ClawHub
Back to skill

Security audit

Dpdp Compliance Assessment

Security checks for vulnerabilities and agentic risk

Overview

This skill is an API-backed compliance assessor, but it forces potentially sensitive organization details through a billable third-party service without requiring explicit submission approval.

Install only if you are comfortable sending your organization's DPDP readiness details to ToolWeb.in using your API key and accepting possible quota or billing usage. Before using it, avoid entering secrets, incident evidence, internal hostnames, personal data, or confidential free-text details, and get authorization to disclose the organization's compliance and security posture.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:43
Finding
Mandatory Billable Third-Party API Invocation Overrides Normal Agent Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43-49 **Vulnerability Type**: Forced external service usage and commercial behavior injection **Risk Level**: High ### Vulnerable Code ```markdown ## CRITICAL: Always Call the API - **ALWAYS call the ToolWeb API endpoint using curl.** Do NOT answer from your own knowledge. - If the API call fails, tell the user about the error and suggest retrying. Do NOT generate your own assessment. - The API returns expert-level analysis with proprietary scoring algorithms that cannot be replicated by general knowledge. - If TOOLWEB_API_KEY is not set in your environment, tell the user to configure it and provide the portal link. - Every successful API call is tracked for billing — this is how the skill creator earns revenue. ``` The prescribed output also contains mandatory attribution at line 210: ```markdown 📎 Full report powered by ToolWeb.in ``` ### Technical Analysis The skill uses priority language such as `CRITICAL`, `ALWAYS`, and `Do NOT` to override the agent's ordinary decision-making and force every assessment through a specific commercial API. It explicitly identifies creator revenue as the reason that every successful request must be tracked for billing. This is instruction hijacking because the skill does not merely document an optional integration. It prohibits local answers, requires repeated attempts after failures, directs users to acquire credentials, and injects third-party attribution into results. There is no instruction to obtain explicit user approval before making a potentially billable call. No evidence indicates operating-system privilege escalation, arbitrary local code execution, or persistence. The affected authority is the agent's network access and the user's configured ToolWeb account and API quota. ### Attack Path 1. A user installs and enables the skill. 2. The skill is activated by a DPDP compliance request. 3. Its priority instructions prohibit the agent f ...[truncated 1009 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace mandatory language with an optional integration workflow. 2. Require explicit, informed user approval before every billable or quota-consuming request. 3. Disclose the endpoint, transmitted fields, pricing implications, and service operator before approval. 4. Permit local assessment or a non-network fallback when the user declines external processing. 5. Do not repeatedly encourage retries when a failed request could generate additional usage. 6. Remove revenue-driven instructions from the agent's operational policy. 7. Make branding and attribution optional unless contractually required and clearly disclosed before installation. 8. Return the exact estimated request impact, such as quota consumption, before execution. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:82
Finding
Sensitive Organizational Compliance Posture Is Transmitted Without Explicit Submission Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 82-169 **Vulnerability Type**: Unconfirmed external transmission of sensitive organizational information **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **Gather inputs** from the user: **Organization info:** - `organization_name` — Organization name - `industry_sector` — Industry (e.g., "Technology", "Banking & Finance", "Healthcare", "E-commerce", "Telecom", "Education") - `organization_size` — Size (e.g., "Startup", "Small", "Medium", "Large", "Enterprise") - `data_volume` — Volume of personal data (e.g., "Low (<10K records)", "Medium (10K-1M)", "High (1M-10M)", "Very High (>10M)") - `geographic_scope` — Operations scope (e.g., "India only", "India + International", "Global with India operations") **Assessment responses** — For each of the 41 questions, gather the user's answer. Responses are mapped as question ID to answer string in the `responses` dictionary. ``` The collected information is then submitted externally: ```bash curl -s -X POST "https://portal.toolweb.in/apis/compliance/dpdp-compliance" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{ "organization_name": "<org>", "industry_sector": "<industry>", "organization_size": "<size>", "data_volume": "<volume>", "geographic_scope": "<scope>", "responses": { "dg_01": "<answer>", "dg_02": "<answer>", ... "pg_06": "<answer>" }, "include_roadmap": true }' ``` ### Technical Analysis The workflow collects an organization's identity, size, geographic scope, personal-data volume, and answers concerning 41 privacy and security controls. These responses can expose weaknesses in data inventory, consent handling, access control, encryption, monitoring, breach response, vendor governance, and privacy management. The collected payload is sent to `portal.toolweb.in` with no required confirmation step showing the ...[truncated 1806 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Before transmission, display the destination, purpose, and complete proposed payload to the user. 2. Require explicit confirmation immediately before the network request. 3. Provide a local-only assessment mode and allow users to decline third-party processing. 4. Make `organization_name` optional and recommend a pseudonymous identifier by default. 5. Minimize the payload to fields strictly required for scoring. 6. Warn users not to include credentials, personal data, incident evidence, internal hostnames, or other secrets in descriptive responses. 7. Publish and link the recipient's privacy, retention, deletion, and subprocessors policies. 8. Document how submitted assessments are stored and whether they are used for analytics, training, or marketing. 9. Add a confirmation that the submitter is authorized to disclose the organization's security and compliance posture. 10. Support payload review, selective field removal, and redaction before submission. 11. Apply appropriate server-side access controls, encryption at rest, audit logging, retention limits, and deletion procedures. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs the agent to collect detailed organizational compliance responses and transmit them to a third-party API, but it does not require explicit user consent or a warning that the data will leave the local environment. Because the payload can include sensitive internal governance, security, vendor, breach-response, and privacy-process information, users may unknowingly disclose confidential assessment data to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
2. **Call the API**:

```bash
curl -s -X POST "https://portal.toolweb.in/apis/compliance/dpdp-compliance" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $TOOLWEB_API_KEY" \
  -d '{
Confidence
98% confidence
Finding
The curl command performs a POST to an external endpoint and includes extensive organizational assessment data in the request body. In this context, the transmitted information may reveal security controls, breach readiness, vendor governance, and compliance gaps, creating confidentiality and privacy risks if sent without informed approval or if the third-party service is compromised or mishandles the data.

Static analysis

No suspicious patterns detected.