ClawHub
Back to skill

Security audit

SuperThink

Security checks for vulnerabilities and agentic risk

Overview

The skill is a clearly disclosed long-running research workflow that sends prompts to Anthropic and writes persistent reports, with no evidence of hidden or malicious behavior.

Install only if you are comfortable with a 6-12 hour unattended run, Anthropic API costs, persistent files under /data/superthink/, and possible delivery through any notification channel you configure. Avoid sensitive or regulated topics unless your Anthropic and notification setup is approved, and pin python-docx before enabling docx output.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:41
Finding

Unpinned Third-Party Dependency Creates a Mutable Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:41
  • SKILL.md:613
  • SKILL.md:620
  • md2docx-spec.md:20-24

Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:41:

yaml
install: pip install python-docx

SKILL.md:613:

text
- Requires: `pip install python-docx`

SKILL.md:620:

text
3. Install python-docx: `pip install python-docx`

md2docx-spec.md:20-24:

markdown
## Environment Requirements

- Python 3.8+
- `python-docx` library — install with: `pip install python-docx`
- No other third-party packages

Technical Analysis

The setup instructions install python-docx without specifying a reviewed version or verifying an integrity hash. Consequently, the exact code installed depends on the package-index state at installation time rather than on a reproducible, audited dependency lock.

If the upstream package, a maintainer account, the package index, or the dependency-resolution path is compromised, a malicious or unexpectedly changed release could be selected. The converter necessarily imports the installed package when generating Word documents, allowing code contained in a compromised dependency to execute with the privileges of the Skill runtime.

The package name is legitimate and no malicious package is currently embedded in the project. The vulnerability is the absence of controls that ensure future installations retrieve the same reviewed artifact.

Attack Path

  1. An operator follows the documented first-time setup instructions and executes pip install python-docx.
  2. Dependency resolution selects the latest compatible package release because no version or artifact hash is pinned.
  3. An attacker compromises the upstream release process, package-index account, configured index or mirror, or another relevant dependency-distribution path.
  4. The installer retrieves the attacker-controlled or modified artifact.
  5. The Skill invokes ` ...[truncated 954 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin python-docx to a specifically reviewed version in a dependency file rather than installing an unconstrained latest release:
text
python-docx==<reviewed-version>
  1. Record hashes for every resolved distribution and require hash verification:
bash
python -m pip install --require-hashes -r requirements.txt

A representative locked entry should take this form:

text
python-docx==<reviewed-version> \
    --hash=sha256:<verified-distribution-hash>

Include locked and hashed transitive dependencies where applicable.

  1. Configure an explicit trusted package index or an internally controlled artifact repository. Avoid silently falling back to additional public indexes.

  2. Generate and retain a lock file or software bill of materials so the reviewed dependency set is reproducible.

  3. Run installation and document conversion under a dedicated, non-privileged account. Expose only the input and output directories needed for conversion.

  4. Do not provide the converter process with ANTHROPIC_API_KEY, TELEGRAM_BOT_TOKEN, or unrelated credentials. Separate batch submission and document conversion into environments with distinct credentials and permissions.

  5. Update all duplicated installation instructions in SKILL.md and md2docx-spec.md so users cannot bypass the locked installation procedure by following an older command.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · batch-worker-spec.md.md (reported line 113)May include surrounding context.

md
"id": "another-request",
      "model": "claude-haiku-4-5",
      "max_tokens": 1000,
      "system": "Override system prompt for this request only",
      "messages": [
        {"role": "user", "content": "Different prompt"}
      ]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly requires external network access to Anthropic and optional notification channels, but the description does not clearly warn users that their prompts, scoped research topic, generated sections, and final brief may be transmitted to third-party services. In a research workflow, that can expose sensitive business, legal, financial, or product information without informed user consent, especially because the pipeline continues unattended after initial confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill performs extensive persistent writes under /data/superthink/ and is designed to run unattended for 6-12 hours after a single confirmation, yet the description does not prominently warn about this operational behavior. That creates risk of unexpected storage consumption, sensitive data retention, and long-running autonomous activity continuing after the user may no longer be actively supervising it.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The skill is intentionally designed for autonomous execution with no further approvals after scope confirmation, including job submission, polling, stage transitions, file writes, and optional notifications. In this context, autonomy increases risk because the pipeline can continue making consequential actions for hours, incur costs, persist data, and transmit outputs externally without additional human review.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
2. Create output directories: `mkdir -p /data/superthink/[slug]/sections`
3. Run **interrogate flow** — ask 4-10 questions in batches of 2 to narrow scope
4. Confirm scope summary — wait for explicit "yes"
5. From here: **fully hands-off** — no more checkpoints, no approvals needed

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This skill sends user-provided research inputs and generated content to an external API endpoint at api.anthropic.com as part of its normal operation. External transmission is contextually expected for this skill, but it still represents a real security and privacy concern because potentially sensitive content is exported off-system and later retrieved in batch results.

Content

Scanner excerpt · SKILL.md (reported line 463)May include surrounding context.

python3 /path/to/batch-worker.py poll

text

If not, implement equivalent: POST to `https://api.anthropic.com/v1/messages/batches`, poll until `processing_status == "ended"`, fetch JSONL results.

JSONL result format:
```jsonl

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · batch-worker-spec.md.md (reported line 130)May include surrounding context.

Submit a batch:

text
POST https://api.anthropic.com/v1/messages/batches
Headers:
  x-api-key: <ANTHROPIC_API_KEY>
  anthropic-version: 2023-06-01

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · batch-worker-spec.md.md (reported line 157)May include surrounding context.

Submit a batch:

text
POST https://api.anthropic.com/v1/messages/batches
Headers:
  x-api-key: <ANTHROPIC_API_KEY>
  anthropic-version: 2023-06-01

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · batch-worker-spec.md.md (reported line 167)May include surrounding context.

Submit a batch:

text
POST https://api.anthropic.com/v1/messages/batches
Headers:
  x-api-key: <ANTHROPIC_API_KEY>
  anthropic-version: 2023-06-01

Static analysis

No suspicious patterns detected.