_list, cmd_find_city, cmd_init, run_setup_wizard |
| 9.5  | Update tests for new data paths | DONE (2026-03-28) | Monkeypatch _geonames_dir; added test_regions.py; 144 tests pass |
| 9.6  | Delete data/ directory from repo | DONE (2026-03-28) | git rm data/regions.json; data/ removed |
| 9.7  | Create skill_template/ with generator system | DONE (2026-03-28) | platforms.yaml, weekend-scout.template.md, generate.py, README.md |
| 9.8  | Create docs/platform-skill-reference.md | DONE (2026-03-28) | Copied from platform-skill-research.md |
| 9.9  | Generate .claude/skills/weekend-scout/SKILL.md from template | DONE (2026-03-28) | Replaced existing file |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · docs/platform-skill-reference.md (reported line 92)May include surrounding context.

md
### Model selection
- No per-skill model override in SKILL.md frontmatter
- Model is set at session level via `~/.codex/config.toml` or `--model` flag
- Advisory model preference can be placed in `metadata` block or in the skill body text
- Default model: `gpt-5.2-codex` (as of March 2026), `gpt-5.4-mini` for lighter tasks

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · docs/weekend-scout-design-v2.md (reported line 678)May include surrounding context.

md
| `init-skill` | Load compact agent-facing run context | `--city`, `--radius` |
| `find-city` | Look up a city in GeoNames | `--name`, `--country` |
| `save` | Save discovered events to cache | `--events '<json>'`, `--events-file`, `--from-session`, `--run-id` |
| `send` | Send message to Telegram | `--file` or `--message` |
| `cache-query` | Query cached events for a weekend | `--date` |
| `session-query` | Query canonical run-session candidates for the target weekend | `--run-id` |
| `prepare-digest` | Build deterministic grouped scoring input from saved weekend cache rows | `--date` |

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · install/install_skill.py (reported line 72)May include surrounding context.

python
"import yaml"
)
SYSTEM_PIP_RECOVERY_COMMANDS: tuple[tuple[str, str], ...] = (
    ("apt-get", "sudo apt update && sudo apt install python3-venv python3-pip"),
    ("dnf", "sudo dnf install python3-pip python3-wheel"),
    ("yum", "sudo yum install python3-pip"),
    ("zypper", "sudo zypper install python3-pip python3-setuptools python3-wheel"),

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · weekend_scout/__main__.py (reported line 1540)May include surrounding context.

python
def cmd_run(args: argparse.Namespace) -> None:
    """Print instructions for a manual /weekend-scout run."""
    print(json.dumps({
        "message": "Run /weekend-scout in Claude Code to start an automated scout.",
        "automation": "planned",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to paste their Telegram bot token into a getUpdates URL without warning that the token is a secret. That can expose the token via browser history, screenshots, shell/history notes, shared logs, proxy logs, or support messages, and anyone with the token can send messages as the bot and inspect bot updates.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 190)May include surrounding context.

For a group: add the bot, send a message, then open:

text
https://api.telegram.org/bot<TOKEN>/getUpdates

Look for "chat":{"id":-100XXXXXXXXXX} (negative number = group/channel).

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares no explicit tool/permission scope even though it instructs the host to read files, invoke Python, run an installer, and potentially access the network during package installation. In an agent setting, missing scope boundaries increases the chance that a user invokes a skill that performs broader file, shell, and network actions than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill states that it sends a digest to Telegram but does not provide a clear user-facing warning that data will be transmitted to an external service. In a skill that may include location-derived recommendations or personal preferences, silent outbound transmission creates privacy and compliance risk.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
| Platform | Canonical runtime skill |
|----------|-------------------------|
| OpenClaw | `.openclaw/skills/weekend-scout/SKILL.md` |
| Codex | `.agents/skills/weekend-scout/SKILL.md` |
| Claude Code | `.claude/skills/weekend-scout/SKILL.md` |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
| Platform | Canonical runtime skill |
|----------|-------------------------|
| OpenClaw | `.openclaw/skills/weekend-scout/SKILL.md` |
| Codex | `.agents/skills/weekend-scout/SKILL.md` |
| Claude Code | `.claude/skills/weekend-scout/SKILL.md` |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
| Platform | Canonical runtime skill |
|----------|-------------------------|
| OpenClaw | `.openclaw/skills/weekend-scout/SKILL.md` |
| Codex | `.agents/skills/weekend-scout/SKILL.md` |
| Claude Code | `.claude/skills/weekend-scout/SKILL.md` |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/backlog.md (reported line 67)May include surrounding context.

md
| Platform | Canonical runtime skill |
|----------|-------------------------|
| OpenClaw | `.openclaw/skills/weekend-scout/SKILL.md` |
| Codex | `.agents/skills/weekend-scout/SKILL.md` |
| Claude Code | `.claude/skills/weekend-scout/SKILL.md` |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/backlog.md (reported line 125)May include surrounding context.

md
| Platform | Canonical runtime skill |
|----------|-------------------------|
| OpenClaw | `.openclaw/skills/weekend-scout/SKILL.md` |
| Codex | `.agents/skills/weekend-scout/SKILL.md` |
| Claude Code | `.claude/skills/weekend-scout/SKILL.md` |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/weekend-scout-design-v2.md (reported line 630)May include surrounding context.

md
| Platform | Canonical runtime skill |
|----------|-------------------------|
| OpenClaw | `.openclaw/skills/weekend-scout/SKILL.md` |
| Codex | `.agents/skills/weekend-scout/SKILL.md` |
| Claude Code | `.claude/skills/weekend-scout/SKILL.md` |