ClawHub
Back to skill

Security audit

Gen Paylink Govilo

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its file-packaging and setup instructions can expose users to unintended local file upload or unverified remote code execution.

Review before installing. Use Homebrew or another trusted package manager for uv instead of the curl/PowerShell installer commands, use a dedicated .env.govilo containing only the Govilo key and seller address, and upload only directories you created or have checked for symlinks. Avoid running this on untrusted repositories or extracted archives until symlink handling and temporary-file creation are fixed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup-guide.md:8
Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/packager.py:40
Finding

Directory Packaging Follows Symbolic Links and Can Upload Files Outside the Selected Directory

Content
View full analysis
MAX_FILE_COUNT: raise PackageError(f"Directory contains more than {MAX_FILE_COUNT} files") dest = Path(tempfile.mktemp(suffix=".zip")) with zipfile.ZipFile(dest, "w", zipfile.ZIP_DEFLATED) as zf: for f in files: zf.write(f, f.relative_to(paths[0])) ``` ### Technical Analysis `Path.is_file()` follows symbolic links. Consequently, a symbolic link located under the selected directory can be treated as a regular file even when its target is outside that directory. `ZipFile.write()` then opens and archives the target's contents, while `f.relative_to(paths[0])` only controls the archive member name; it does not prove that the resolved target remains inside the selected root. The resulting archive is subsequently uploaded to the presigned URL returned by Govilo. This behavior violates the expected boundary that selecting a directory should upload only files physically contained within that directory. ### Attack Path 1. An attacker or untrusted archive/repository creates a directory containing a symbolic link, for example `export/credentials`, pointing to a user-accessible sensitive file outside `export`. 2. The user invokes the Skill with `--input export`. 3. `rglob("*")` discovers the symbolic link and `is_file()` accepts it by following its target. 4. `ZipFile.write()` reads the external target and stores its contents under the link's relative archive name. 5. The workflow uploads the generated ZIP to the API-provided storage URL. 6. The sensitive contents become part of the paid Govilo item or otherwise enter remote storage. ### Impact Assessment ...[truncated 500 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/packager.py:44
Finding

Predictable Non-Atomic Temporary Archive Creation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
pyproject.toml:5
Finding

Unpinned Runtime and Build Dependencies Allow Non-Reproducible Code Resolution

Content
View full analysis
=3.11 and the `requests` dependency from `pyproject.toml` — no manual `pip install` needed. ``` ### Technical Analysis The runtime dependency `requests` and build dependency `hatchling` have no version constraints. No lock file was present in the audited project structure. Each environment may therefore resolve different package versions, and future upstream releases can become part of the executed environment without a corresponding Skill review. Build-system dependencies are particularly security-sensitive because they may execute during package construction or installation. This finding does not establish that either named package is currently malicious; it identifies a supply-chain control deficiency and lack of reproducibility. ### Attack Path 1. A user runs the documented `uv run` command in an environment without a trusted lock file. 2. The resolver selects versions available from its configured package index at that time. 3. A compromised upstream release, compromised package index, or unsafe future version is downloaded. 4. Build or runtime package code executes with the user's privileges. 5. Malicious dependency code could read local data, alter files, or intercept the Govilo API key and uploaded content. ### Impact Assessment If dependency distribution is compromised, package code executes with the same privileges as the Skill. Accessible scope may include: - `GOVILO_API_KEY` and `SELLER_ADDRESS` from the process environment. - Files selected for packaging and upload. - Other files readable or writable by the invoking ...[truncated 253 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises sensitive remote behavior involving file uploads, presigned URLs, API-key usage, and monetization workflows, but the analyzed content does not substantiate those actions and instead appears centered on local packaging/validation. This mismatch is dangerous because users and reviewers may authorize secret access and file handling under false assumptions, masking dead code, incomplete implementation, or substituted behavior in other files.

Content

No source excerpt is available for this finding.

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/bot-api-quick-ref.md (reported line 47)May include surrounding context.

md
| 809108003 | 401 | api key has expired |
| 809108005 | 429 | daily api key usage limit exceeded |
| 809108006 | 429 | api key rate limit exceeded |
| 809104001 | 404 | upload session not found |
| 809104002 | 410 | upload session expired |
| 809104003 | 404 | file not found |

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/bot-api-quick-ref.md (reported line 48)May include surrounding context.

md
| 809108003 | 401 | api key has expired |
| 809108005 | 429 | daily api key usage limit exceeded |
| 809108006 | 429 | api key rate limit exceeded |
| 809104001 | 404 | upload session not found |
| 809104002 | 410 | upload session expired |
| 809104003 | 404 | file not found |

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The | sh shell-chaining pattern is a direct arbitrary-command execution sink for whatever data is returned by the remote endpoint. If an attacker can influence the downloaded content or the transport path, they can execute malicious commands immediately, potentially stealing Govilo API keys, wallet-related data, or other local secrets used by this skill.

Content

Scanner excerpt · references/setup-guide.md (reported line 10)May include surrounding context.

md
### Install uv

    # macOS / Linux
    curl -LsSf https://astral.sh/uv/install.sh | sh

    # Windows
    powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly requires environment variables and describes network-based upload/API operations, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where the runtime may permit broader env or network access than reviewers and users expect, increasing the chance of secret exposure or unintended outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The reference explicitly documents authenticated API calls and raw ZIP uploads to an external Govilo service, but provides no warning that user files and metadata will be transmitted off-platform. In the context of an agent skill that automates uploads, this omission increases the risk of users or downstream agents sending sensitive data to a third party without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The setup guide instructs users to execute installer scripts fetched directly from the internet without any warning or verification step. Even if the upstream source is legitimate, this pattern creates a supply-chain risk: a compromised host, CDN, DNS path, or installer script could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/api_client.py (reported line 27)May include surrounding context.

python
return body["data"]

    def presign(self, seller_address: str) -> dict:
        resp = requests.post(
            f"{self._base_url}/api/v1/bot/uploads/presign",
            headers=self._headers,
            json={"seller_address": seller_address},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The presign method sends the user-provided seller_address to a remote API via requests.post, but the file contains no confirmation prompt, logging, or explanatory comment disclosing that this data is transmitted externally. Because this is a code file, outbound transmission of user or system data should have some visible disclosure unless clearly covered elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The upload method reads a local zip file and transmits its contents to upload_url using an HTTP PUT request. There is no confirmation prompt, user-facing log, or inline documentation warning that local file contents will be sent off-system, which is a safety-relevant operation for code files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/api_client.py (reported line 51)May include surrounding context.

python
price: str,
        description: str = "",
    ) -> dict:
        resp = requests.post(
            f"{self._base_url}/api/v1/bot/items",
            headers=self._headers,
            json={

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The project declares requests without any version constraint, so dependency resolution may install a release affected by known vulnerabilities. In this skill's context, requests is likely used for Govilo API calls and presigned upload flows, so a vulnerable or unexpectedly changed HTTP client could expose credentials, mishandle redirects/auth, or introduce supply-chain instability in a network-facing workflow.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The command curl ... | sh fetches a remote script and immediately executes it, giving that remote content full code execution privileges in the user's shell. In a setup guide for a developer tool, this is more dangerous because users are likely to run it verbatim, often in trusted local environments that may contain credentials or source code.

Content

Scanner excerpt · references/setup-guide.md (reported line 10)May include surrounding context.

md
### Install uv

    # macOS / Linux
    curl -LsSf https://astral.sh/uv/install.sh | sh

    # Windows
    powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Static analysis

No suspicious patterns detected.