ClawHub
Back to skill

Security audit

Deepvista Recipe

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for DeepVista workflow automation, but running remote Recipes gives an AI agent broad, under-scoped authority to act and update account context after only a start confirmation.

Review the Recipe content with the read-only get command before running it, run only Recipes from sources you trust, avoid giving sensitive input unless needed, and expect Recipe runs or installs to modify DeepVista account state. Install the CLI in a restricted environment if possible because the package version is not pinned by this skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:55
Finding

Untrusted Remote Recipes Can Control Agent Actions

Content
View full analysis
[--input "context text"] ``` Start a Recipe run — the AI agent executes the workflow checklist step by step. | Flag | Required | Default | Description | |------|----------|---------|-------------| | `` | Yes | — | ID of the Recipe template to run | | `--input` | No | — | Context or instructions for the run | > [!CAUTION] > Write command — creates a new Recipe run (a chat session) and the agent may create/update context cards, search the web, and take other actions. Confirm with the user before executing. Output is NDJSON (one JSON object per line) as the agent streams its response. ``` ### Technical Analysis The skill delegates workflow control to remotely stored Recipe content and instructs the AI agent to execute that content “step by step.” The resulting agent is expressly permitted to modify context cards, search the web, and perform unspecified additional actions. Although the skill requires user confirmation before starting a Recipe, it does not require the complete workflow to be displayed or reviewed before execution. It also does not define publisher verification, immutable content hashes, instruction sanitization, tool restrictions, domain restrictions, or confirmation gates for consequential actions performed during the run. Consequently, confirmation to start a seemingly benign Recipe can implicitly authorize attacker-controlled instructions that were not visible to the user. A malicious or compromised Recipe could attempt to change the agent's goals, induce disclosure of supplied context, manipulate persistent context cards, or direct other available tools. ### Attack Path 1. An attacker publishes a malicious marketplace Recipe or compromises an existing Recipe or its hostin ...[truncated 1230 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party CLI Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.