Dievio Lead Search API

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:17 AM UTC
• Version: 1.0.3

Overview

This skill is a coherent Dievio API client, but users should handle returned lead contact data and the API key carefully.

Install only from a source you trust, prefer the ClawHub install path or a pinned installer/source revision, use DIEVIO_API_KEY instead of passing keys on the command line, and treat any raw or enriched results as sensitive contact data that should only be collected and stored when authorized.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:142
• Finding: Unpinned Third-Party Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `README.md:142-151` **Vulnerability Type**: Supply-chain risk from an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install as a Skill (skills.sh) ```bash npx skills add hundevmode/dievio-lead-search-openclaw-skill --skill dievio-lead-search-api ``` Preview available skills in repo: ```bash npx skills add https://github.com/hundevmode/dievio-lead-search-openclaw-skill --list ``` ``` ### Technical Analysis The documented installation commands invoke `npx skills` without specifying a reviewed package version or integrity digest. Depending on the local npm cache and registry behavior, `npx` may retrieve and execute the current version of the package from a remote package registry. This creates a mutable supply-chain dependency: the code executed when a user follows the instructions can differ from the code that existed when this Skill was audited. The GitHub-based source argument is also not pinned to an immutable commit or release. The commands are installation documentation rather than code automatically executed by the Skill. Exploitation therefore requires a user or automation process to follow the documented commands. Nevertheless, installation tooling commonly operates with the user's filesystem privileges, making source authenticity and version pinning security-sensitive. ### Attack Path 1. An attacker compromises the package registry account, upstream package, GitHub repository, release pipeline, or another component responsible for the retrieved installer. 2. The attacker publishes or substitutes a malicious version after this audit has completed. 3. A user follows the README and invokes the unpinned `npx skills` command. 4. `npx` retrieves the current, unreviewed package version or installer implementation. 5. Malicious installation code executes with the privileges of the invoking user. ### Impact Assessment Successful exploitation could permit ...[truncated 446 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `npx` to a reviewed, explicit version, for example by using a command of the form `npx skills@<reviewed-version> ...`. 2. Pin GitHub installation sources to an immutable commit hash rather than a mutable branch or repository head. 3. Where supported, verify package integrity using a lockfile, cryptographic checksum, signed release, or provenance attestation. 4. Document the expected package publisher, repository, version, and checksum so users can validate the downloaded artifact. 5. Prefer installing from a verified immutable release artifact. 6. Advise users to review installation scripts and avoid running the installer with administrator or root privileges. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/dievio_api.py:53
• Finding: API Key May Be Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/dievio_api.py:53-62`, with command-line options registered at `scripts/dievio_api.py:227` and `scripts/dievio_api.py:271` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Low ### Vulnerable Code ```python def _build_headers(auth_mode, api_key=None): headers = {"Content-Type": "application/json"} key = api_key or os.getenv("DIEVIO_API_KEY") if not key: raise ValueError("Missing API key. Set --api-key or DIEVIO_API_KEY.") if auth_mode == "x-api-key": headers["X-API-Key"] = key else: headers["Authorization"] = f"Bearer {key}" return headers ``` The secret-bearing command-line options are registered as follows: ```python search.add_argument("--api-key", help="Override DIEVIO_API_KEY.") ``` ```python linkedin.add_argument("--api-key", help="Override DIEVIO_API_KEY.") ``` ### Technical Analysis The CLI allows callers to provide the Dievio API credential as `--api-key`. Secrets supplied as command-line arguments may be exposed through: - Shell history files - Process inspection utilities - Process accounting or endpoint-monitoring systems - Diagnostic logs that record command lines - Automation logs and job metadata The script does not print the key itself, and its normal documented workflow uses the `DIEVIO_API_KEY` environment variable. The exposure occurs only when a caller chooses the command-line override. The key is legitimately transmitted over HTTPS to the fixed, documented Dievio endpoint as an authentication header; that network transmission is necessary for the declared API-client functionality and is not itself unauthorized exfiltration. ### Attack Path 1. A user invokes the utility with a command such as: ```bash python3 scripts/dievio_api.py search --api-key SECRET --body-file search_body.json ``` 2. The complete command is retained in shell history, process t ...[truncated 953 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--api-key` option and require a protected credential source such as `DIEVIO_API_KEY`, a secrets manager, or a permission-restricted configuration file. 2. If an interactive option is required, read the secret using a no-echo prompt such as Python's `getpass`. 3. Alternatively, accept the credential through standard input or a dedicated file descriptor rather than through command-line arguments. 4. If backward compatibility requires retaining `--api-key`, display a prominent warning in CLI help and documentation that the option may expose the secret through shell history and process inspection. 5. Recommend narrowly scoped credentials, regular rotation, usage monitoring, and immediate revocation following suspected disclosure. 6. Ensure automation systems mask the credential and do not record full command lines containing secrets. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Self-Modification

High

• Category: Rogue Agent

Content

## Release Process

1. Update skill files and script.
2. Commit and push to GitHub.
3. Publish new ClawHub version:

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning an exact package/version, which means execution depends on whatever package version is current at install time. If the upstream package is compromised, replaced, or changed incompatibly, users could execute unreviewed code during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This `npx skills add ... --list` command also relies on an unpinned package resolution path, so users may run a different package version than the one reviewed by the skill author. That creates a supply-chain risk because `npx` can fetch and execute remote code at runtime.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The verification step again uses `npx skills add ...` without a pinned version, repeating the same supply-chain exposure in a release workflow. Because this appears in a publish/verify section, maintainers may execute it routinely, increasing the chance of eventual compromise through a malicious or altered upstream package.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill requires sensitive capabilities (`env`, `file_read`, and `network`) but does not explicitly declare a tool/permission scope. That creates an authorization ambiguity where an agent runtime may grant broader access than reviewers or policy expect, increasing the chance of unintended secret exposure or external data exfiltration during API use.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This markdown file documents options that retrieve raw data, emails, personal emails, work emails, and phone numbers, but it does not include any warning about handling sensitive personal data or privacy implications. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The LinkedIn lookup command is explicitly designed to send profile URLs to a third-party API and can request enrichment fields such as work emails, personal emails, and phones. In a skill context, this creates a real privacy/security risk because operators may transmit personal identifiers and collect sensitive contact data without an explicit consent/authorization gate or strong warning at execution time.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The LinkedIn lookup defaults enable includePersonalEmails=True and onlyWithEmails=True, making retrieval of personal contact data part of the normal execution path rather than an explicitly opted-in action. This increases the likelihood of over-collection and downstream exposure of sensitive personal information in routine use.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The --raw-output mode prints the full API response, which may include personal emails, phone numbers, and other sensitive enrichment data directly to stdout. In agent and automation environments, stdout is often logged, persisted, or shown to downstream tools, so this can unintentionally disclose PII beyond the intended recipient.

Static analysis

No suspicious patterns detected.