ClawHub
Back to skill

Security audit

tagesstatus-live-public

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent status-reporting helper, but it relies on persistent plaintext storage of high-value API/admin credentials and references an absent browser dashboard, so users should review it carefully before use.

Install only if you are comfortable supplying service credentials for these providers. Use narrowly scoped, read-only, short-lived tokens where possible, avoid admin keys unless strictly required, keep keys.env out of version control, do not host the browser dashboard on a shared or untrusted origin, and rotate or revoke tokens after use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:60
Finding

Persistent Plaintext Storage of High-Value API Credentials

Content
View full analysis

Vulnerability Details

File Location: README.md:60-62
Related Locations: SKILL.md:43; keys.env.template:2-14
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code

README.md:60-62:

text
## Sicherheit
Keys liegen im Klartext (Browser-localStorage bzw. keys.env). Paket privat halten,
Keys regelmäßig rotieren. Für Dauerbetrieb ablaufende Tokens (z. B. Tailscale) durch
OAuth-Clients ersetzen.

keys.env.template:2-14 demonstrates the credentials intended for plaintext storage:

dotenv
# In keys.env umbenennen, Werte eintragen. Privat halten, regelmaessig rotieren.
GH_REPO="owner/repo"
GH_TOKEN=""
VERCEL_TOKEN=""
VERCEL_TEAM_ID=""
VERCEL_PROJECT_ID=""
DOCKER_NAMESPACE=""
DOCKER_PAT=""
OPENROUTER_API_KEY=""
OPENAI_ADMIN_KEY=""
CLAUDE_ADMIN_KEY=""
TAILSCALE_TOKEN=""
TAILSCALE_TAILNET="-"
CLAWHUB_SLUGS=""

Technical Analysis

The documented design persistently stores API credentials in browser localStorage or an unencrypted keys.env file. These values can include organization-level OpenAI and Anthropic administrator keys, a Docker personal access token, a Tailscale token, and credentials capable of accessing private GitHub or Vercel resources.

Browser localStorage is accessible to any JavaScript executing within the same origin. If the dashboard is hosted alongside a compromised application, affected by script injection, or supplied with an untrusted third-party script, that script could read and transmit every stored token. The advertised dashboard file, tagesstatus-live-public.html, is absent from the audited package, so its origin isolation, content security policy, external script usage, and token-handling implementation could not be verified.

A plaintext keys.env file can be disclosed through accidental source-control commits, insecure backups, permissive filesystem permissions, artifact packaging, log ...[truncated 2726 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not persist browser credentials by default. Keep tokens in memory for the current page session and clear them when the page closes or the report finishes.
  2. If browser persistence is retained, require explicit opt-in, clearly warn users about same-origin script access, and provide a prominent function to remove all stored credentials.
  3. Serve the dashboard from a dedicated, isolated origin containing no unrelated applications or user-controlled content.
  4. Apply a restrictive Content Security Policy and avoid third-party scripts, inline executable content, and dynamically imported remote code.
  5. Prefer a backend or CI worker that retrieves credentials from a managed secret store and returns only sanitized report data to the browser.
  6. Store CI credentials using the platform's protected secret mechanism rather than committing keys.env.
  7. Add keys.env and equivalent secret-file patterns to .gitignore, and document verification with git status before commits.
  8. Require restrictive file permissions, such as owner-only read/write access, for any local secret file.
  9. Use separate, narrowly scoped, read-only credentials for each provider. Avoid organization-admin keys unless the selected endpoint strictly requires them.
  10. Set short expiration periods where supported, rotate credentials regularly, and revoke them immediately after suspected exposure.
  11. Supply the missing dashboard HTML for review before recommending browser-based credential entry, so its storage behavior, network destinations, dependency usage, and origin protections can be validated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
Siehe `keys-beispiel.png` — zeigt Dummy-Beispieleinträge für alle möglichen Abfragen

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
Siehe `statusseite-beispiel.png` — zeigt die Live-Seite mit aktiven Abfragen (Slack,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

In der geplanten Aufgabe / im Skript — neuen Abschnitt ergänzen:

text
# Mein Dienst
curl -s -H "Authorization: Bearer $MEIN_TOKEN" "https://api.example.com/v1/..." | <parsen>

und das Ergebnis in den Report aufnehmen; fehlende Keys -> Quelle überspringen.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
## Quellen, benötigte Angaben & Endpunkte
- GitHub — `GH_REPO` (owner/repo, Pflicht), `GH_TOKEN` (optional für privat/Codespaces): pulls?state=open, branches, commits/{branch}/check-runs, user/codespaces.
- Vercel — `VERCEL_TOKEN` + `VERCEL_PROJECT_ID` (+ opt. `VERCEL_TEAM_ID`): GET https://api.vercel.com/v6/deployments?projectId={proj}&limit=10[&teamId={team}] → state (ERROR hervorheben), Commit, Branch.
- Docker Hub — `DOCKER_NAMESPACE` (= Anmeldename) + `DOCKER_PAT`: POST https://hub.docker.com/v2/users/login {username:NAMESPACE, password:PAT} → .token; dann GET https://hub.docker.com/v2/repositories/{namespace}/?page_size=50 mit Bearer JWT → name, is_private, pull_count. Pulls summieren.
- OpenRouter — `OPENROUTER_API_KEY`: /v1/key, /v1/credits.
- OpenAI — `OPENAI_ADMIN_KEY` (Admin-Key): /v1/organization/costs?start_time=<unix-30d>.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly describes a browser-based dashboard that stores tokens and identifiers in localStorage, but does not clearly warn that localStorage is persistent and accessible to any script running on the same origin. If the HTML is hosted or opened in an unsafe environment, an XSS issue, malicious browser extension, or shared machine access could expose long-lived API keys and admin tokens.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The documentation says the example status page shows active queries for Slack, Linear, Notion, GitHub, and Vercel, plus a disabled Zoom source and an automatic daily run. This contradicts the declared source set of the public skill, which elsewhere limits the scope to GitHub, Vercel, Docker Hub, OpenRouter, OpenAI, Anthropic/Claude, Tailscale, and ClawHub, and describes a local/public variant rather than an automated scheduled system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language comments in this template instruct the user in German only, which imposes a specific language on users without any opt-in or alternative. The policy explicitly allows locale constraints only when they are documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.