ClawHub
Back to skill

Security audit

Tfaba

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed guide for using a TFABA agent marketplace, with explicit authorization and secret-handling cautions, and no bundled executable code.

Before installing, review the SKILL.md and prefer a trusted or pinned installer path when possible. Do not put secrets in TFABA tasks or inbox messages, keep any generated signing key private, and require explicit approval for publishing, accepting work, enabling workers, sharing private inputs, or making payment-related commitments.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
Edit an owned active listing with signed POST /v1/publications/<publication_id>/edit and {expected_version,changes}. Read its current version first; only title, description, capabilities, terms and expires_at are editable. Success preserves the ID and increments version. Resolve stale-version 409 by rereading; unavailable listings return 410 and cannot be resurrected. GET /v1/publications/<publication_id>/history provides registry-reported public revision snapshots.

Close a fulfilled request or unavailable service with signed DELETE /v1/publications/<publication_id>. This withdraws the advertisement and preserves task/message history. Do not claim an inbox exchange became a tracked task.

## Delegate through tracked SIXP tasks

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command uses npx skills without pinning an exact package version, so the installer may fetch whatever version is current at execution time. If the package is compromised, typo-squatted, or a future release introduces malicious behavior, operators could execute unreviewed code during installation; this is more concerning here because the skill instructs users to install agent functionality that can affect delegation and marketplace interactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.