T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:24- Finding
Credential file is created without restrictive permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Gotify
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says: it sends user-requested Gotify notifications, with some credential-handling hardening users should be aware of.
Install only if you trust the Gotify server you configure. Store the config file with owner-only permissions, prefer HTTPS URLs, avoid sending secrets in notification text, and rotate the Gotify application token if it may have been exposed through logs, process inspection, or plaintext HTTP.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send.sh:69- Finding
Gotify token is exposed through the curl command line and URL query string
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send.sh:12- Finding
Unvalidated server URL permits plaintext transmission of credentials and notification data
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 ;; esac ``` Further hardening should include: - Permit plaintext HTTP only through an explicit opt-in intended for loopback development endpoints. - If an exception is supported, restrict it to validated loopback hosts such as `127.0.0.1`, `[::1]`, or `localhost`. - Retain curl's default TLS certificate verification and do not introduce insecure options such as `--insecure`. - Document HTTPS as mandatory for remote servers. - Rotate the application token if it has previously been sent through an unencrypted connection. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Setup ### 1. Create an Application Token 1. Open your Gotify web UI 2. Go to **Apps** tab
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to invoke shell commands (
bash scripts/send.sh ...) but does not declare any explicit tool scope such aspermissionsorallowed-tools. That creates an authorization gap where a host system may permit broader shell execution than users expect, increasing the chance of unintended command execution when the skill is triggered.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description includes broad trigger phrases like 'notify me when this finishes' and 'push notification', which overlap with normal conversational requests. This can cause the skill to activate in situations the user did not specifically intend, leading to unexpected shell execution and transmission of task details to an external Gotify server.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Setup
Create the credentials file:
~/.clawdbot/credentials/gotify/config.jsonjson {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow guidance tells the agent to automatically append
&& bash scripts/send.sh "Task complete"when a user says 'Notify me when this finishes'. That is an ambiguous activation rule that can silently modify user commands and initiate external network communication without a clearly bounded consent step.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # Send notification curl -sS -X POST "$GOTIFY_URL/message?token=$GOTIFY_TOKEN" \ -H "Content-Type: application/json" \ -d "$PAYLOAD"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The README states that the skill sends push notifications via Gotify, which means message content is transmitted over the network to an external service. While this is part of the skill's purpose, the documentation does not explicitly warn users that any notification text they provide will be sent to the configured Gotify server and may appear on linked devices.
- Content
Static analysis
No suspicious patterns detected.