ClawHub
Back to skill

Security audit

OpenGemini SaaS Builder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SaaS-building helper that uses Gemini, GitHub, and Vercel for expected project workflows, with no evidence of hidden persistence, exfiltration, or deceptive behavior.

Install only if you are comfortable using Gemini CLI for product briefs and authenticated GitHub/Vercel CLIs for publishing or deployment. Before repo creation or deployment, confirm repo visibility, scan for secrets, review environment variables, and avoid putting confidential or regulated data in Gemini prompts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script creates a remote GitHub repository and immediately pushes the current working tree without any explicit interactive confirmation, dry-run, or user-visible warning. In the context of a SaaS-building skill that may be run as part of an automated workflow, this increases the risk of unintentionally publishing sensitive source code, secrets, internal history, or work-in-progress content to GitHub.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends the project name and requirements brief to the external gemini service and writes the returned content to a local file, but it provides no warning, consent step, or data-handling notice to the operator. In a SaaS-builder skill, briefs often contain proprietary product plans, internal architecture ideas, customer details, or secrets accidentally pasted by users, so undisclosed off-box transmission creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file describes a deployment workflow and includes 'Run deployment' as an action, but it does not warn that deployment may change live system behavior or affect availability. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · scripts/generate_requirements.sh (reported line 7)May include surrounding context.

sh
if [ "$#" -lt 2 ]; then
  echo "Usage: $0 <project-name> '<product description and constraints>' [output-file]" >&2
  exit 1
fi

project="$1"
brief="$2"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code redirects the output of the gemini command into "$out", which creates or overwrites a file, and the only user-facing message appears after the write completes. There is no prior confirmation, warning comment, or explanatory disclosure in this file about the file-write side effect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.