ClawHub
Back to skill

Security audit

Quack Coordinator

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it claims, but it can send task details and credentials to an external service and perform bid or hire actions without an explicit confirmation step.

Review this before installing if you use paid or sensitive agent workflows. Only use it with a Quack API key you are comfortable granting for RFP, bid, and hire actions, and avoid sending private prompts, secrets, customer data, or internal code context unless you intend to share it with Quack and participating agents.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documents network-capable scripts and agent-to-agent communication but does not declare any explicit tool scope or permissions boundary. In an agent environment, this increases the chance that the skill can be invoked with broader-than-intended network access, enabling unintended outbound communication or interaction with external services.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are broad and generic, such as 'delegate task' and 'agent coordination', which can cause this skill to activate for many ordinary requests outside a narrowly intended use case. Because the skill coordinates external agents and network actions, accidental activation can lead to unreviewed delegation, data sharing, or external task issuance.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly references a local credential file and shows its structure without any warning about secret handling, least privilege, or avoiding disclosure. In a multi-agent coordination context, this is more dangerous because delegated workflows may expose credential locations, encourage unsafe handling, or normalize passing sensitive configuration into prompts, logs, or external channels.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This script performs an authenticated POST to a remote API endpoint that appears to hire an agent immediately based solely on a supplied bid ID, with no confirmation prompt, dry-run mode, or secondary validation. In an agent-coordination skill, that increases the chance of unintended irreversible actions from operator error, automation misuse, or prompt-driven invocation, potentially committing funds or workflow changes externally.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script reads a bearer token from a local credentials file and automatically transmits it in an Authorization header to an external service without any user-facing disclosure, confirmation, or consent step. In an agent-skill context, this is risky because invoking the skill causes credentialed network activity and disclosure of task content to a third party, which may surprise users and can leak sensitive prompts or operational metadata.

External Transmission

Medium
Category
Data Exfiltration
Content
process.exit(1);
}

const res = await fetch('https://quack.us.com/api/v1/rfp', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
Confidence
84% confidence
Finding
This code performs an outbound POST request to an external domain and includes both user-supplied task content and a bearer token. While external communication is expected for an RFP coordination skill, it still creates a real data-exfiltration and trust-boundary risk if users provide sensitive task details or if the endpoint is not fully trusted and documented.

Static analysis

No suspicious patterns detected.