ClawHub
Back to skill

Security audit

Idle Web Developer

Security checks for vulnerabilities and agentic risk

Overview

This is a real website builder and deployer, but it handles deployment secrets and public tracking behavior in ways users should review carefully before installing.

Install only if you are comfortable giving it a Vercel token and allowing it to deploy public sites. Use a narrowly scoped, revocable token; avoid providing Google service-account credential paths; review generated pages for privacy claims before publishing; and treat the local .skill-config file as sensitive.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/build-and-deploy.sh:54
Finding

Executable Configuration Injection Through Sourced User Input

Content
View full analysis
"$CONFIG_FILE" <
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/build-and-deploy.sh:108
Finding

Credentials Stored in Plaintext and Vercel Token Exposed Through Process Arguments

Content
View full analysis
"$CONFIG_FILE" <
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/build-and-deploy.sh:218
Finding

Unescaped Values Injected Into Generated HTML and JavaScript

Content
View full analysis
document.getElementById('waitlist-form').addEventListener('submit', async function(e) { e.preventDefault(); var email = document.getElementById('waitlist-email').value; var btn = document.getElementById('waitlist-btn'); var msg = document.getElementById('waitlist-msg'); btn.disabled = true; btn.textContent = 'Joining...'; try { var res = await fetch('${SUPABASE_URL}/rest/v1/waitlist', { method: 'POST', headers: { 'Content-Type': 'application/json', 'apikey': '${SUPABASE_ANON_KEY}', 'Authorization': 'Bearer ${SUPABASE_ANON_KEY}', 'Prefer': 'return=minimal' }, body: JSON.stringify({ email: email }) }); ``` The static HTML template also directly interpolates command-line values: ```html ${NAME} ``` ```html

${NAME}

${IDEA:-A polished product built for the people who need it most.}

``` The generated Next.js component similarly derives client-visible values directly from generated environment configuration: ```typescript const SUPABASE_URL = process.env.NEXT_PUBLIC_SUPABASE_URL ?? ''; const SUPABASE_ANON_KEY = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? ''; const SUPABASE_ENABLED = !!(SUPABASE_URL && SUPABASE_ANON_KEY); ``` ```typescript const res = await fetch(`${SUPABASE_URL}/rest/v1/waitlist`, { method: 'POST', headers: { 'Content-Type': 'application/json', apikey: SUPABASE_ANON_KEY, Authorization: `Bearer ${SUPABASE_ANON_KEY}`, Prefer: 'return=minimal', }, body: JSON.stringify({ email }), }); ``` ### Technical Analysis The script constructs HTML and Ja ...[truncated 1922 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/build-and-deploy.sh:423
Finding

Mutable Remote Package Downloaded and Executed With npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description frames the skill as an idle website builder, but the body also collects and persists deployment tokens, optional Google credential paths, and publishes deployed artifacts containing baked configuration values. This mismatch undermines informed consent and can cause users to authorize credential handling and public deployment they did not reasonably expect.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The skill requests a path under a common Google Cloud credential location, which can steer users toward exposing privileged credential material unrelated to simple site deployment. Even though only a path is requested, the workflow institutionalizes credential discovery and persistence in a context that does not clearly justify it.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
- If **yes** → ask:

> "What is your Google Application Credentials JSON file path?  
> (e.g. /home/you/.config/gcloud/service-account.json)"

Save as `GOOGLE_APPLICATION_CREDENTIALS`.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The page explicitly claims 'No tracking' while analytics code may be injected and activated. This is a stronger variant of the disclosure issue because it is an affirmative false statement about data practices, increasing regulatory, contractual, and reputational risk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/build-and-deploy.sh (reported line 497)May include surrounding context.

sh
}
WAITLISTtsx

  # Write .env.local for Next.js
  cat > "${TARGET_DIR}/.env.local" <<ENVLOCAL
NEXT_PUBLIC_SUPABASE_URL=${SUPABASE_URL}
NEXT_PUBLIC_SUPABASE_ANON_KEY=${SUPABASE_ANON_KEY}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/build-and-deploy.sh (reported line 498)May include surrounding context.

sh
WAITLISTtsx

  # Write .env.local for Next.js
  cat > "${TARGET_DIR}/.env.local" <<ENVLOCAL
NEXT_PUBLIC_SUPABASE_URL=${SUPABASE_URL}
NEXT_PUBLIC_SUPABASE_ANON_KEY=${SUPABASE_ANON_KEY}
ENVLOCAL

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill performs sensitive operations requiring environment access and network/deployment capabilities, but it does not declare an explicit tool scope such as allowed-tools or permissions. That increases the chance of overbroad execution in environments that rely on manifest scoping, making secret access and internet actions less visible to users and policy enforcement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The skill instructs the agent to persist collected tokens and integration values into a dotfile for reuse across sessions. Persistent storage of secrets increases the blast radius of local compromise and creates long-lived credential exposure beyond the immediate deployment action.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
### Onboarding Wizard

Ask the user each question in order. Collect the answers, then write them all to `.skill-config` at the end. Present each question clearly — one at a time, conversationally.

---

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The onboarding flow asks for a Google Application Credentials JSON path and persists it in a reusable config for a workflow that only injects client-side GA tags. Requesting service-account credential material for this purpose is unnecessary and normalizes collection of higher-sensitivity cloud credentials than the task requires.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The broad trigger phrase for re-running setup can cause the skill to activate and ask for secrets in normal conversation without strong user intent verification. In a system that supports conversational routing, that increases the risk of surprise credential collection and unintended workflow execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill sources a persistent shell config from the user's home directory that contains secrets, causing those values to enter the shell environment for subsequent commands. This broadens exposure to accidental leakage through logs, child processes, command history, or other tools invoked later in the workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The deployment instructions explicitly export Supabase and analytics values and build them into static client assets before public deployment, yet the skill lacks a clear warning that these values will be embedded into the published bundle. Users may incorrectly assume configuration remains server-side, leading to accidental publication of values they consider secret.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The scaffolded waitlist form collects email addresses and sends them to Supabase without any privacy notice, retention disclosure, or user consent language in the generated page. Collecting personal data without disclosure creates privacy and compliance risk and can mislead end users about how their data will be used.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The generated site states 'No tracking' and 'Your data stays yours' while the script conditionally injects Google Analytics when configured. This is a deceptive privacy representation that can lead to undisclosed data collection and legal/compliance exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The script executes npx create-next-app@latest, which pulls and runs the newest package version at build time without a pinned, reviewed release. This creates a supply-chain risk: a compromised upstream package or breaking change could execute arbitrary code on the operator's machine during scaffolding.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest promises autonomous website building and deployment, but this branch instructs the agent to query gh issue list against the OpenClaw repository. Accessing GitHub issue data is a separate external capability not clearly justified as necessary for building and deploying websites, especially since it may depend on broader GitHub CLI authentication/context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The setup wizard asks for 'Google Application Credentials JSON path' and stores GOOGLE_APPLICATION_CREDENTIALS, but the only analytics behavior in this file is injecting a public gtag.js snippet using the GA measurement ID. Reading and persisting service-account credential configuration is not justified by the code's stated website scaffold/deploy behavior here.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/build-and-deploy.sh:431

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/build-and-deploy.sh:448

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:96