ClawHub
Back to skill

Security audit

PrivateBin Upload Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent PrivateBin upload purpose, but it can send user content to an external share link too easily and gives unsafe shell-command examples.

Only install this if you are comfortable with an agent uploading selected content to a PrivateBin server and producing a link that can grant access. Before use, require explicit confirmation of the target instance and sharing settings, avoid uploading secrets or proprietary files, prefer a trusted self-hosted instance, pin reviewed dependency versions, and ensure the agent invokes the CLI without shell interpolation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
package.json:20
Finding

Unpinned Third-Party Installation and Dependency Versions

Content
View full analysis

Vulnerability Details

File Location: README.md:14-18; package.json:20-22
Vulnerability Type: Supply-chain exposure through mutable third-party dependencies
Risk Level: Medium

Complete Code Snippets:

README.md:14-18

bash
## Install Skill

npx skills add KafCoppelia/privatebin-upload-skill

package.json:20-22

json
"dependencies": {
  "privatebin-cli": ">=1.0.0"
},

Technical Analysis

The documented npx skills add command retrieves and processes a remotely maintained project without pinning an immutable commit or verified artifact. In addition, the privatebin-cli dependency accepts every version from 1.0.0 onward. Consequently, the code installed in the future can differ from the code reviewed during this audit.

This does not establish that either current upstream project is malicious. The risk is that a compromised maintainer account, repository, registry package, or later release could introduce malicious installation behavior. Depending on the package manager and installation workflow, lifecycle scripts or equivalent setup logic may execute during installation.

The external badge links in README.md:9-10 do not themselves download or execute an executable. The prebuilt-download link at README.md:34 points to the declared CLI project's GitHub releases rather than a pastebin or an opaque direct executable. The substantive concern is the absence of version and integrity pinning, not evidence of a currently malicious payload.

Attack Path

  1. An attacker compromises the relevant repository, package registry entry, maintainer account, or a future accepted dependency release.
  2. The attacker publishes malicious code under a version accepted by >=1.0.0, or changes the repository state resolved by the unpinned installation command.
  3. A user follows the documented installation instructions.
  4. The package manager or skill installer retrieves the chang ...[truncated 627 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the dependency range with an exact, reviewed version, for example "privatebin-cli": "1.0.0".
  2. Commit a lockfile containing integrity hashes where the relevant package manager supports them.
  3. Pin skill installation to a reviewed immutable commit or signed release rather than a mutable repository reference.
  4. Verify release signatures or published checksums before installing prebuilt CLI artifacts.
  5. Document the expected package publisher and repository identity so users can detect dependency confusion or impersonation.
  6. Review package lifecycle scripts and, where practical, install with lifecycle scripts disabled until their contents have been verified.
  7. Run installation without administrative privileges and in a constrained environment.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:52
Finding

Unsafe Shell Command Templates Permit Command Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:52-59
Vulnerability Type: Shell command injection through unsafe interpolation of content, paths, and flags
Risk Level: High

Complete Code Snippet:

bash
4. **Run upload** — Use `--output=json` as global flag (before `create`):
   ```bash
   # Text/code via stdin
   printf '%s' "<content>" | privatebin --output=json create [flags]

   # From file
   privatebin --output=json create --filename=/path/to/file [flags]

The immediately following attachment command uses the same unsafe filename and flag pattern:

bash
# File attachment
privatebin --output=json create --attachment --filename=/path/to/file [flags]

Technical Analysis

The Skill instructs an agent to construct shell commands containing user-controlled content, filenames, and inferred flags. Merely placing a placeholder between double quotes is not a safe execution boundary if the agent replaces that placeholder by generating a command string.

For example, content containing a double quote followed by shell operators can terminate the intended quoted argument and introduce another command. Shell substitutions inside double quotes may also be evaluated if copied into the command text. Filenames can similarly be dangerous when inserted into --filename=/path/to/file without argument-safe process invocation. The open-ended [flags] placeholder creates an additional injection surface unless every flag and value is selected from a strict allowlist.

The Skill only needs to execute the PrivateBin CLI and send data to its standard input. Invocation through a shell with interpolated data therefore exceeds the minimum mechanism necessary for the declared upload functionality.

Attack Path

  1. A user supplies text containing shell metacharacters, quote termination, or command substitution syntax, or identifies a file with a maliciously constructed path.
  2. The agent follo ...[truncated 1139 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not build a shell command by interpolating content, filenames, passwords, hosts, or option values.
  2. Invoke the privatebin executable through a process API using a fixed argument array and with shell processing disabled.
  3. Send paste content directly to the child process's standard input as raw data.
  4. Pass filenames as individual arguments. Use an end-of-options marker where supported and reject NUL characters or invalid paths.
  5. Construct options only from strict allowlists. In particular, validate expiry and formatter values against the documented enumerations and represent Boolean options as fixed flags.
  6. Treat instance names and host values as data, validate their expected syntax, and never concatenate them into shell text.
  7. Avoid passing passwords on the command line where they may appear in process listings or logs. Prefer a protected standard-input or environment mechanism supported by the CLI.
  8. Update SKILL.md to explicitly prohibit shell interpolation and provide an argument-array example appropriate to the agent runtime.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description says the skill uploads content to any PrivateBin instance and returns a shareable link, but it does not prominently warn that user data leaves the local environment and is transmitted to an external server. This omission is particularly dangerous here because the core purpose of the skill is external sharing, so users or agents may disclose secrets, proprietary code, personal data, or internal reports without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

bash
privatebin init                                        # default: privatebin.net
privatebin init --host https://bin.example.com         # custom host
privatebin init --host https://bin.example.com --force # overwrite existing

Config file (~/.config/privatebin/config.json):

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are very broad and overlap with common user requests to share reports, code, or files, increasing the chance the agent invokes this skill automatically without clearly surfacing that data will be sent to an external paste service. In this skill's context, unintended activation is more dangerous because it can cause exfiltration of potentially sensitive content to a third-party PrivateBin instance and generate a shareable link.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly facilitates uploading user-provided text or files to an external PrivateBin server, but the description does not warn that this transfers potentially sensitive content and related metadata off the local system. Users may unknowingly disclose secrets, proprietary code, personal data, or internal reports to a third-party service because the skill presents the action as a normal sharing workflow without any privacy warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to extract and return the paste URL and references password usage, but it does not warn that the paste URL fragment, password, and delete token are effectively sensitive access/control secrets. Mishandling these values in logs, chat history, screenshots, or follow-on automation could allow unauthorized access to the paste or deletion of the shared content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says the skill uploads content and returns a link, but it does not clearly warn that data is sent to an external PrivateBin instance and becomes accessible through a shareable URL. This lack of disclosure is risky because users may provide sensitive text, code, reports, or files assuming local handling, when the skill actually publishes them to a third-party service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad phrases such as 'upload deliverable' and 'generate shareable link' that can activate the skill for generic sharing requests, not just explicit PrivateBin use. In a skill that exfiltrates user-provided content to an external service, overbroad activation increases the chance of unintended uploads of sensitive data without clear user awareness or consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.