Security audit

Lobster

Security checks for vulnerabilities and agentic risk

Overview

This workflow skill is coherent, but it gives agents broad shell and credentialed remote-action capability that users should review and constrain before installing.

Install only after reviewing or pinning the Lobster package version, and use it only in trusted workspaces. Avoid passing untrusted input into shell-backed workflows, require approvals before side effects, scope CLAWD_TOKEN narrowly, and set LOBSTER_STATE_DIR to a project-specific location if persistent state may contain sensitive data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Unpinned Global Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
`. - Record the dependency in a lockfile and use reproducible installation commands such as `npm ci`. - Verify package provenance, registry origin, signatures, and integrity hashes before installation. - Prefer a project-local installation over a global installation. - Run the package in an isolated environment with restricted filesystem, credential, and network access. - Disable npm lifecycle scripts where compatible with the package, or separately review every required lifecycle script. - Establish an update process that requires security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:111
Finding: Potential Shell Command Injection Through Unvalidated Workflow Argument Substitution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill's activation guidance is broad enough to match many generic automation, monitoring, data-processing, and batch-operation tasks, increasing the chance an agent selects this highly privileged skill in contexts where safer, narrower tools should be used. Because Lobster includes shell execution, persistent state, and remote invocation, overbroad routing materially increases exposure to misuse.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly documents a generic exec --json --shell "cmd" primitive, which enables arbitrary shell execution rather than a narrowly scoped workflow DSL. In an agent skill context, this broadens capability to essentially any local command execution, making prompt-driven misuse, data exfiltration, or destructive host actions possible if the agent routes untrusted tasks through Lobster.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation exposes direct remote tool invocation via clawd.invoke using environment-provided credentials (CLAWD_URL and CLAWD_TOKEN), enabling credentialed actions outside the workflow runtime's core deterministic-processing scope. Combined with arbitrary pipeline composition, this can let an agent trigger external side effects or message sending against remote systems if approval and authorization boundaries are weak or bypassed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.