ClawHub
Back to skill

Security audit

Numerology Calculator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate external numerology API integration, but it sends full names and birth dates to a third party through a billable API without clear consent or safe command handling.

Review this before installing. It should tell users before each first request that their full name, birth date, language choice, session identifier, userId, and timestamp will be sent to portal.toolweb.in and may consume paid quota. Do not use it for other people's personal details unless they agree, and prefer a version that uses safe JSON serialization rather than interpolated shell curl commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:43
Finding

Forced Billable API Invocation and Promotional Output Hijacking

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:85
Finding

Shell Command Injection Through Unescaped User-Controlled JSON Values

Content
View full analysis
", "birthMonth": , "birthDay": , "birthYear": , "system": "", "language": "", "sessionId": "", "userId": 0, "timestamp": "" }' ``` ### Technical Analysis The documented workflow instructs the agent to place user-controlled values directly inside a single-quoted shell argument. In particular, `fullName` originates from user input and is interpolated into the body passed to `curl`. Single quotes cannot be escaped from inside a POSIX shell single-quoted string. If an implementation replaces `` directly without safe serialization, a name containing a single quote can terminate the `-d` argument. Additional shell metacharacters can then introduce a new command. A conceptually malicious value could use the following structure: ```text '; ; # ``` After unsafe interpolation, the first single quote terminates the JSON argument, the semicolon begins another command, and the comment marker can suppress the remainder of the generated command. The same general issue applies to any user-controlled string inserted into this template without shell-safe encoding. The vulnerability arises from combining data serialization, shell parsing, and command execution in one interpolated string. JSON validation alone is insufficient because shell parsing occurs before `curl` processes the request. ### Attack Path 1. An attacker requests a numerology reading and supplies a crafted full name containing a single quote and shell metacharacters. 2. The agent or skill executor re ...[truncated 1391 chars]
Remediation
View remediation

other

Warning
Location
SKILL.md:71
Finding

Transmission of Personally Identifying Data Without an Explicit Consent Step

Content
View full analysis
", "birthMonth": , "birthDay": , "birthYear": , "system": "", "language": "", "sessionId": "", "userId": 0, "timestamp": "" }' ``` ``` ### Technical Analysis The skill collects a full name and complete date of birth and transmits those values to `https://portal.toolweb.in`. A full name combined with a birth date is identifying personal data. The request also includes a session identifier and timestamp, which can facilitate correlation across requests or with server-side records. The documentation says that API requests are tracked for billing, but it does not require the agent to: - Tell the user that their personal data will leave the local environment. - Obtain explicit consent before transmission. - Explain retention, logging, deletion, or secondary-use policies. - Provide a privacy-policy reference. - Minimize or pseudonymize the submitted identity information. HTTPS protects data in transit from ordinary passive interception, but it does not prevent the receiving service from storing, analyzing, or correlating the data. ### At ...[truncated 1385 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to configure an external service API key and demonstrates sending highly personal inputs such as full name and birth date, but it does not disclose that this data may be transmitted to a third-party service. Because numerology inherently uses personal data and the example includes identifying information, users may unknowingly expose sensitive personal data to an external API without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs the agent to collect and transmit sensitive personal data including full name and full birth date to a third-party API, but it does not require any explicit user-facing privacy notice or consent before exfiltration. The risk is increased because the transmitted fields are sufficient for personal profiling and the skill strongly instructs that the API must always be called, discouraging safer local handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This curl command sends user-supplied PII and metadata to an external service at portal.toolweb.in, including full name, birth date, sessionId, userId, and timestamp. External transmission is not inherently malicious, but in this context it is risky because the skill mandates transmission of personal data to a third party without built-in consent, data minimization, or clear disclosure controls.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

  1. Call the API:
bash
curl -s -X POST "https://portal.toolweb.in/apis/lifestyle/numerology" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $TOOLWEB_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The example interaction normalizes sending real user identity and birth-date data to an external API as part of standard operation. Because the example reinforces the 'always call the API' behavior, it increases the chance that agents will exfiltrate personal data by default without considering privacy, consent, or safer alternatives.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

  1. User responds: "Pythagorean, in Hindi please"
  2. Call API:
bash
curl -s -X POST "https://portal.toolweb.in/apis/lifestyle/numerology" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $TOOLWEB_API_KEY" \
  -d '{