ClawHub
Back to skill

Security audit

Plausible Analytics Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill does Plausible analytics work as advertised, but its scripts can send analytics data and API credentials to any configured base URL without validation.

Install only if you will keep PLAUSIBLE_BASE_URL and any --base-url value restricted to a trusted HTTPS Plausible instance. Prefer PLAUSIBLE_API_KEY from a protected environment variable rather than command-line arguments, and avoid placing secrets or personal data in tracked URLs, referrers, or custom event properties.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/stats.sh:52
Finding

Bearer API Key Disclosure Through an Unvalidated Stats API Endpoint

Content
View full analysis
` directly to the attacker-controlled endpoint. 5. The attacker captures and reuses the token against the legitimate Plausible service, subject to the token’s assigned permissions. Alternatively, an `http://` base URL permits an on-path attacker to observe or modify the request. ...[truncated 498 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/top-pages.sh:49
Finding

Bearer API Key Disclosure Through an Unvalidated Top-Pages Endpoint

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/realtime.sh:43
Finding

Bearer API Key Disclosure Through an Unvalidated Realtime API Endpoint

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/track.sh:48
Finding

Analytics and Potentially Sensitive Event Data Can Be Sent to an Arbitrary Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code’s behavior is limited to a single stats-summary retrieval script using Plausible's aggregate stats endpoint. That is related to analytics querying, but it is substantially narrower than the declared description. The declared purpose includes event tracking and several specific query types that are absent from the code shown. Since the primary described capability set is broader than the actual implemented behavior in this chunk, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code in track.sh matches the tracking portion of the description: it accepts domain, URL, referrer, event name, properties, and base URL, then posts JSON payloads to the Plausible Events API. However, there is no functionality for fetching analytics data or querying stats from any Plausible stats endpoint. Because a substantial declared capability is absent from the provided code chunk, the description does not accurately represent the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs the agent to execute shell scripts but does not declare any tool scope such as allowed-tools or permissions. This creates an authorization gap where a consumer may not realize the skill requires shell execution and network access, increasing the chance of unintended command execution or outbound requests with environment-provided secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/track.sh (reported line 60)May include surrounding context.

sh
referrer: (if $r != "" then $r else null end)
    }')

  RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
    -H "Content-Type: application/json" \
    -d "$PAYLOAD" \
    "${BASE_URL}/api/event")

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/track.sh (reported line 99)May include surrounding context.

sh
referrer: (if $r != "" then $r else null end)
    }')

  RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
    -H "Content-Type: application/json" \
    -d "$PAYLOAD" \
    "${BASE_URL}/api/event")

Static analysis

No suspicious patterns detected.