ClawHub
Back to skill

Security audit

Cocreator Content Research

Security checks for vulnerabilities and agentic risk

Overview

The skill's runtime behavior is mostly coherent read-only social media research, but its automatic uv installer runs an unverified remote shell script during installation.

Install only if you are comfortable with ScrapeCreators receiving the searched keywords, creator handles, and API key. Avoid the automatic `curl | sh` uv installer unless you trust that channel; prefer installing uv separately through a trusted, pinned, or verified method before enabling the skill.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unverified Remote Installer Piped Directly into a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–20
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

json
{
  "id": "uv-install",
  "kind": "bash",
  "script": "curl -LsSf https://astral.sh/uv/install.sh | sh",
  "bins": ["uv"],
  "label": "Install uv (cross-platform via bash)"
}

Technical Analysis

The installation command downloads content from https://astral.sh/uv/install.sh and streams it directly to sh. The downloaded payload is not pinned to a specific version, stored for inspection, checksum-verified, or authenticated with a separately verified signature.

Although the Astral endpoint is consistent with the declared uv prerequisite, the effective installer can change after the Skill has been reviewed. A compromise of the remote endpoint, its hosting infrastructure, DNS resolution, or the relevant TLS trust chain could therefore turn Skill installation into arbitrary code execution.

This behavior exceeds the minimum privileges required for the declared social-media research functionality. The runtime scripts only need an available Python environment, the requests dependency, and access to the ScrapeCreators API; they do not inherently require mutable remote shell code to be executed during installation.

Attack Path

  1. A user or agent initiates installation of the Skill prerequisite.
  2. The installation framework invokes the configured Bash command.
  3. curl retrieves the current response from https://astral.sh/uv/install.sh.
  4. The response is passed directly to sh without local review or integrity verification.
  5. If the response has been maliciously altered, arbitrary shell commands execute with the privileges of the account performing installation.
  6. Those commands could access user-readable data, modify user-owned files and configuration, install additional payloads, or perform network operations.

...[truncated 688 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the automatic curl | sh installation command and treat uv as an externally managed prerequisite.
  2. Direct users to install uv through a trusted operating-system package manager or another controlled software-distribution mechanism.
  3. If automated installation is essential:
    • Pin an exact uv release.
    • Download the release artifact to disk rather than streaming it into a shell.
    • Verify a published cryptographic checksum or signature obtained through a separately trusted channel.
    • Abort installation if verification fails.
    • Inspect and execute only the verified artifact.
  4. Run installation under an unprivileged account and avoid sudo or administrator execution.
  5. Where possible, replace runtime dependency resolution with a locked dependency set and verified hashes to improve reproducibility and reduce supply-chain exposure.
  6. Document the expected files and environment changes made by prerequisite installation so users can assess its scope before approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code does align with part of the description: it performs read-only intelligence gathering via ScrapeCreators and does not generate content or post. However, the declared description overstates the implemented functionality. The script only searches TikTok by keyword/hashtag and Instagram Reels by keyword, then ranks top content by views. There is no implementation for specific creator profile lookup, no direct competitor profile/strategy retrieval beyond inferring from searched content, and no general Instagram profile intelligence. Thus the description is materially broader than the actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares network and environment-dependent behavior but does not define any explicit tool scope or allowed-tools boundary. In agent environments, this can lead to overbroad execution authority, making it easier for the skill to access secrets or perform unintended outbound requests beyond the user's expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends the user's query parameters and an API key to an external service via HTTP requests, but the script provides no visible warning, confirmation, or explanatory comment about that outbound data transmission. Under the code-file criteria, network calls that transmit user or system data should have some form of user disclosure unless the behavior is clearly disclosed elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends the provided social-media handle and API key to a third-party service via requests.get, but the file contains no comment, docstring, or user-facing notice explaining that external network transmission occurs. Because network calls that transmit user or system data require some form of disclosure for code files, this operation should be explicitly communicated.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/competitor-research.py (reported line 33)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/competitor-research.py (reported line 34)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/competitor-research.py (reported line 70)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/competitor-research.py (reported line 71)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/keyword-search.py (reported line 31)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/keyword-search.py (reported line 75)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/profile-lookup.py (reported line 31)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/profile-lookup.py (reported line 52)May include surrounding context.

python
return {"error": str(e)}

def lookup_tiktok_profile(handle: str, api_key: str) -> Dict:
    profile_data = make_request("https://api.scrapecreators.com/v1/tiktok/profile", {"handle": handle}, api_key)
    
    if "error" in profile_data:
        return profile_data

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Piping a remote script directly into sh executes unverified code from the network at install time, creating a supply-chain and remote code execution risk. If the upstream host, transport, or installer content is compromised, the agent environment can be fully compromised, including exposure of SCRAPE_CREATORS_API_KEY and other accessible data.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
{
          "id": "uv-install",
          "kind": "bash",
          "script": "curl -LsSf https://astral.sh/uv/install.sh | sh",
          "bins": ["uv"],
          "label": "Install uv (cross-platform via bash)"
        }

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest frames this skill as analysis that relies on ScrapeCreators data, but does not indicate any need to access host environment secrets. Reading SCRAPE_CREATORS_API_KEY from environment variables introduces credential access behavior beyond the stated research function, even though it is used only to call the declared upstream service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The script reads the SCRAPE_CREATORS_API_KEY secret from the environment and uses it for external API requests. While this is common practice, the file lacks a docstring or comment warning users that a credential is required and will be used for third-party requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This Python code sends the provided social-media handles to third-party ScrapeCreators endpoints via HTTP requests. Although the network calls are visible in code and errors are printed, there is no user-facing warning, prompt, or explanatory comment/docstring disclosing that input data will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script reads SCRAPE_CREATORS_API_KEY from the environment, which is a sensitive credential source, but there is no explanatory comment, docstring, or warning describing that the skill accesses credentials from environment variables. For this category, credential access in code should have some visible disclosure unless already documented elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.