ClawHub
Back to skill

Security audit

Preflight Check

Security checks for vulnerabilities and agentic risk

Overview

This preflight skill has a legitimate purpose, but its instructions can expose secrets in logs and saved reports.

Review before installing. This skill is meant to check setup readiness, but it should be changed to test only whether secrets are set, never print credential values or prefixes, and save reports only after redacting sensitive data or with explicit user approval.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:32
Finding

Sensitive credentials are exposed through diagnostic output and plaintext reports

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-42; related occurrences at lines 57 and 111
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

markdown
| Env var | `NEXT_PUBLIC_SUPABASE_URL` | `echo $NEXT_PUBLIC_SUPABASE_URL` | stack-scaffold, supabase-ops |
| Env var | `NEXT_PUBLIC_SUPABASE_ANON_KEY` | `echo $NEXT_PUBLIC_SUPABASE_ANON_KEY` | stack-scaffold, supabase-ops |
| Env var | `SUPABASE_SERVICE_ROLE_KEY` | `echo $SUPABASE_SERVICE_ROLE_KEY` | supabase-ops, firebase-auth-setup |
| Env var | `NEXT_PUBLIC_FIREBASE_API_KEY` | `echo $NEXT_PUBLIC_FIREBASE_API_KEY` | stack-scaffold, firebase-auth-setup |
| Env var | `NEXT_PUBLIC_FIREBASE_PROJECT_ID` | `echo $NEXT_PUBLIC_FIREBASE_PROJECT_ID` | stack-scaffold, firebase-auth-setup |
| Env var | `FIREBASE_PROJECT_ID` | `echo $FIREBASE_PROJECT_ID` | firebase-auth-setup |
| Env var | `FIREBASE_CLIENT_EMAIL` | `echo $FIREBASE_CLIENT_EMAIL` | firebase-auth-setup |
| Env var | `FIREBASE_PRIVATE_KEY` | `echo $FIREBASE_PRIVATE_KEY \| head -c 20` | firebase-auth-setup |
| Env var | `VERCEL_TOKEN` | `echo $VERCEL_TOKEN \| head -c 10` | deploy-pilot |
| Env var | `CLOUDFLARE_API_TOKEN` | `echo $CLOUDFLARE_API_TOKEN \| head -c 10` | cloudflare-guard |
| Env var | `CLOUDFLARE_ZONE_ID` | `echo $CLOUDFLARE_ZONE_ID` | cloudflare-guard |

Additional affected instructions include:

markdown
| Env var | `OPENROUTER_API_KEY` (optional) | `echo $OPENROUTER_API_KEY \| head -c 10` | web-scraper (Stage 5 only) |
markdown
Save the report to `preflight-report.json` in the project root.

Technical Analysis

The skill checks whether credentials are configured by printing their values. In particular, SUPABASE_SERVICE_ROLE_KEY is printed in full. Other sensitive values, including the Firebase private key, Vercel token, Cloudflare API token, and OpenRouter API key, have prefixes printed.

Credential ...[truncated 2488 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace all secret-printing commands with presence-only checks:

    sh
    if test -n "${SUPABASE_SERVICE_ROLE_KEY:-}"; then
  printf '%s\n' "set"
else
  printf '%s\n' "missing"
fi

  2. Apply the same pattern to every credential, including FIREBASE_PRIVATE_KEY, VERCEL_TOKEN, CLOUDFLARE_API_TOKEN, and OPENROUTER_API_KEY. Never print complete values, prefixes, suffixes, lengths, hashes, or other identifying fragments.

  3. Require report entries to contain only normalized states such as set, missing, valid, or invalid. Explicitly prohibit placing environment-variable values or command output containing secrets in the detail, fix, or recommendation fields.

  4. Redact credentials defensively before displaying or serializing diagnostic data, even when a check unexpectedly returns sensitive content.

  5. If preflight-report.json must be written, create it with owner-only permissions where supported, avoid following symbolic links, and add it to .gitignore. Prefer a user-approved output location outside the repository for reports that may contain environment metadata.

  6. Do not include credentials in shell command lines beyond what is strictly required for authenticated connectivity checks. Ensure connectivity-check output reports only success or failure and does not use verbose HTTP diagnostics that may reveal authorization headers.

  7. Document report retention and deletion behavior, and advise users to remove previously generated reports and rotate any privileged credentials that may already have appeared in logs or reports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly checks numerous sensitive environment variables by echoing them, including service-role keys, private keys, and API tokens, with some commands printing token prefixes. This creates a credential exposure risk in logs, terminal history, model context, or saved reports, especially because the skill is framed as a routine preflight step and lacks privacy warnings or masking requirements.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The skill invokes npx playwright install --dry-run without pinning a specific package version. npx may resolve and execute code from whatever version is currently published or locally available, creating a supply-chain risk and making behavior non-deterministic in a preflight step that users may trust as safe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill instructs saving preflight-report.json to the project root without any consent, path safety checks, or warning that it modifies user files. Even though the content is diagnostic, writing into the workspace can overwrite files, pollute repositories, or leak environment-derived metadata into version-controlled locations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
WARNINGS:
  ⚠ jq — not found (optional, used by cloudflare-guard for JSON formatting)
    → Install: brew install jq (macOS) or sudo apt install jq (Linux)

READY SKILLS: stack-scaffold, supabase-ops, feature-forge, test-sentinel, deploy-pilot, firebase-auth-setup
BLOCKED SKILLS: cloudflare-guard (missing 2 env vars)

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The optional connectivity check sends authenticated requests to the Vercel API using Authorization: Bearer $VERCEL_TOKEN. Although intended to validate connectivity, it transmits credentials to an external service and may reveal account metadata or create audit noise without explicit consent or clear minimization safeguards.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
When the user requests a deep check, also verify service connectivity:

- **Supabase:** `curl -sf "$NEXT_PUBLIC_SUPABASE_URL/rest/v1/" -H "apikey: $NEXT_PUBLIC_SUPABASE_ANON_KEY" -o /dev/null && echo "ok"`
- **Vercel:** `curl -sf "https://api.vercel.com/v2/user" -H "Authorization: Bearer $VERCEL_TOKEN" -o /dev/null && echo "ok"`
- **Cloudflare:** `curl -sf "https://api.cloudflare.com/client/v4/user/tokens/verify" -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" -o /dev/null && echo "ok"`
- **GCP:** `gcloud auth print-access-token > /dev/null 2>&1 && echo "ok"`

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The Cloudflare connectivity check sends a bearer token to an external endpoint during preflight. This is sensitive because the skill normalizes outbound authenticated network traffic in a validation phase, increasing the chance of unintended credential use or disclosure if outputs, command lines, or traces are captured.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
- **Supabase:** `curl -sf "$NEXT_PUBLIC_SUPABASE_URL/rest/v1/" -H "apikey: $NEXT_PUBLIC_SUPABASE_ANON_KEY" -o /dev/null && echo "ok"`
- **Vercel:** `curl -sf "https://api.vercel.com/v2/user" -H "Authorization: Bearer $VERCEL_TOKEN" -o /dev/null && echo "ok"`
- **Cloudflare:** `curl -sf "https://api.cloudflare.com/client/v4/user/tokens/verify" -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" -o /dev/null && echo "ok"`
- **GCP:** `gcloud auth print-access-token > /dev/null 2>&1 && echo "ok"`

## Usage

Static analysis

No suspicious patterns detected.