ClawHub
Back to skill

Security audit

Hellofresh

Security checks for vulnerabilities and agentic risk

Overview

This HelloFresh skill is purpose-aligned, but it needs review because it handles account/browser data, stores personal subscription details plainly, and includes real shipment identifiers in documentation.

Review before installing. Use local browser mode unless you are comfortable with authenticated HelloFresh browsing through Kernel.sh, avoid shared machines, treat the session file as sensitive, and remove or replace the real-looking tracking, phone, and subscription examples before publication or distribution. Pin dependencies and add a lockfile before relying on this package.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
IMPLEMENTATION_NOTES.md:23
Finding

Real Personal and Shipment Identifiers Exposed in Documentation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
handler.ts:253
Finding

Sensitive Subscription Data Stored Without Explicitly Restrictive File Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package.json:8
Finding

Unpinned Dependencies and Missing Lockfile Permit Unaudited Package Resolution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The notes propose monitoring Gmail shipping emails, setting up Gmail API access, and handling OAuth or app-specific passwords without any guidance on least-privilege access, secure credential storage, user consent, or protection of private email contents. In an agent skill context, this can normalize collecting broad mailbox access and sensitive credentials for a convenience feature, creating privacy and token-exposure risk if implemented as written.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
75% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# HelloFresh Skill for OpenClaw

Interact with your HelloFresh meal subscription — discover recipes, manage selections, convert instructions to speech.

## Features

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises account-modifying actions ('manage selections') and optional cloud/browser execution without warning users that subscription data, browsing activity, and account actions may be processed locally or remotely. This can lead users to authorize sensitive actions or expose personal/order data without informed consent, especially in cloud mode where third-party infrastructure is involved.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
75% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
# HelloFresh Assistant

**Description:** Interact with your HelloFresh account — discover recipes, manage selections, convert instructions to audio, and get shipment alerts.

**Commands:**
- `/hello-fresh setup` — First-time setup (collects subscription info)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly states it collects subscription information and stores session data at a local filesystem path, but it does not warn users what data is retained, how long it persists, or how it can be removed beyond a reset command. This creates a privacy and local data exposure risk, especially on shared machines or environments where the storage location may be backed up or accessible to other processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The shipment alert feature sends delivery-status information through Telegram, a third-party messaging platform, without clearly warning the user that account-related shipment metadata will leave the local environment. Even if the data is not highly sensitive, delivery timing and status can reveal personal household patterns and should require informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill stores subscription details, delivery address, payment metadata, preferences, and notification history in plaintext JSON files under the user's home directory. In an agent/tooling environment, local skill storage may be accessible to other processes, backups, or operators, so silent persistence of this personal data increases privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This handler performs a file deletion via unlinkSync, which is a destructive operation, but there is no confirmation prompt before removing the saved session. The returned message appears only after deletion, so the user is not warned at the point of action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code creates a remote cloud-hosted browser session and connects to it over CDP, which means page content, navigation targets, cookies, and user interactions may be processed by a third-party service. In a skill context, that can expose sensitive browsing data without any explicit consent, warning, or policy enforcement in this file, making unintended data disclosure a real risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
68% confidence
Finding

The file includes example delivery instruction values such as "À la réception" and "APPT : 18 +18194482636 À la réception" without any indication that the language is user-selected or regionally constrained. Because SQP-3 covers natural-language policy issues in any file type, this can be read as a locale-specific default without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The configuration section instructs users to export a live API key but provides no guidance on secure storage, secret rotation, scope limitation, or avoiding accidental disclosure in shell history and logs. While the README itself does not leak a real key, normalizing unsafe credential handling increases the likelihood of key exposure and subsequent unauthorized use of the cloud browser service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The comments state that the implementation 'would use the message tool' and 'for now' only returns the message, implying a side-effect-free placeholder notification path. However, cmdNotify still treats this as a real send path and updates session state such as lastRecipeReminder and lastShipmentAlert via saveSession after calling sendNotification, so the overall documented behavior around sending is misleading.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range instead of an exact pinned version, which allows newer upstream releases to be installed without review. This increases supply-chain risk and can cause builds to consume unexpected code or vulnerable transitive updates over time.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"build": "tsc"
  },
  "dependencies": {
    "@onkernel/sdk": "^1.0.0",
    "playwright": "^1.40.0"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

Playwright is specified with a caret version range, so installs may resolve to different upstream releases over time. In a browser-automation skill, this is particularly relevant because Playwright can download and manage browser binaries, increasing the blast radius of a compromised or vulnerable update.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
},
  "dependencies": {
    "@onkernel/sdk": "^1.0.0",
    "playwright": "^1.40.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The manifest includes Playwright without an exact pinned version, and there is a known advisory affecting some Playwright releases related to browser download authenticity verification. Because the version is not pinned, it is not possible to verify from this file whether installs will resolve to an affected version, creating real uncertainty in a package that performs browser automation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"playwright": "^1.40.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  },
  "openclaw": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  },
  "openclaw": {
    "name": "hellofresh",