ClawHub
Back to skill

Security audit

UserLayer

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it needs Review because its paid API key can be sent to any configured API host.

Review before installing. Use only a UserLayer-scoped API key with quotas, avoid setting LAUNCHBASE_API_URL unless you fully trust the host, and treat analyze/query calls as billable external transmissions of the app URL, question text, and related analysis identifiers.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/call_api.py:9
Finding

API Credential Disclosure Through an Unrestricted Configurable Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Tainted flow: 'LAUNCHBASE_API_URL' from os.environ.get (line 9, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The request destination is derived from an environment variable and the helper automatically attaches the API bearer token to every outbound request. If an attacker can influence LAUNCHBASE_API_URL or deployment configuration, they can redirect traffic and exfiltrate the API key and submitted review-analysis data to an attacker-controlled host. In this skill context, the helper is intended for one vendor service, so unrestricted endpoint override materially increases risk.

Content

Scanner excerpt · scripts/call_api.py (reported line 42)May include surrounding context.

python
}

    try:
        response = requests.post(
            f"{LAUNCHBASE_API_URL}/v1/{service}{endpoint}",
            json=params,
            headers={

Tainted flow: 'LAUNCHBASE_API_URL' from os.environ.get (line 7, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request URL is derived from an environment variable and the code sends a Bearer API key to whatever host that variable points to. If an attacker can influence deployment configuration, they can redirect status checks to an attacker-controlled server and exfiltrate the credential, making this effectively an SSRF-plus-secret-leak issue.

Content

Scanner excerpt · scripts/main.py (reported line 45)May include surrounding context.

python
return {"success": False, "error": "AUTH_NO_API_KEY"}
        
    try:
        response = requests.get(
            f"{LAUNCHBASE_API_URL}/v1/{SERVICE_NAME}/analyze/{analysis_id}/status",
            headers={"Authorization": f"Bearer {api_key}"},
            timeout=30

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The manifest presents the skill as a narrowly scoped UserLayer review-analysis integration, but the detected behavior indicates generic outbound API gateway access and auth handling not tightly bound to that purpose. This mismatch is dangerous because it can mislead reviewers and users into approving a skill that may send data to broader endpoints than expected, enabling data exfiltration, unexpected third-party processing, or abuse of provided credentials.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares access to environment variables and relies on outbound networked wrappers, but it does not define any explicit tool scope such as allowed-tools or permissions. That creates an overbroad execution surface where a caller or runtime may permit more capabilities than users expect, increasing the chance of unintended secret access or external communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill includes pricing details, but it does not present a clear operational warning that invoking API actions will incur real charges before use. In an agent setting, this can lead to unauthorized or surprising spend, especially if analysis runs are triggered automatically or repeatedly during polling workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language instructions and warnings exclusively in Chinese, including the file header and operational docstring context. That can violate a language/locale policy when the skill does not offer any user choice or document that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This generic helper can call any service and endpoint while reusing the same environment-sourced credential, which exceeds the stated purpose of the skill. That broad routing surface can enable unintended backend actions, data access, or policy bypass if upstream callers can control service or endpoint values. In a narrowly scoped user-review analysis skill, this mismatch makes abuse more plausible.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/call_api.py (reported line 42)May include surrounding context.

python
}

    try:
        response = requests.post(
            f"{LAUNCHBASE_API_URL}/v1/{service}{endpoint}",
            json=params,
            headers={

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The function sends the provided params payload to an external endpoint and uses an API key for authentication. While the docstring describes the API call for developers, there is no user-facing warning, confirmation, or visible disclosure in code output about transmitting potentially sensitive user or system data off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The functions send app_url, pain_point_id, and question to external API endpoints via call_api, but this file provides no confirmation prompt, logging, or comment/docstring warning that user data is being transmitted off-system. Because these are network operations involving potentially sensitive user inputs, the code should disclose that behavior unless such warning exists elsewhere in markdown documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

check_status reads API_KEY from the environment and sends it in an Authorization header to a remote endpoint. While this may be necessary for the skill, the file lacks any user-facing disclosure, logging, or explanatory warning about credential use and outbound transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The query function docstring is written in Chinese, which imposes a language-specific instruction/documentation choice without opt-in or justification elsewhere in the file. Under the policy, language constraints should either offer a choice or be clearly documented as intentional and context-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.