ClawHub
Back to skill

Security audit

Grokipedia

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only Grokipedia search and article-fetch helper, with ordinary dependency and untrusted-content cautions but no evidence of hidden, destructive, credential-seeking, or persistent behavior.

Install only if you are comfortable sending Grokipedia search terms and article slugs to grokipedia.com. Treat fetched article content as untrusted external text, and prefer pinned dependency versions or a lockfile for reproducible installs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
scripts/fetch.mjs:116
Finding

Untrusted Remote Article Content Is Passed Directly to the Consuming AI Agent

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents executable scripts that perform network access to an external domain, but the manifest does not declare any corresponding tool scope or allowed-tools restriction. This creates a policy/visibility gap: an agent or reviewer cannot reliably enforce or reason about the skill’s external connectivity, increasing the chance of unintended data egress or execution with broader-than-expected capabilities.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range (^24.0.0), which allows future minor/patch releases to be installed without explicit review. In a supply-chain context, this reduces build reproducibility and can unintentionally pull in a compromised or breaking upstream release, though the package itself appears read-only and does not handle secrets.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json
"install": "bun install --production"
  },
  "dependencies": {
    "jsdom": "^24.0.0",
    "@mozilla/readability": "^0.5.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency range for @mozilla/readability is not pinned, so installs may resolve to different versions over time. This creates avoidable supply-chain risk and makes it harder to ensure the deployed version is not affected by newly disclosed issues.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json
},
  "dependencies": {
    "jsdom": "^24.0.0",
    "@mozilla/readability": "^0.5.0"
  }
}

Unverifiable Dependency: @mozilla/readability has 1 known advisory(ies) (CVE-2025-2792 (@mozilla/readability Denial of Service through Regex)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The manifest references @mozilla/readability with an unpinned version while a known advisory exists for some releases (CVE-2025-2792, regex-based DoS). Because the exact installed version is not fixed, you cannot verify from this manifest alone whether deployments are vulnerable, and this parser processes remote article content where maliciously crafted input could trigger excessive resource use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script sends the user-provided search query to grokipedia.com over the network, but it does not clearly disclose to the user that their input will be transmitted to a third-party service. This creates a privacy risk because users may enter sensitive terms assuming the tool is purely local or not realizing the destination of the query.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.