ClawHub
Back to skill

Security audit

Baserow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Baserow CLI helper with disclosed database access and destructive commands called out for confirmation.

Install only from a trusted Python package source, consider pinning a reviewed baserow-cli version, and use a least-privilege Baserow token. Confirm delete and batch-delete requests carefully because those operations can permanently change database records.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party CLI Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-21
Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

Vulnerable Code

bash
uv tool install baserow-cli   # or: pip install baserow-cli
baserow config init            # interactive setup wizard

Technical Analysis

The documented installation commands retrieve and install the current baserow-cli release from the configured Python package index without specifying an exact version, validating package hashes, using a locked dependency set, or verifying release provenance.

Because the resolved package and its transitive dependencies can change after the Skill has been reviewed, the commands create a mutable code-execution boundary. A compromised package maintainer account, malicious future release, dependency compromise, or package-index attack could cause an agent following these instructions to install and execute attacker-controlled code.

The subsequent configuration and use of the CLI may expose the installed process to BASEROW_TOKEN, BASEROW_URL, and Baserow data accessible to the user.

Attack Path

  1. An attacker compromises baserow-cli, one of its dependencies, a maintainer account, or the configured package index.
  2. The attacker publishes or serves a malicious release.
  3. A user or agent follows the unpinned uv tool install baserow-cli or pip install baserow-cli instruction.
  4. The package manager resolves the attacker-controlled release because no reviewed version or package hash is required.
  5. Malicious code executes during installation, initialization, or later CLI invocation with the permissions of the invoking user.
  6. The code may read accessible environment variables or configuration, including Baserow credentials, and use those credentials against the configured Baserow service.

Impact Assessment

Successful exploitation could provide code execution with the invoking user's privileges. The resulting sco ...[truncated 392 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin baserow-cli to an exact, reviewed version rather than resolving the latest available release.
  • Install from a lock file or requirements file containing cryptographic hashes for the package and all transitive dependencies.
  • Document and enforce a trusted package index instead of inheriting an arbitrary local index configuration.
  • Verify package provenance, release signatures, and the canonical upstream source before approving upgrades.
  • Review new versions and dependency changes before updating the pin.
  • Run the CLI in a least-privilege environment with access only to the Baserow credentials and local resources required for the requested task.
  • Scope the Baserow token to the minimum necessary permissions and rotate it if package compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.