ClawHub
Back to skill

Security audit

Combination of Many Breaches

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it directs agents to send emails, usernames, or passwords to a third-party leaked-credential API without adequate warnings or safeguards.

Install only if you are comfortable with queries being sent to ProxyNova. Do not submit live passwords, API keys, tokens, or other secrets; use only identifiers you are authorized to investigate, and redact any returned credentials before sharing or storing results.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:17
Finding

Disclosure of Sensitive Credentials Through a Third-Party GET Query

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-23
Vulnerability Type: Sensitive data exposure through URL query parameters
Risk Level: High

Vulnerable Code

markdown
Required arg: email, username, or password.

Append `?query=` with the supplied email, username, or password.

Simple request:
```bash
curl 'https://api.proxynova.com/comb?query=jrubin'

Technical Analysis

The Skill explicitly permits a raw password to be supplied as the API query and instructs the Agent to place that value in a GET URL parameter. Executing the documented command transmits the sensitive value to the external service api.proxynova.com.

URLs are commonly recorded by API access logs, reverse proxies, network-monitoring systems, security telemetry, command transcripts, and shell history. Consequently, using a password in the query parameter creates more exposure than transmitting sensitive data through a properly protected and non-logged request body. HTTPS protects the request in transit but does not prevent the destination service or endpoint infrastructure from recording the URL.

The API response also contains plaintext leaked credential pairs, as demonstrated later in the document. If the Agent returns those records without redaction, the credentials can persist in conversation histories and downstream logs.

Attack Path

  1. A user or attacker persuades an operator to invoke the Skill with a current or reused password as the required argument.
  2. The Agent follows the Skill instructions and constructs a URL such as https://api.proxynova.com/comb?query=<password>.
  3. curl transmits the raw password to the third-party ProxyNova service.
  4. The password may be retained in service access logs, proxy logs, monitoring telemetry, shell history, or Agent execution records.
  5. Anyone with access to those records may recover the password.
  6. If the password is valid or reused, it may be tested against associated services, potenti ...[truncated 865 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prohibit passwords, authentication tokens, API keys, and other secrets as search inputs.
  2. Restrict queries to non-secret identifiers, such as an email address, and only process identifiers the requester is authorized to investigate.
  3. Clearly disclose that query data will be transmitted to ProxyNova and require explicit user consent before making the request.
  4. Prefer a vetted breach-checking service that supports privacy-preserving mechanisms, such as partial-hash or k-anonymity queries, so raw passwords are never disclosed.
  5. Do not include sensitive values in URL query parameters. If sensitive identifiers must be transmitted, use an appropriately protected request body and enforce redaction and no-log controls, while recognizing that raw passwords should still never be sent.
  6. Redact passwords from API responses before displaying, storing, or forwarding results. For example, return only the affected identifier, breach status, and remediation guidance.
  7. Disable command echoing and ensure shell history, Agent traces, HTTP diagnostics, and telemetry cannot retain sensitive request or response data.
  8. Add input validation that rejects password-like secrets and displays guidance to rotate any password already submitted.
  9. Document acceptable-use and authorization requirements to reduce the risk of credential harvesting or unauthorized account targeting.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly invites users to search by email, username, or password against a third-party leaked-credential API, but provides no warning that the supplied query may itself be highly sensitive and will be transmitted to an external service. In this context, users may paste real passwords or identifiers, causing additional disclosure of secrets to ProxyNova and creating privacy, compliance, and handling risks beyond the original breach data exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill sends user-supplied input directly to an external endpoint at api.proxynova.com. While external calls are expected for this skill's purpose, the dangerous aspect is that the transmitted data may be sensitive credentials or identifiers from a user, and the skill does not provide safeguards, minimization guidance, or warnings about third-party disclosure.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Simple request:

bash
curl 'https://api.proxynova.com/comb?query=jrubin'
# Output:
# {
#    "count": 795,

Static analysis

No suspicious patterns detected.