ClawHub
Back to skill

Security audit

BadgerPeek

Security checks for vulnerabilities and agentic risk

Overview

The skill is a read-only Honeybadger inspection helper, but its CLI can send a Honeybadger token to any HTTPS or loopback endpoint selected through environment variables.

Install only if you trust the environment that will run it. Set Honeybadger credentials only for this workflow, prefer a minimally scoped read-only token, and do not set HONEYBADGER_API_URL or HONEYBADGER_ENDPOINT except to a trusted Honeybadger endpoint you intentionally use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/badgerpeek:90
Finding

Honeybadger Authentication Token Can Be Sent to an Arbitrary HTTPS Endpoint

Content
View full analysis
"$auth_file" if ! status=$(curl \ --config "$auth_file" \ --silent \ --show-error \ --connect-timeout 10 \ --max-time 45 \ --retry 2 \ --retry-delay 1 \ --request GET \ --header 'Accept: application/json' \ --header "User-Agent: ${PROGRAM}/${VERSION}" \ --output "$response_file" \ --write-out '%{http_code}' \ "$url"); then ``` ### Technical Analysis The CLI reads its destination from `HONEYBADGER_API_URL` or the fallback `HONEYBADGER_ENDPOINT`. Its validation only requires an `https://` prefix, or loopback HTTP with an explicit port. It does not restrict the hostname to an official or explicitly trusted Honeybadger origin. The Honeybadger token is then written to a curl configuration as an HTTP Basic authentication username and used for the request. Consequently, an attacker who can influence the process environment can select an attacker-controlled HTTPS origin and cause the CLI ...[truncated 1867 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly instructs use of a shell-executable CLI (badgerpeek or scripts/badgerpeek) but does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, this can permit broader shell access than intended, weakening policy enforcement and increasing the chance that the skill is invoked with unrestricted command execution or with access to sensitive environment variables like Honeybadger tokens.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This shell script reads Honeybadger authentication tokens from environment variables and sends HTTP requests to a remote API, which transmits account-scoped data off the local system. Although the behavior is functional and expected for the tool, the file lacks a confirmation prompt, user-facing notice during execution, or explicit warning near the network/credential handling code about this sensitive operation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/badgerpeek (reported line 119)May include surrounding context.

text
auth_file=$(mktemp)
  response_file=$(mktemp)
  chmod 600 "$auth_file" "$response_file"
  printf 'user = "%s:"\n' "$token" >"$auth_file"

  if ! status=$(curl \

Static analysis

No suspicious patterns detected.