ClawHub
Back to skill

Security audit

Talk

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only voice setup skill with coherent instructions, but users should handle provider secrets and public webhook tunnels carefully.

Before installing or using this skill, keep provider API keys and auth tokens out of source control, prefer environment variables or a secrets manager, validate webhook signatures, restrict exposed routes, disable temporary tunnels when finished, and review or pin the external phone-voice skill before installing it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
config.md:51
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: config.md:51-62
Vulnerability Type: Unpinned external dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown
## Option 3: Advanced Integration

Install the `phone-voice` skill for:
- Caller ID authentication
- Voice PIN security
- Memory injection (MEMORY.md loaded into calls)
- Cost tracking per call
- Cloudflare tunnel (permanent URL)

```bash
clawhub install phone-voice
text

### Technical Analysis

The documentation instructs users to install the externally maintained `phone-voice` skill by package name alone. The command does not identify a reviewed version, immutable digest, trusted publisher, repository, or integrity-verification procedure.

Consequently, the installed content can differ from the content that was originally reviewed. This creates a supply-chain trust boundary in which a compromised publisher account, malicious package replacement, namespace takeover, or unsafe future release could deliver unintended code.

The advertised package capabilities increase the potential impact: the package may load `MEMORY.md`, process telephone calls, access provider credentials, and establish a permanent Cloudflare tunnel. The project does not itself contain the external package, so this finding identifies an unsafe dependency-installation practice rather than proof that the referenced package is malicious.

### Attack Path

1. An attacker compromises the package publisher, takes control of the package namespace, or causes an unsafe release to be published under `phone-voice`.
2. A user follows the documented `clawhub install phone-voice` command.
3. Because no version or immutable digest is specified, the package manager retrieves the currently available package.
4. The package is installed and invoked with the permissions available to the user or Agent runtime.
5. Malicious package behavior could then access data and serv
...[truncated 815 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed version or, preferably, an immutable package digest.
  • Document the expected publisher, source repository, and package identifier.
  • Require cryptographic signature or checksum verification before installation.
  • Review package permissions and source code before enabling access to memory, credentials, telephone services, or tunnels.
  • Run the skill under a dedicated least-privilege account or sandbox.
  • Restrict filesystem access to explicitly required files rather than broadly exposing Agent memory.
  • Store provider credentials in a secret manager and provide only narrowly scoped credentials.
  • Establish a controlled upgrade process in which new package versions are reviewed before deployment.

T09 · Insecure Skill Coding Practices

Warning
Location
providers.md:66
Finding

Public Tunnel Instructions Omit Mandatory Webhook Authentication Controls

Content
View full analysis

Vulnerability Details

File Location: providers.md:66-84
Vulnerability Type: Unsafe exposure of a local webhook service
Risk Level: Medium

Complete Code Snippet:

markdown
## Webhook Tunnels

Voice calls need public URLs for webhooks.

**ngrok (temporary):**
```bash
ngrok http 8013
# Use the https URL

Tailscale funnel (permanent, requires Tailscale):

bash
tailscale funnel 8013

Cloudflare tunnel (permanent, free):

bash
cloudflared tunnel --url http://localhost:8013
text

### Technical Analysis

The documented commands make the service on local port `8013` publicly reachable. The instructions do not require users to verify that the service is limited to the intended webhook route, authenticate requests, validate provider signatures, reject replayed requests, apply rate limits, or configure tunnel-level access restrictions.

HTTPS at the tunnel edge protects transport confidentiality but does not establish that a request originated from Twilio, Telnyx, or another trusted provider. Likewise, the inbound caller allowlist documented elsewhere controls permitted caller identities but does not independently authenticate HTTP requests arriving at the webhook endpoint.

If the local service accepts unauthenticated or weakly validated requests, an attacker who obtains the public URL can submit forged provider events directly. The vulnerability becomes exploitable when the exposed application does not implement its own robust webhook controls.

### Attack Path

1. A user starts ngrok, Tailscale Funnel, or Cloudflare Tunnel for local port `8013`.
2. The tunnel creates a publicly reachable URL and forwards requests to the local service.
3. An attacker obtains that URL through disclosure, logs, configuration exposure, shared setup information, or endpoint discovery.
4. The attacker sends forged or replayed webhook requests that imitate legitimate voice-provider events
...[truncated 972 chars]
Remediation
View remediation

Remediation Suggestions

  • Require cryptographic validation of Twilio, Telnyx, or other provider webhook signatures before processing any event.
  • Validate the expected host, request path, HTTP method, content type, and provider account identifier.
  • Add timestamp or nonce validation and reject replayed requests outside a short acceptance window.
  • Expose only the required webhook route rather than forwarding a general-purpose local service.
  • Apply per-source and per-account rate limits, request-size limits, timeouts, and abuse monitoring.
  • Configure tunnel access policies or an authenticated gateway where compatible with provider delivery.
  • Ensure administrative, debug, health, and unrelated application routes are not exposed through the same public listener.
  • Store webhook secrets outside documentation and configuration committed to source control.
  • Document how to disable and revoke temporary tunnel URLs after setup.
  • Retain the caller allowlist as a defense-in-depth control, but do not treat it as a substitute for HTTP webhook authentication.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · providers.md (reported line 40)May include surrounding context.

ElevenLabs (TTS + Conversational)

  1. Create account: https://elevenlabs.io/
  2. Get API key from Profile
  3. For agents: use Conversational AI dashboard
yaml

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · providers.md (reported line 56)May include surrounding context.

ElevenLabs (TTS + Conversational)

  1. Create account: https://elevenlabs.io/
  2. Get API key from Profile
  3. For agents: use Conversational AI dashboard
yaml

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file instructs users to obtain and place highly sensitive provider credentials into configuration examples without any warning about treating them as secrets, avoiding commits, or using secure secret storage. In a skill focused on live voice providers, these tokens can enable account takeover, billing abuse, call control, or access to speech services if users mishandle them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation tells users to expose a local service via ngrok or Tailscale funnel for voice webhooks but omits any warning that this publishes a locally running endpoint to the internet. In this context, that can expose unauthenticated or weakly protected webhook handlers to probing, abuse, or unintended access during development.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.