ClawHub
Back to skill

Security audit

Marriage Matching

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for astrology marriage reports, but it sends extensive personal data to an external service and returns report download links without documented privacy or access controls.

Review before installing or using this skill with real people’s data. Only submit information with consent from both individuals, avoid unnecessary real identifiers where possible, and treat returned PDF links as sensitive because the artifacts do not document access controls, expiration, or deletion behavior.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
openapi.json:121
Finding

Unauthenticated Access to Sensitive Generated Reports

Content
View full analysis
Remediation
View remediation

other

Warning
Location
openapi.json:260
Finding

Excessive Mandatory Collection of Sensitive Personal Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill requests and transmits highly sensitive personal data for two individuals, including full names, parents' names, mobile numbers, birth date, birth time, and birth place, without any privacy notice, consent guidance, retention policy, or data handling warning. In this context, those fields are sufficient for identity profiling and create elevated privacy risk because they are sent to a third-party astrology service and used to generate persistent report artifacts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This finding reflects transmission of user-supplied sensitive personal data to an external domain to generate horoscope reports. External transmission is expected for an API-backed skill, but in this case it becomes security-relevant because the data includes extensive personal and birth information tied to named individuals and there is no disclosure of privacy safeguards.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
{
  "success": true,
  "message": "Marriage compatibility analysis completed successfully",
  "bride_pdf_url": "https://api.mkkpro.com/downloads/Anjali_Sharma_horoscope_1234567890.pdf",
  "groom_pdf_url": "https://api.mkkpro.com/downloads/Arjun_Patel_horoscope_1234567890.pdf",
  "match_pdf_url": "https://api.mkkpro.com/downloads/marriage_match_report_1234567890.pdf",
  "generated_at": "2024-01-15T14:30:00Z"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill returns direct download URLs for personal horoscope and marriage-matching PDFs without any warning that these links may expose highly sensitive report data if shared, logged, guessed, or retained in conversation history. Because the filenames include personal names and appear to be publicly retrievable from a downloads path, the resulting documents may be accessible beyond the intended recipient.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This URL indicates externally hosted access to a generated groom horoscope PDF containing personal data. While external hosting is part of normal operation, exposing or distributing report artifacts through third-party URLs increases the chance of unintended access through logs, referrals, shared chat history, or weak download controls.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
"success": true,
  "message": "Marriage compatibility analysis completed successfully",
  "bride_pdf_url": "https://api.mkkpro.com/downloads/Anjali_Sharma_horoscope_1234567890.pdf",
  "groom_pdf_url": "https://api.mkkpro.com/downloads/Arjun_Patel_horoscope_1234567890.pdf",
  "match_pdf_url": "https://api.mkkpro.com/downloads/marriage_match_report_1234567890.pdf",
  "generated_at": "2024-01-15T14:30:00Z"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This finding points to an externally hosted marriage compatibility report URL, which likely aggregates sensitive data from both individuals into a single downloadable artifact. The combined nature of the report makes exposure more dangerous because it links identities, relationship intent, and detailed personal birth information in one file.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

"message": "Marriage compatibility analysis completed successfully", "bride_pdf_url": "https://api.mkkpro.com/downloads/Anjali_Sharma_horoscope_1234567890.pdf", "groom_pdf_url": "https://api.mkkpro.com/downloads/Arjun_Patel_horoscope_1234567890.pdf", "match_pdf_url": "https://api.mkkpro.com/downloads/marriage_match_report_1234567890.pdf", "generated_at": "2024-01-15T14:30:00Z" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md
## References

- **Kong Route:** https://api.mkkpro.com/lifestyle/marriage-matching
- **API Docs:** https://api.mkkpro.com:8197/docs

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The API schema explicitly collects highly sensitive personal data for two individuals, including names, parents' names, mobile numbers, date/time of birth, and birthplace, but provides no privacy notice, data minimization guidance, retention policy, or handling constraints. In this context, the combination of fields is especially sensitive because it enables identity profiling and exposes intimate personal attributes that could be misused if logged, retained, or shared improperly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The language_id field enumerates multiple supported languages but sets the default to 1, which the description defines as Tamil. This is a natural-language locale preference enforced by default rather than chosen by the user, which matches the policy concern for language or locale restrictions without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.