ClawHub
Back to skill

Security audit

Auth

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only authentication skill with no executable install behavior, but some copyable examples show insecure authentication patterns that could put accounts at risk if used as written.

Install only if you will treat it as a high-level checklist, not as code to paste into production. Before using its OAuth, OIDC, or middleware examples, replace them with patterns that fully verify tokens, link accounts only through an authenticated confirmation flow, and validate sessions cryptographically or through a trusted server-side store.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
oauth.md:205
Finding

OIDC ID Token Decoded Without Cryptographic Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
oauth.md:165
Finding

Automatic OAuth Account Linking Based Only on Email Address

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
middleware.md:208
Finding

Next.js Middleware Treats Cookie Presence as Successful Authentication

Content
View full analysis
pathname.startsWith(p))) { return NextResponse.next(); } // Check for session cookie const session = request.cookies.get('session'); if (!session) { return NextResponse.redirect(new URL('/login', request.url)); } return NextResponse.next(); } ``` ### Technical Analysis The middleware checks only whether a cookie named `session` exists. It does not verify a signature, expiration, issuer, audience, or server-side session record. Because clients can create arbitrary cookies, an attacker can satisfy this check by sending any nonempty value. The public-route check also uses unrestricted prefix matching. Consequently, a path such as `/api/auth-attacker` is treated as public because it begins with `/api/auth`, even if that route was not intended to bypass authentication. Middleware should not be considered an authentication boundary unless it validates the credential. Every sensitive route must also perform authoritative authentication and authorization. ### Attack Path **Cookie-presence bypass:** 1. An attacker requests a route protected only by this middleware. 2. The middleware redirects the request because no session cookie is present. 3. The attacker adds an arbitrary cookie such as `session=x`. 4. The middleware observes that the cookie exists and permits the request. 5. If the destination route relies on the middleware as its authentication control, the attacker reaches protected functionality without a valid session. **Public-prefix bypass:** 1. An application exposes a sensitive route whose path begins with a ...[truncated 634 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
| OAuth and social login | `oauth.md` |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · strategies.md (reported line 73)May include surrounding context.

text
+-----------------------------------------------------+
|  Access Token (15min)    Refresh Token (7 days)     |
|  - In memory             - httpOnly cookie          |
|  - Sent in header        - Sent only to /refresh    |
|  - Short-lived           - Rotated on use           |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · strategies.md (reported line 81)May include surrounding context.

text

**Refresh flow:**
1. Access token expires -> client calls /refresh
2. Server validates refresh token
3. Server issues new access token + rotates refresh token
4. If refresh token reused -> revoke all tokens (breach detected)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · strategies.md (reported line 152)May include surrounding context.

text

**Refresh flow:**
1. Access token expires -> client calls /refresh
2. Server validates refresh token
3. Server issues new access token + rotates refresh token
4. If refresh token reused -> revoke all tokens (breach detected)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · strategies.md (reported line 83)May include surrounding context.

Refresh flow:

  1. Access token expires -> client calls /refresh
  2. Server validates refresh token
  3. Server issues new access token + rotates refresh token
  4. If refresh token reused -> revoke all tokens (breach detected)
typescript

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · strategies.md (reported line 156)May include surrounding context.

Refresh flow:

  1. Access token expires -> client calls /refresh
  2. Server validates refresh token
  3. Server issues new access token + rotates refresh token
  4. If refresh token reused -> revoke all tokens (breach detected)
typescript

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · strategies.md (reported line 143)May include surrounding context.

md
| Storage | XSS Safe | CSRF Safe | Persists | Best For |
|---------|----------|-----------|----------|----------|
| Memory (JS variable) | [NO] | [YES] | [NO] | Access tokens (SPA) |
| httpOnly cookie | [YES] | [NO]* | [YES] | Refresh tokens, sessions |
| localStorage | [NO] | [YES] | [YES] | [NO] Never for auth |
| Secure enclave (mobile) | [YES] | [YES] | [YES] | Mobile apps |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · oauth.md (reported line 67)May include surrounding context.

md
}
  
  // Exchange code for tokens
  const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · oauth.md (reported line 120)May include surrounding context.

md
const config = {
  authUrl: 'https://github.com/login/oauth/authorize',
  tokenUrl: 'https://github.com/login/oauth/access_token',
  userInfoUrl: 'https://api.github.com/user',
  emailUrl: 'https://api.github.com/user/emails', // Email is separate
  scopes: ['read:user', 'user:email']
};

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · oauth.md (reported line 121)May include surrounding context.

md
const config = {
  authUrl: 'https://github.com/login/oauth/authorize',
  tokenUrl: 'https://github.com/login/oauth/access_token',
  userInfoUrl: 'https://api.github.com/user',
  emailUrl: 'https://api.github.com/user/emails', // Email is separate
  scopes: ['read:user', 'user:email']
};

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The OIDC example decodes an ID token with jwt.decode() without cryptographically verifying its signature, issuer, audience, or expiry before use. In authentication documentation, developers often copy samples directly, so this can lead to token forgery or acceptance of attacker-controlled identity claims, causing account takeover or authentication bypass.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · passwords.md (reported line 53)May include surrounding context.

md
const prefix = hash.slice(0, 5);
  const suffix = hash.slice(5);
  
  const res = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`);
  const text = await res.text();
  
  return text.includes(suffix);

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes a sensitive endpoint for account deletion protected by recent MFA, but the surrounding text does not explicitly warn that the operation is destructive or may permanently affect user data. Under the markdown-specific missing-warning criterion, behaviors that can affect user data or system integrity should be accompanied by a user-facing warning in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.