ClawHub
Back to skill

Security audit

Scan.now Security Tools

Security checks for vulnerabilities and agentic risk

Overview

The skill provides clearly scoped public website and phishing checks through Scan.now, with no local credential access or destructive operations.

Submitted URLs go to Scan.now. Use public links without passwords, access tokens, or confidential details, and review the linked MCP privacy policy before sharing sensitive information. Authorize website assessments only for sites you own or have permission to test; a clean result does not guarantee safety.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
# Scan.now tools

Connect to the public Streamable HTTP MCP endpoint at `https://mcp.scan.now`.
No API key, account, or environment variable is required. Do not ask the user to obtain
a Scan.now credential, and do not invent REST endpoints; use the MCP tools exposed by
that server.

The workflow sends user-provided URLs to a third-party service without a privacy warning.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The workflow submits user-provided URLs to an external service without requiring disclosure of that data transfer or screening for sensitive URL components. Even publicly reachable URLs can contain signed access tokens, account identifiers, or confidential paths; permission to assess a website does not necessarily authorize sharing those details with a third party. The public-target restriction and privacy-policy link reduce concern but do not directly address this exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.