ClawHub
Back to skill

Security audit

ToolSnap

Security checks for vulnerabilities and agentic risk

Overview

ToolSnap discloses its extraction and paid tools, but directs your agent to install remote instructions and save remote guidance without review.

Review before installing. Require approval for skill updates and inspect any memory snippet before saving it. Only send authentication headers or private content if you trust ToolSnap to process them. If enabling paid tools, use a dedicated wallet with a small balance and set a spending limit.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

The skill instructs agents to overwrite its local instructions with a remotely supplied version.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The skill instructs the agent to replace its local instructions with remote content based solely on a higher version number, without review or integrity verification. A compromised publisher or hosting account could therefore introduce persistent malicious instructions into future agent runs; HTTPS does not protect against a compromised source.

Content

No source excerpt is available for this finding.

The skill instructs the agent to overwrite its local instructions with a remote version without warning about the integrity impact.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

This is the same underlying remote-update vulnerability as SDI-2, not an independent attack path. Calling the remote document canonical and directing replacement without an integrity or approval gate promotes mutable external content into persistent agent instructions.

Content

No source excerpt is available for this finding.

The advertised tool scope includes generative media operations rather than only deterministic extraction.

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The manifest describes exact parsing instead of LLM summarization, but the paid-tool section also offers image generation, video generation, and text-to-speech. Those operations create new media rather than extract existing web/data content, materially expanding the skill beyond its stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.