ClawHub
Back to skill

Security audit

Dievio Lead Search API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Dievio API client, but users should handle returned lead contact data and the API key carefully.

Install only from a source you trust, prefer the ClawHub install path or a pinned installer/source revision, use DIEVIO_API_KEY instead of passing keys on the command line, and treat any raw or enriched results as sensitive contact data that should only be collected and stored when authorized.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:142
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis
Remediation
View remediation
...`. 2. Pin GitHub installation sources to an immutable commit hash rather than a mutable branch or repository head. 3. Where supported, verify package integrity using a lockfile, cryptographic checksum, signed release, or provenance attestation. 4. Document the expected package publisher, repository, version, and checksum so users can validate the downloaded artifact. 5. Prefer installing from a verified immutable release artifact. 6. Advise users to review installation scripts and avoid running the installer with administrator or root privileges. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
scripts/dievio_api.py:53
Finding

API Key May Be Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 187)May include surrounding context.

md
## Release Process

1. Update skill files and script.
2. Commit and push to GitHub.
3. Publish new ClawHub version:

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx skills add ... without pinning an exact package/version, which means execution depends on whatever package version is current at install time. If the upstream package is compromised, replaced, or changed incompatibly, users could execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This npx skills add ... --list command also relies on an unpinned package resolution path, so users may run a different package version than the one reviewed by the skill author. That creates a supply-chain risk because npx can fetch and execute remote code at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The verification step again uses npx skills add ... without a pinned version, repeating the same supply-chain exposure in a release workflow. Because this appears in a publish/verify section, maintainers may execute it routinely, increasing the chance of eventual compromise through a malicious or altered upstream package.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill requires sensitive capabilities (env, file_read, and network) but does not explicitly declare a tool/permission scope. That creates an authorization ambiguity where an agent runtime may grant broader access than reviewers or policy expect, increasing the chance of unintended secret exposure or external data exfiltration during API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file documents options that retrieve raw data, emails, personal emails, work emails, and phone numbers, but it does not include any warning about handling sensitive personal data or privacy implications. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The LinkedIn lookup command is explicitly designed to send profile URLs to a third-party API and can request enrichment fields such as work emails, personal emails, and phones. In a skill context, this creates a real privacy/security risk because operators may transmit personal identifiers and collect sensitive contact data without an explicit consent/authorization gate or strong warning at execution time.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The LinkedIn lookup defaults enable includePersonalEmails=True and onlyWithEmails=True, making retrieval of personal contact data part of the normal execution path rather than an explicitly opted-in action. This increases the likelihood of over-collection and downstream exposure of sensitive personal information in routine use.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The --raw-output mode prints the full API response, which may include personal emails, phone numbers, and other sensitive enrichment data directly to stdout. In agent and automation environments, stdout is often logged, persisted, or shown to downstream tools, so this can unintentionally disclose PII beyond the intended recipient.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.