Security audit
Security checks for vulnerabilities and agentic risk
This is a real Vercel monitoring skill, but it needs Review because its URL checks can be bypassed and may let the agent request internal/private services.
Install only if you understand that it will make HTTP requests from your agent environment to the URLs you provide and to Vercel when a token is supplied. Prefer VERCEL_TOKEN from a protected environment variable, do not pass tokens on the command line, avoid ALLOW_INTERNAL unless you intentionally need private-network monitoring, and do not let untrusted input choose the homepage/API URLs or state-file path.
scripts/watchdog-check.sh:31Bypassable URL Validation Enables Server-Side Requests to Internal Network Services
scripts/watchdog-check.sh:61Vercel API Tokens Can Be Exposed Through Command-Line Arguments
The skill is presented as Vercel deployment monitoring, but the documented options allow targeting arbitrary URLs and explicitly permit internal/private/local resources when ALLOW_INTERNAL is enabled. In practice, this broadens the skill into a general network probing tool and increases SSRF-style or internal reconnaissance risk, especially since the file also suggests undeclared local state usage.
The skill is presented as Vercel deployment monitoring, but the documented options allow targeting arbitrary URLs and explicitly permit internal/private/local resources when ALLOW_INTERNAL is enabled. In practice, this broadens the skill into a general network probing tool and increases SSRF-style or internal reconnaissance risk, especially since the file also suggests undeclared local state usage.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
### Compliance with ClawHub Policies
This skill:
- Does **not** attempt to bypass security controls
- Does **not** include obfuscated or hidden functionality
- Is **open source** and transparent about all operations
- Respects `robots.txt` and common web standards
The script advertises a simple environment variable, ALLOW_INTERNAL, to bypass internal/private URL protections entirely. In an agent or automation context, this weakens SSRF safeguards because any caller able to influence environment variables can re-enable probing of localhost, RFC1918 space, or internal hostnames.
echo " --help Show this help message"
echo ""
echo "Security note: Only monitor sites you own. Internal/private URL checks are enabled by default."
echo "To bypass security checks for internal resources, set ALLOW_INTERNAL=true env var."
exit 0
;;
*)
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
echo " --help Show this help message"
echo ""
echo "Security note: Only monitor sites you own. Internal/private URL checks are enabled by default."
echo "To bypass security checks for internal resources, set ALLOW_INTERNAL=true env var."
exit 0
;;
*)
The skill clearly instructs the user to run shell commands and scripts, yet it declares no explicit tool scope or permissions. This creates a governance gap: an agent or platform may permit broader shell execution than intended, making review and enforcement of least privilege harder.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
{
"id": "check-deps",
"kind": "manual",
"instructions": "Ensure curl and jq are installed. On Debian/Ubuntu: sudo apt-get install curl jq. On macOS: brew install curl jq.",
"bins": ["curl", "jq"],
"label": "Check for curl and jq dependencies",
},
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
{
"id": "check-deps",
"kind": "manual",
"instructions": "Ensure curl and jq are installed. On Debian/Ubuntu: sudo apt-get install curl jq. On macOS: brew install curl jq.",
"bins": ["curl", "jq"],
"label": "Check for curl and jq dependencies",
},
The skill metadata and manifest describe automated health checks, cache freshness verification, and API validation, but the implementation only enumerates recent deployments and reports their states. This mismatch can cause operators or downstream agents to falsely assume post-deployment verification occurred, leading to insecure or broken deployments being treated as healthy.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
API_URL=""
# Allow internal URL monitoring only when explicitly permitted via environment variable
if [[ -n "${ALLOW_INTERNAL:-}" ]]; then
SKIP_VALIDATION=true
echo "Warning: Internal URL validation disabled via ALLOW_INTERNAL environment variable"
else
SKIP_VALIDATION=false
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
API_URL=""
# Allow internal URL monitoring only when explicitly permitted via environment variable
if [[ -n "${ALLOW_INTERNAL:-}" ]]; then
SKIP_VALIDATION=true
echo "Warning: Internal URL validation disabled via ALLOW_INTERNAL environment variable"
else
SKIP_VALIDATION=false
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
JSON_OUTPUT=false
# Vercel API settings (optional)
VERCEL_TOKEN_ENV="${VERCEL_TOKEN:-}" # Capture environment variable before we overwrite it
VERCEL_TOKEN=""
VERCEL_PROJECT_ID="${VERCEL_PROJECT_ID:-}"
VERCEL_TEAM_ID="${VERCEL_TEAM_ID:-}"
The help output states that internal/private URL checks are enabled by default and can be bypassed with ALLOW_INTERNAL=true, but the code above actually sets SKIP_VALIDATION=true whenever ALLOW_INTERNAL is merely non-empty, not specifically 'true'. This is an active documentation contradiction that materially changes the security posture because values like ALLOW_INTERNAL=0 or ALLOW_INTERNAL=no still disable validation.
Returning immediately when SKIP_VALIDATION is true disables all hostname checks, allowing arbitrary targets including localhost and private/internal networks. In a skill that accepts URLs and issues curl requests, this creates an SSRF primitive if an attacker can influence environment variables or wrapper configuration.
local url="$1"
local type="$2"
if [[ "$SKIP_VALIDATION" == "true" ]]; then
return 0
fi
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
fi
}
# Function to save state to file
save_state() {
local state_file="$1"
local state_json="$2"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
last_timestamp=$(echo "$current_state" | jq -r '.lastDeploymentTimestamp // 0')
# Build API query
local api_url="https://api.vercel.com/v6/deployments"
local query_params="limit=1&state=READY"
if [[ -n "$project_id" ]]; then
The script writes deployment state to a user-specified path using echo "$state_json" > "$state_file", which can create or overwrite files. Although the script documents the --state-file option, there is no explicit user-facing warning at the write site or disclosure that existing contents at that path will be replaced.
The script performs multiple curl requests to the homepage, API, and Vercel API endpoints, which transmits request metadata to external services. While network access is central to a watchdog check, the file does not clearly disclose in its usage/help text that running the script will actively contact the provided endpoints and Vercel if a token is supplied.
No suspicious patterns detected.