ClawHub
Back to skill

Security audit

Groq API Inference

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Groq API helper, but it needs Review because setup asks to persist broad activation preferences in global agent memory despite claiming persistence stays under ~/groq-api/.

Review the global-memory behavior before installing. The Groq API and audio/prompt transmission are expected for this skill, but you should only enable persistent activation if you are comfortable with broad triggers affecting later sessions; prefer local-only memory under ~/groq-api/ or require explicit invocation.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
setup.md:13
Finding

Persistent Global Memory Modification for Skill Activation

Content
View full analysis

Vulnerability Details

File Location: setup.md, lines 13–17
Vulnerability Type: Persistent modification of agent-wide memory
Risk Level: Medium

Vulnerable Code

markdown
Within the first 2-3 exchanges, ask:
- "Should this activate whenever you mention Groq, LLM latency, or inference tuning?"
- "Do you want proactive routing suggestions, or only when you ask?"

Save only activation trigger preferences to the user's global memory (no keys, no payload content). Mirror a short summary in `~/groq-api/memory.md`.

This also conflicts with the persistence boundary declared in SKILL.md, lines 106–109:

markdown
**This skill does NOT:**
- Store `GROQ_API_KEY` in project files
- Access files outside `~/groq-api/` for persistence
- Call undeclared third-party endpoints
- Modify itself or other skills

Technical Analysis

The setup instructions direct the agent to write activation triggers into the user's global memory. These persistent rules can affect future conversations beyond the current skill invocation and outside the documented local state directory, ~/groq-api/.

Although the content originates from user preferences rather than a concealed fixed payload, the skill requests broad triggers such as “Groq,” “LLM latency,” and “inference tuning.” Persisting those triggers at agent-wide scope may cause this skill or its routing recommendations to influence later sessions. Local storage is already available for the same preference, so global persistence is not required for the skill's core operation.

The instruction does not identify the global memory location, define an expiration period, namespace the stored rule, or provide a removal procedure. It also contradicts the claim that the skill does not access locations outside ~/groq-api/ for persistence.

Attack Path

  1. The skill is loaded for initial setup.
  2. It asks the user to authorize broad activation triggers and proactive suggestions.
  3. The agent writes the selec ...[truncated 1004 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store activation preferences only in the skill-local ~/groq-api/memory.md file.
  2. Remove the instruction to write preferences into global memory unless agent-wide persistence is essential.
  3. If global persistence is retained:
    • Obtain explicit, informed consent immediately before writing.
    • Disclose the exact storage destination and cross-session scope.
    • Show the precise entry that will be stored.
    • Namespace the entry specifically to the Groq skill.
    • Use narrowly defined triggers instead of broad phrases.
    • Add an expiration policy and documented deletion procedure.
    • Confirm successful deletion when the user disables the integration.
  4. Update SKILL.md so its stated persistence boundaries accurately reflect actual behavior.
  5. Treat local memory as the authoritative source and avoid duplicating behavioral rules into broader agent state.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
## Common Traps

- Using stale model IDs copied from old examples -> call `/models` and select available IDs at runtime.
- Sending giant prompts without truncation -> latency spikes and timeout risk.
- Ignoring `429` backoff guidance -> repeated failures under load.
- Mixing chat and transcription assumptions -> wrong endpoint and payload format.
- Trusting free-form text for automation -> parse and validate before executing.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-patterns.md (reported line 6)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-patterns.md (reported line 15)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-patterns.md (reported line 22)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-patterns.md (reported line 40)May include surrounding context.

md
## Base URL and Headers

Base URL:
`https://api.groq.com/openai/v1`

Required headers:
- `Authorization: Bearer $GROQ_API_KEY`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The examples send prompt text and audio files to a third-party API, but the documentation does not warn users that potentially sensitive data will leave their environment. In a production-safe skill, omission of a data-sharing notice can lead to accidental disclosure of confidential prompts, transcripts, or audio content during copy-paste use of the examples.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-patterns.md (reported line 22)May include surrounding context.

Chat Completion (minimal)

bash
curl -s https://api.groq.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-patterns.md (reported line 40)May include surrounding context.

Chat Completion (minimal)

bash
curl -s https://api.groq.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The audio transcription example uploads a local audio file to an external API, which can include voice biometrics, personal information, or confidential spoken content. In the absence of any warning or safe-use guidance, users may unintentionally transmit sensitive recordings off-platform.

Content

Scanner excerpt · api-patterns.md (reported line 56)May include surrounding context.

Audio Transcription

bash
curl -s https://api.groq.com/openai/v1/audio/transcriptions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -F "model=MODEL_ID" \
  -F "file=@sample.wav" | jq

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation phrases are broad enough to trigger the skill on generic mentions of 'Groq', 'LLM latency', or 'inference tuning', which can cause the skill to activate outside the user's intended context. This increases the chance of unintended persistence of user preferences and workflow steering, especially because the skill is designed to save trigger preferences globally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup flow instructs the agent to save activation preferences to global memory and mirror them into ~/groq-api/memory.md, but it does not clearly warn the user beforehand that this state will be persisted. That creates a consent and privacy issue because users may disclose preferences or operational details without realizing they are being stored across sessions and on disk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file defines a memory template and operating conventions, but it does not state when the skill should be invoked or what phrases or conditions activate it. For markdown files, missing trigger scope can make invocation behavior ambiguous because there are no explicit constraints or negative examples.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.