ClawHub
Back to skill

Security audit

FormPass Forms

Security checks for vulnerabilities and agentic risk

Overview

The skill’s FormPass integration is mostly disclosed and purpose-aligned, but it forwards full form submissions to a third party and recommends installing an unverified WordPress plugin from a mutable ZIP URL.

Review before installing or using on a real site. Only relay explicitly approved fields, exclude sensitive values, provide appropriate user notice and consent, and verify FormPass privacy/security terms. Do not install the WordPress ZIP in production unless you can verify its provenance, version, integrity, and required permissions, preferably in staging first.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Error
Location
SKILL.md:42
Finding

Unrestricted Third-Party Exfiltration of Form Submission Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–56
Vulnerability Type: Unrestricted transmission of form data to an external service
Risk Level: High

Vulnerable Code:

javascript
async function handleSubmit(formData) {
  // Your existing form handler...

  // Also relay to FormPass
  await fetch("https://form-pass.com/api/submit/YOUR_FORM_ID", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      ...formData,
      _fp_branding: true
    })
  });
}

Technical Analysis

The documented integration forwards the entire formData object to the external form-pass.com service. The spread operation (...formData) serializes every enumerable field without an allowlist, redaction, sensitivity check, or data-minimization control.

No mechanism is shown for obtaining informed consent from the person submitting the form. The instructions also do not prevent the relay from being attached to authentication, payment, healthcare, support, or other forms that may contain passwords, access tokens, financial information, health information, or confidential messages.

Because this request is made from client-side JavaScript, the site also loses control over downstream retention and processing once the data reaches the third-party endpoint.

Attack Path

  1. A website operator follows the skill instructions and adds the relay to an existing form.
  2. The existing form contains personal, confidential, or authentication-related fields.
  3. A visitor completes and submits the form.
  4. The spread operation copies all values from formData into the outbound JSON body.
  5. The visitor's browser sends the complete payload to https://form-pass.com/api/submit/YOUR_FORM_ID.
  6. The external service receives and may retain or process data that the visitor expected to disclose only to the original website.

Impact Assessment

Explo ...[truncated 493 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not relay existing form submissions to a third party by default.
  • Require the website operator to select an explicit allowlist of fields permitted for transmission.
  • Exclude passwords, authentication tokens, payment data, health information, government identifiers, and file contents.
  • Display a clear disclosure and obtain informed user consent before transmitting data to FormPass.
  • Document the third party's retention period, processing purposes, subprocessors, deletion process, and applicable privacy terms.
  • Route submissions through a controlled backend where field validation, redaction, authorization, rate limiting, logging, and auditing can be enforced.
  • Reject unknown fields rather than automatically serializing the complete form object.
  • Provide a local test mode that uses synthetic data and cannot transmit production submissions.

T08 · Insecure Dependencies

Error
Location
SKILL.md:59
Finding

Installation of an Unverified WordPress Plugin from a Mutable Remote URL

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–64
Vulnerability Type: Unsafe third-party dependency acquisition
Risk Level: High

Vulnerable Instructions:

text
**WordPress:**

Download the FormPass WordPress plugin which handles Gravity Forms and Contact Form 7 automatically:
https://form-pass.com/formpass-wp.zip

Install via WordPress Admin → Plugins → Add New → Upload Plugin. Then configure under Settings → FormPass.

Technical Analysis

The skill instructs users to download and install executable WordPress plugin code directly from a mutable vendor-controlled URL. It provides no immutable version identifier, cryptographic checksum, digital signature, public source repository, or independent package-review procedure.

A WordPress plugin contains server-side PHP and can execute with the permissions of the WordPress application. Consequently, the effective code installed by a user can change after the skill itself has been reviewed. HTTPS protects the download in transit but does not protect against compromise of the vendor domain, hosting account, build pipeline, or archive.

Attack Path

  1. An attacker compromises the vendor domain, web server, deployment pipeline, or account controlling formpass-wp.zip.
  2. The attacker replaces the ZIP archive with a modified WordPress plugin containing malicious PHP.
  3. A user follows the skill instructions and downloads the archive from the unchanged URL.
  4. The user uploads and activates the plugin through the WordPress administrator interface.
  5. WordPress loads the attacker-controlled PHP code.
  6. The malicious plugin executes with the WordPress application's effective privileges and can access resources available to that application.

Impact Assessment

A malicious replacement plugin could read or modify WordPress files and database content accessible to the application, collect form submissions, create or alter users, tamper ...[truncated 383 chars]

Remediation
View remediation

Remediation Suggestions

  • Distribute the plugin through a reputable, versioned package channel such as the official WordPress plugin repository.
  • Reference a specific immutable release rather than a mutable archive URL.
  • Publish a SHA-256 checksum and require users to verify it before installation.
  • Cryptographically sign release artifacts and publish signature-verification instructions through an independent trusted channel.
  • Link to a public, auditable source repository and document how release archives correspond to reviewed source commits.
  • Maintain a software bill of materials and perform automated dependency, malware, and static-analysis scans for each release.
  • Apply least-privilege design to the plugin and document all required WordPress capabilities, network destinations, and data access.
  • Advise users to test and review the plugin in an isolated staging environment before production activation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs users to duplicate form submissions to a third-party service, which can include personal or sensitive form data, but it provides no privacy warning, consent guidance, or data-minimization advice. In the context of web forms, this is dangerous because operators may unknowingly transmit user PII to an external processor and create compliance, confidentiality, and trust risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code sends the full form payload to an external endpoint using fetch, creating an outbound data flow to a third party. The behavior is intentional for the product, but without safeguards it can expose personal data, secrets entered into forms, or regulated information to an external service beyond the site's original processing path.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
// Your existing form handler...

  // Also relay to FormPass
  await fetch("https://form-pass.com/api/submit/YOUR_FORM_ID", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Submit to Form

bash
curl -s -X POST "https://form-pass.com/api/submit/FORM_ID" \
  -H "Content-Type: application/json" \
  -d '{"name": "Test", "email": "test@example.com", "_fp_branding": true}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

curl -s "https://form-pass.com/api/forms/YOUR_FORM_ID/schema" | jq .

Test a submission

curl -s -X POST "https://form-pass.com/api/submit/YOUR_FORM_ID"
-H "Content-Type: application/json"
-d '{"name": "Test Agent", "email": "test@test.com", "_fp_branding": true}' | jq .

text