ClawHub
Back to skill

Security audit

Http Sec Audit

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its URL checker can make unrestricted network requests from the runner and should be reviewed before use.

Install only if you are comfortable with the skill making outbound requests from your environment. Use it on public websites you intend to audit, avoid internal or sensitive URLs, and prefer running it in a network-restricted environment until URL validation, redirect validation, response streaming, and pinned dependencies are added.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sec_headers.py:140
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery and Resource Exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/sec_headers.py, lines 140 and 265–268
Vulnerability Type: Server-Side Request Forgery and uncontrolled response buffering
Risk Level: High

Vulnerable Code

python
resp = requests.get(url, headers=headers, timeout=timeout, allow_redirects=True)

The untrusted URL reaches this request through the following code:

python
results = []
for url in args.urls:
    if not url.startswith(("http://", "https://")):
        url = "https://" + url
    results.append(audit_url(url, args.timeout))

Technical Analysis

The command-line URL is passed directly to requests.get() without validating the destination host or its resolved IP addresses. The scheme check only verifies that the URL begins with HTTP or HTTPS; it does not prevent access to loopback, private, link-local, reserved, multicast, or otherwise internal addresses.

Automatic redirects are enabled with allow_redirects=True. Even if validation of the initial URL were added, an attacker-controlled public endpoint could redirect the request to an internal destination unless every redirect target is independently resolved and validated. DNS rebinding may similarly cause a previously acceptable hostname to resolve to a prohibited address when the connection is made.

The request is also made without stream=True. The Requests library therefore downloads and buffers the response body before returning, even though the application only uses the response status and headers. A remote server can return a very large or continuously generated body to consume process memory. The timeout is not a total download deadline and does not by itself establish a maximum response size.

Attack Path

  1. An attacker supplies a URL targeting a loopback address, private network host, cloud metadata service, or another service reachable from the machine running the Skill.
  2. The scheme check accepts the HTTP or HTTPS URL and passes it to audit_url(). ...[truncated 1449 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse URLs with a standards-compliant parser and permit only explicitly required schemes, normally HTTPS.
  2. Reject URLs containing embedded credentials or ambiguous host syntax.
  3. Resolve the hostname before connecting and reject all loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 addresses.
  4. Protect against DNS rebinding by ensuring the validated address is the address actually used for the connection.
  5. Disable automatic redirects and process redirects manually. Resolve and validate every redirect destination before following it, and enforce a low redirect limit.
  6. Prefer an explicit hostname or network allowlist where the deployment permits one.
  7. Use a streaming request and close it without consuming the body:
python
with requests.get(
    url,
    headers=headers,
    timeout=(3, timeout),
    allow_redirects=False,
    stream=True,
) as resp:
    result["status"] = resp.status_code
    resp_headers = {k.lower(): v for k, v in resp.headers.items()}
  1. Enforce connection and read timeouts, a total operation deadline, and limits on response headers and redirects.
  2. Run the Skill in a network sandbox that cannot reach cloud metadata endpoints, loopback services, management networks, or unrelated internal systems.

T08 · Insecure Dependencies

Note
Location
SKILL.md:61
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–65
Vulnerability Type: Unconstrained third-party package installation
Risk Level: Low

Vulnerable Code

markdown
## Dependencies

```bash
pip install requests
text

### Technical Analysis

The installation instructions retrieve an unconstrained version of `requests` from whichever Python package index is active in the user's environment. The project does not provide a version lock, integrity hash, or trusted-index requirement.

The documented package name is legitimate, and the audited project does not contain evidence that it intentionally directs users to a malicious package or repository. Nevertheless, installation is not reproducible and relies entirely on the integrity of the configured package index and the latest dependency release available at installation time.

If pip is configured to use an attacker-controlled or compromised index, or if an upstream release is compromised, following the documented command could install unreviewed code. A future incompatible release could also change runtime behavior or introduce vulnerabilities.

### Attack Path

1. A user follows the dependency installation command from `SKILL.md`.
2. Pip queries the package index configured in the user's environment.
3. A compromised index, proxy, account, or upstream release serves an unreviewed package artifact.
4. Pip installs the artifact without checking it against a project-maintained version and hash.
5. Package installation or later import executes the installed dependency with the privileges of the user running the Skill.

This path requires compromise or malicious configuration of the package supply chain; no malicious dependency source is embedded in the audited project itself.

### Impact Assessment

A successfully substituted dependency could execute code with the privileges of the user installing or running the Skill. Depending on those privileges, this could expose local files, environ
...[truncated 333 chars]
Remediation
View remediation

Remediation Suggestions

  1. Define a reviewed dependency version in a requirements file rather than installing an unconstrained latest release.
  2. Generate and verify cryptographic hashes for the package and its transitive dependencies, then install with --require-hashes.
  3. Use a lock-file workflow or dependency-management tool that produces deterministic environments.
  4. Explicitly document the trusted package index and prevent fallback to untrusted extra indexes.
  5. Install dependencies inside a dedicated virtual environment with least privilege.
  6. Regularly review and update pinned versions so that pinning does not prevent security patches.
  7. Add automated dependency vulnerability and integrity scanning to the release process.

An example installation approach is:

bash
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly instructs execution of a Python script that performs outbound HTTP requests, yet the manifest declares no explicit tool scope or permissions. This creates a governance gap where network-capable behavior is not transparently declared, increasing the risk of unintended SSRF-style access, scanning of internal resources, or policy bypass in environments that rely on manifest-level restrictions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.