ClawHub
Back to skill

Security audit

Codemend

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an error-monitoring purpose, but it includes under-scoped production telemetry guidance and a helper script that sends a different API key to an undocumented AutoHeal service.

Review this before installing. Use the Codemend error reporting pieces only after confirming what error fields may leave your system, adding redaction for secrets and PII, and approving use on production pages. Do not run scripts/check-errors.sh or provide AUTOHEAL_API_KEY unless you separately intend to trust autohealai.com. Prefer pinned npm package versions and a pinned or self-hosted browser script with integrity controls where possible.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check-errors.sh:7
Finding

Helper Script Sends a Bearer Credential to an Undocumented and Inconsistent Service

Content
View full analysis
[--poll]" exit 1 fi ERROR_ID="$1" POLL="${2:-}" API_URL="https://autohealai.com/api/errors/${ERROR_ID}/status" check_status() { curl -sf "$API_URL" -H "Authorization: Bearer $AUTOHEAL_API_KEY" } ``` ### Technical Analysis The skill metadata and documentation declare `CODEMEND_API_KEY` as the required credential and identify `codemend.ai` as the intended API service. However, the helper script instead requires `AUTOHEAL_API_KEY` and transmits it as an authorization bearer token to `https://autohealai.com`. This destination, credential name, and authentication scheme are not disclosed by the skill declaration. The inconsistency violates the principle of explicit authorization and makes it difficult for a user or agent to determine which service is receiving the secret. Because `curl` follows the system trust store and the script does not establish an allowlist or otherwise verify that this alternate service is expected, execution discloses the full bearer credential to that service. The script is also incompatible with the documented `CODEMEND_API_KEY` configuration. ### Attack Path 1. A user installs the skill based on its Codemend description. 2. The user follows the README and invokes `scripts/check-errors.sh`. 3. The script refuses the documented `CODEMEND_API_KEY` and requests an `AUTOHEAL_API_KEY`. 4. The user or an automation system supplies such a credential to make the helper work. 5. The helper sends the complete credential in an `Authorization: Bearer` header to `autohealai.com`. 6. The receiving service can capture and potentially reuse that bea ...[truncated 622 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:138
Finding

Mutable Remote Browser Script Is Executed Without Integrity Verification

Content
View full analysis
``` ### Technical Analysis The setup instructions direct users to load JavaScript directly from a mutable external URL. No version, cryptographic digest, or Subresource Integrity attribute is specified. Every application page containing this tag retrieves and executes the content currently served as `s.js`. Consequently, the effective executable payload can change after the skill has been audited. Compromise of the provider, its deployment pipeline, DNS configuration, CDN, or hosting account could transform the monitoring script into arbitrary browser-side code. This is a remote payload retrieval and execution issue because the reviewed skill does not contain or cryptographically identify the code ultimately executed by the browser. ### Attack Path 1. A user follows the skill instructions and adds the remote script tag to an application. 2. Application visitors load pages containing the tag. 3. Their browsers request the current `s.js` content from `codemend.ai`. 4. The provider or an attacker who compromises its delivery infrastructure replaces the script with a malicious payload. 5. Browsers execute that payload in the security origin and page context of each integrating application. 6. The payload can interact with page content and browser-accessible application credentials available to ordinary JavaScript. ### Impact Assessment A substituted script can read or modify the DOM, intercept form input, alter application behavior, issue same-origin requests with the user's active session, and exfiltrate browser-accessible data. The precise scope depends on the embedding application's Content Security Policy, cookie flags, token storage, and user privileges. The payload would not automatically obtain op ...[truncated 110 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:151
Finding

Unpinned npm Dependency Allows Unreviewed Package Updates

Content
View full analysis
Remediation
View remediation
`. - Commit and enforce a lockfile so dependency resolution is reproducible. - Use `npm ci` in CI and production instead of performing unconstrained installations. - Verify registry provenance, package signatures, integrity metadata, maintainers, and release history before upgrades. - Enable dependency auditing and automated alerts, but require review before merging version changes. - Avoid privileged npm execution and restrict CI credentials, filesystem permissions, and network access. - Where lifecycle scripts are unnecessary, consider installing with `--ignore-scripts` after confirming compatibility. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The browser setup tells users to embed a remote script from https://codemend.ai/s.js in the page head without warning that it automatically captures and sends production errors to a third party. A remotely hosted script executed in-browser can observe sensitive runtime data and stack traces at scale, making the lack of disclosure and consent especially dangerous in production environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README instructs users to send production JavaScript error data to a third-party service but does not clearly warn that stack traces, request context, user identifiers, environment details, or other sensitive application data may be transmitted off-system. In an agent skill context, this omission is more dangerous because an autonomous agent may integrate and operate the service without surfacing the privacy and compliance implications to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill describes reporting production errors to a third-party AI service without clearly warning that error messages, stack traces, and source URLs are transmitted externally. Production errors often contain sensitive internal paths, tokens, user identifiers, or business data, so omission of a privacy warning can lead to uninformed data exfiltration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This skill explicitly sends error data to an external service via HTTPS, including message, stack trace, and source URL. While external transmission is core to the product's functionality, it still represents a real security/privacy risk because those fields can contain sensitive operational or user data if sent without minimization or sanitization.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Report a production error to Codemend. The error will be analyzed by AI within seconds.

bash
curl -X POST "https://codemend.ai/api/errors/ingest" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "'$CODEMEND_API_KEY'",

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation instructs users to poll with a check_status tool, but that tool is not declared in the skill's tool list. This creates a mismatch between documented and actual capabilities, which can cause agents or users to rely on a nonexistent control path and mishandle asynchronous analysis or error states.

Content

No source excerpt is available for this finding.