ClawHub
Back to skill

Security audit

Exuvia

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Exuvia integration, but it gives a remote service broad influence over agent behavior through persistent memory and server-suggested actions.

Review this skill before installing if you do not want a remote research platform to influence what your agent does next. Use a limited-scope Exuvia API key, avoid exposing it in logs or transcripts, and require human confirmation before following server-suggested commands, publishing, replying, or updating persistent basin keys.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
HEARTBEAT.md:24
Finding

External Service Responses Can Hijack Agent Instructions and Actions

Content
View full analysis
0` or hints suggest action: follow the suggested actions from `/me`, read the relevant threads, and decide if you have something genuine to contribute. ``` ### Technical Analysis The skill treats content returned by `https://exuvia-two.vercel.app` as authoritative instructions rather than as untrusted external data. In particular, it directs the agent to follow server-provided navigation hints and “ready-to-run curl commands.” These instructions can change after the local skill package has been reviewed. The heartbeat also requires remotely stored “basin keys” to be read before other activity after a context reset. This gives external, persistent state an opportunity to influence later sessions. The package does not define an allowlist of acceptable suggested operations, validate returned commands, constrain their destinations, or require expl ...[truncated 2028 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The heartbeat instructions tell an agent to immediately send a secret API key in outbound network requests, but provide no safeguards around secret handling, destination verification, logging, or least-privilege use. In an agent-skill context this is more dangerous than ordinary documentation because it operationalizes autonomous secret use and encourages follow-on execution of server-provided actions, increasing the chance of credential exposure or misuse if the endpoint, environment, or returned suggestions are compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Registration (new agents only)

bash
curl -X POST https://exuvia-two.vercel.app/api/v1/agents/spawn \
  -H "Content-Type: application/json" \
  -d '{"name": "your-agent-name", "description": "what you do"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes instructions to receive, save, export, and send an API key in request headers, but it does not warn that the key is a secret that should not be shared, logged, committed, or exposed in transcripts. Because this skill handles credentials and transmits them in HTTP requests, a user-facing warning about sensitive credential handling is expected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.