ClawHub
Back to skill

Security audit

Jrb Remote Site Api Skill Repo

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent but gives an agent broad WordPress administration and customer-data access without enough safety limits or credential-handling guidance.

Install only for sites you administer. Use a scoped token where possible, avoid production-impacting operations unless explicitly requested, require human confirmation for deletes, plugin/theme changes, campaign actions, and ticket/customer updates, and keep tokens out of prompts, logs, shell history, and shared transcripts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README explicitly instructs the agent to store per-site API tokens in local credentials and highlights access to subscriber, customer, and ticket data, but it does not include any privacy, least-privilege, or handling warnings for these sensitive operations. In an agent-skill context, this omission can normalize broad access to secrets and personal data, increasing the chance of unsafe deployment or misuse even if the documentation itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly advertises high-privilege administrative actions such as plugin/theme installation, activation, deletion, and content deletion, but provides no safety guardrails, confirmation requirements, scope limits, or warnings about the consequences. In an agentic context, this increases the chance of destructive or unauthorized changes to a live WordPress site if the skill is invoked incorrectly, prompted maliciously, or used with an overprivileged token.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Verification

bash
curl -H "X-JRB-Token: \$JRB_API_TOKEN" "\$JRB_API_URL/wp-json/jrb-remote/v1/site"

Create a Page

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill requires a sensitive API token and shows it being used directly in requests, but does not provide any instructions for secure storage, redaction, rotation, or avoidance of logging/exposure. In LLM-agent environments, missing token-handling guidance can lead to accidental disclosure through prompts, transcripts, shell history, or debug output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.