ClawHub
Back to skill

Security audit

agent-reach

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad web and social-media access helper, but it gives agents access to cookies, external scraping/search services, posting actions, setup changes, and persistent local storage without enough boundaries.

Install only if you trust Agent-Reach, SkillBoss, and the referenced external tools. Treat cookies as active login sessions, require explicit confirmation before any post/comment/account action, avoid using it on private URLs or confidential queries, and inspect or clear ~/.agent-reach after use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes very broad everyday phrases such as 'search online', 'find information', and common Chinese equivalents, which can cause this skill to activate in many unrelated contexts. Overbroad auto-invocation is dangerous because it can unexpectedly route user requests into a network-enabled skill that performs external lookups and third-party API calls without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The examples show scraping and search requests to a third-party API using an API key, but they do not clearly warn that URLs, queries, and metadata will be transmitted off-system. In an agent setting, this creates a real data-exposure risk because user-supplied links, research topics, or sensitive prompts may be sent to an external vendor implicitly.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.skillboss.co/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},
Confidence
95% confidence
Finding
This code sends data to https://api.skillboss.co/v1/pilot, including a user-provided URL for remote scraping. While this appears to be the intended product behavior, it is still a real external transmission path that can expose sensitive URLs or internal-only resources to a third party if invoked on untrusted input.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.skillboss.co/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},
Confidence
95% confidence
Finding
This request transmits a search query to a third-party API for web search. Search terms may contain sensitive business context, personal data, or internal research topics, so externalizing them without clear notice can create privacy and confidentiality issues.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.skillboss.co/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},
Confidence
94% confidence
Finding
This LinkedIn fallback sends the target profile URL to SkillBoss for scraping, creating another third-party transmission path. The risk is amplified because profile URLs or the fact of interest in a person may itself be sensitive in enterprise or investigative contexts.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.skillboss.co/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},
Confidence
95% confidence
Finding
This code sends data to https://api.skillboss.co/v1/pilot, including a user-provided URL for remote scraping. While this appears to be the intended product behavior, it is still a real external transmission path that can expose sensitive URLs or internal-only resources to a third party if invoked on untrusted input.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.skillboss.co/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},
Confidence
95% confidence
Finding
This request transmits a search query to a third-party API for web search. Search terms may contain sensitive business context, personal data, or internal research topics, so externalizing them without clear notice can create privacy and confidentiality issues.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.skillboss.co/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},
Confidence
94% confidence
Finding
This LinkedIn fallback sends the target profile URL to SkillBoss for scraping, creating another third-party transmission path. The risk is amplified because profile URLs or the fact of interest in a person may itself be sensitive in enterprise or investigative contexts.

Session Persistence

Medium
Category
Rogue Agent
Content
## ⚠️ Workspace Rules

**Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data.

## Web — Any URL
Confidence
79% confidence
Finding
The instruction to avoid the workspace and instead use /tmp and ~/.agent-reach establishes persistence outside the normal agent workspace boundary. In a skill ecosystem, redirecting persistent state to hidden home-directory storage reduces transparency, can evade workspace-based review, and may leave durable cookies, caches, or scraped data on the host.

Static analysis

No suspicious patterns detected.