ClawHub
Back to skill

Security audit

Huckleberry

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it asks users to install an unofficial unpinned CLI and may handle sensitive Huckleberry account credentials without enough security guidance.

Review this carefully before installing. Prefer interactive login or a credential manager over exported passwords, avoid putting Huckleberry credentials in shell startup files or shared scripts, install the CLI in an isolated environment such as pipx or a virtualenv, and consider pinning a reviewed package version. Do not run the install or CLI with administrator privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding
Unpinned Installation of an Unverified Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–18 **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install ```bash pip install huckleberry-cli ``` ``` ### Technical Analysis The skill instructs users to install `huckleberry-cli` directly from the package index without specifying a reviewed version, validating a cryptographic hash, or identifying a verified source repository. The document also explicitly describes the tool as unofficial. Consequently, the installed artifact can change after the skill itself has been reviewed. Package maintainers, compromised publisher accounts, or compromised supply-chain infrastructure could distribute malicious package code under the expected package name. Depending on the package format and installation environment, package-controlled code may run during build or installation; otherwise, it will run when the installed CLI is invoked. This is a supply-chain weakness rather than evidence that the currently published package is malicious. ### Attack Path 1. An attacker compromises the package publisher, distribution account, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the `huckleberry-cli` package name. 3. A user follows the skill instruction and runs `pip install huckleberry-cli`. 4. Because no version or hash is pinned, `pip` retrieves the attacker-controlled release. 5. Malicious code executes during package build/installation or when the user subsequently invokes the CLI. 6. The code operates with the privileges of the user running `pip` or the CLI and may access data available to that account. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the installing user's privileges. The affected scope may include files readable or writable by that user, environment variables, Huckleberry authentication material, and sensiti ...[truncated 290 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash python -m pip install "huckleberry-cli==<reviewed-version>" ``` 2. Publish and verify cryptographic hashes using a locked requirements file and `pip --require-hashes`. 3. Link to the verified source repository and clearly document package ownership and provenance. 4. Review the pinned release, including its build configuration, transitive dependencies, and installation hooks. 5. Install the CLI in an isolated virtual environment or through `pipx` rather than into the system Python environment. 6. Avoid running installation or CLI commands with administrator or root privileges. 7. Use automated dependency monitoring and repeat the security review before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly recommends placing Huckleberry email and password in plaintext environment variables, but gives no warning about the security tradeoffs. Environment variables can be exposed through shell history, process inspection, crash reports, CI logs, and inherited subprocess environments, which is especially concerning because these credentials protect a child-tracking account containing sensitive family data.

Static analysis

No suspicious patterns detected.