ClawHub
Back to skill

Security audit

powerdrill-data-analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Powerdrill data analysis, but it can upload arbitrary local files to an external service and delete remote datasets or sessions without strong built-in confirmation safeguards.

Review carefully before installing. Use it only for data you are allowed to send to Powerdrill, keep credentials scoped to a limited project, and require explicit user confirmation before any file upload, dataset deletion, session deletion, or cleanup that includes a dataset ID.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:23-25
  • README.md:33-39

Vulnerability Type: Mutable, unverified dependency installation
Risk Level: Medium

Complete Code Snippets:

SKILL.md:23-25

bash
The only Python dependency is `requests`. Install with: `pip install requests`

README.md:33-39

markdown
### 3. Install Dependency

```bash
pip install requests
text

### Technical Analysis

The installation instructions retrieve the latest version of `requests` resolved by the configured Python package index. The project does not provide a pinned version, lockfile, integrity hashes, or instructions to require hash verification.

Consequently, the installed code can differ from the code reviewed during this audit. Although `requests` is a legitimate and widely used dependency, an unpinned installation creates supply-chain exposure if a future release, package-index account, configured mirror, or dependency in the resolved dependency graph is compromised. It can also introduce unexpected compatibility or security changes without any modification to this Skill.

No evidence was found that the project intentionally installs a malicious package. The risk arises from mutable and unverified dependency resolution.

### Attack Path

1. An attacker compromises a future dependency release, a package-publishing account, a configured package mirror, or another component in the dependency resolution chain.
2. A user follows the documented `pip install requests` instruction after the compromised version becomes the version selected by pip.
3. Pip downloads and installs the mutable, unverified package version.
4. Malicious package installation behavior or imported runtime code executes in the user's Python environment.
5. The malicious code operates with the privileges of the user running pip or invoking the Powerdrill client.

### Impact Assessment

Successful exploitation could ex
...[truncated 511 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin requests and its transitive dependencies to reviewed versions in a requirements lockfile.
  2. Record cryptographic hashes for every distributed artifact and require their verification:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Generate and review the lockfile using a dependency-management tool such as pip-tools.
  4. Automate vulnerability and dependency-update monitoring while requiring review before accepting upgrades.
  5. Recommend installation in a dedicated virtual environment rather than a privileged or system-wide Python environment.
  6. Keep SKILL.md and README.md consistent by replacing both unpinned installation commands with the same locked, hash-verified procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md
| `create_dataset()` | `POST /v2/team/datasets` | Create a new dataset |
| `get_dataset_overview()` | `GET /v2/team/datasets/{id}/overview` | Get dataset summary and suggested questions |
| `get_dataset_status()` | `GET /v2/team/datasets/{id}/status` | Check data source sync status |
| `delete_dataset()` | `DELETE /v2/team/datasets/{id}` | Delete a dataset |
| `list_data_sources()` | `GET /v2/team/datasets/{id}/datasources` | List files in a dataset |
| `create_data_source()` | `POST /v2/team/datasets/{id}/datasources` | Add a data source (URL or uploaded file) |
| `upload_local_file()` | `POST /v2/team/file/init-multipart-upload` | Upload a local file via multipart upload |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 105)May include surrounding context.

md
| `wait_for_dataset_sync()` | `GET /v2/team/datasets/{id}/status` | Poll until all sources are synced |
| `list_sessions()` | `GET /v2/team/sessions` | List analysis sessions |
| `create_session()` | `POST /v2/team/sessions` | Create a new session |
| `delete_session()` | `DELETE /v2/team/sessions/{id}` | Delete a session |
| `create_job()` | `POST /v2/team/jobs` | Run a natural-language analysis query |
| `cleanup()` | (composite) | Delete session and dataset |

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill supports uploading local files and sending dataset contents to an external service, but it does not prominently warn users at the entry point that their local data will be transmitted off-system. This creates a meaningful risk of privacy, confidentiality, and compliance violations if users invoke the skill without informed consent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/powerdrill_client.py (reported line 119)May include surrounding context.

python
def delete_dataset(dataset_id: str) -> dict:
    """DELETE /v2/team/datasets/{id} - Delete a dataset."""
    user_id, api_key = _get_env()
    resp = _session.delete(
        f"{BASE_URL}/v2/team/datasets/{dataset_id}",

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/powerdrill_client.py (reported line 342)May include surrounding context.

python
def delete_session(session_id: str) -> dict:
    """DELETE /v2/team/sessions/{id} - Delete a session."""
    user_id, api_key = _get_env()
    resp = _session.delete(
        f"{BASE_URL}/v2/team/sessions/{session_id}",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly encourages uploading local files and sending natural-language questions to an external Powerdrill service, but it does not warn users that file contents and query text leave the local environment and may contain sensitive data. In an AI-agent skill context, this omission is security-relevant because users may assume analysis is local and unknowingly expose proprietary, personal, or regulated information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation instructs users to call cleanup and documents delete operations, but it does not clearly warn that datasets and sessions may be permanently removed. In an agentic workflow, automatic cleanup can delete resources the user expected to retain, causing data loss or destruction of analysis history.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs use of environment variables, local file upload, and external API/network access, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance of the skill being invoked with broader-than-necessary capabilities and reduces reviewability of what data and actions the skill is allowed to access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is very broad, covering nearly any request to analyze, query, upload, visualize, continue analysis, or explore data mentioning Powerdrill. Overly broad activation can cause unintended invocation on ambiguous user requests, increasing the chance of accidental external data transmission or destructive actions like deletion in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The cleanup guidance says to always call cleanup(), which deletes sessions and datasets, but it does not consistently require a user-facing confirmation or emphasize the destructive consequences at the point of instruction. In practice, this can lead to accidental irreversible deletion of user data or analysis context, especially when cleanup is presented as routine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The client exposes direct dataset deletion as a single function/CLI action with no confirmation, dry-run, or safeguard. In an agent skill focused on data analysis, accidental or prompt-induced invocation could irreversibly delete user datasets and disrupt ongoing work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The upload_local_file workflow reads an arbitrary local path and uploads its contents to presigned external upload URLs, but the client code provides no explicit warning, confirmation, or restriction before exfiltrating local data. In an agent/tooling context, this is dangerous because a user prompt or higher-level workflow could cause sensitive local files to be transmitted off-host without the user realizing the transfer destination or sensitivity of the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The cleanup helper and CLI command can delete both sessions and datasets based solely on supplied identifiers, with no confirmation or scope limitation. In an agent workflow, cleanup routines are especially risky because they may be triggered automatically, causing silent destructive side effects beyond the user's intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

Session deletion is also exposed without confirmation, which can destroy analysis context and history unexpectedly. While less severe than dataset deletion because it typically affects workflow state rather than underlying data, it still enables unintended destructive actions in an automated agent setting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.