ClawHub
Back to skill

Security audit

lex

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to help build Warden LangGraph agents, but some testing and production deployment examples could expose API keys or unauthenticated agent endpoints if copied directly.

Review this before installing if you plan to copy its deployment examples. Use HTTPS for any authenticated endpoint, do not pass real API keys as command-line arguments, add authentication before public /invoke or /stream routes, restrict CORS, avoid public Redis/Postgres defaults, replace example passwords, and pin dependencies/images for production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/test-agent.py:16
Finding

API Credentials Can Be Exposed Through Command-Line Arguments and Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/deployment-guide.md:426
Finding

Production Deployment Example Exposes Unauthenticated Agent Execution Endpoints

Content
View full analysis
{ try { const { input } = req.body; if (!input) { return res.status(400).json({ error: 'Input required' }); } const result = await agent.invoke({ input }); res.json(result); } catch (error) { console.error('Agent error:', error); res.status(500).json({ error: 'Internal error', message: error.message }); } }); // Streaming endpoint app.post('/stream', async (req, res) => { try { const { input } = req.body; res.setHeader('Content-Type', 'text/event-stream'); res.setHeader('Cache-Control', 'no-cache'); res.setHeader('Connection', 'keep-alive'); const stream = await agent.stream({ input }); for await (const chunk of stream) { res.write(`data: ${JSON.stringify(chunk)}\n\n`); } res.end(); } catch (error) { console.error('Streaming error:', error); res.write(`data: ${JSON.stringify({ error: error.message })}\n\n`); res.end(); } }); ``` ### Technical Analysis The guide presents this as a production server setup but does not apply authentication or authorization middleware to `/invoke` or `/stream`. Both routes directly execute the agent using attacker-supplied input. The Kubernetes example exposes the service through a `LoadBalancer`, which can make the endpoints reachable from external networks. In addition, `cors() ...[truncated 1594 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/init-agent.py:29
Finding

Generated Projects Use Unpinned and Non-Reproducible Dependency Ranges

Content
View full analysis
=0.0.19 langchain-openai>=0.0.19 python-dotenv>=1.0.0 fastapi>=0.100.0 uvicorn>=0.23.0""" ``` Users are then instructed to resolve and install these ranges: ```bash npm install ``` ```bash pip install -r requirements.txt ``` ### Technical Analysis The scaffold uses caret ranges for npm dependencies and unrestricted lower bounds for Python dependencies. It does not generate an npm lockfile, a Python constraints file, or package hashes. Consequently, two users running the same scaffold at different times may install materially different dependency versions. For Python in particular, `>=` permits any later release accepted by the resolver. Installation therefore introduces code that was not present in and was not reviewed as part of this Skill. This does not prove that any listed dependency is malicious. The issue is the lack of reproducible dependency selection and integrity verification, which enlarges the supply-chain attack surface and can also introduce incompatible updates. ### Attack Path 1. A user runs `scripts/init-agent.py` to generate a project. 2. The generated manifest contains broad dependency ranges and no lockfile or hashes. 3. At a later time, a new or compromised package release becomes eligible under those ranges. 4. The user runs `npm install` or `pip install -r requirements.txt`. 5. The package manager downloads the newly eligible package and its transitive dependencies. 6. Package installation hooks, build scripts, imported modules, or runtime cod ...[truncated 701 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
assets/example-configs.md:240
Finding

Infrastructure Examples Expose Redis and Use a Predictable Database Password

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (41)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description focuses on building new Warden/LangGraph agents, preparing them for publishing, and deployment-related workflows. The actual code does not build agents, generate LangGraph logic, prepare publishing artifacts, integrate with Warden Studio, or handle deployments. Instead, it tests an existing agent service over HTTP. That is a materially different primary purpose, so this is a clear description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill instructs users to place API keys in a .env file and configures langgraph.json to load that file, but it provides no safeguards around secret handling, exclusion from version control, or least-privilege usage. In a code-generation or agent-runner setting, this can lead to accidental exposure of LangSmith, OpenAI, or other API credentials through repository commits, logs, packaging, or unintended file access.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

"graphs": { "agent": "./src/graph.ts" // or .py }, "env": ".env" }

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/example-configs.md (reported line 191)May include surrounding context.

md
"graphs": {
    "agent": "./src/graph.ts"
  },
  "env": ".env"
}""",
            ".env.example": """# OpenAI Configuration
OPENAI_API_KEY=your_openai_key_here

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/example-configs.md (reported line 206)May include surrounding context.

md
"graphs": {
    "agent": "./src/graph.ts"
  },
  "env": ".env"
}""",
            ".env.example": """# OpenAI Configuration
OPENAI_API_KEY=your_openai_key_here

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-agent.py (reported line 62)May include surrounding context.

python
"graphs": {
    "agent": "./src/graph.ts"
  },
  "env": ".env"
}""",
            ".env.example": """# OpenAI Configuration
OPENAI_API_KEY=your_openai_key_here

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-agent.py (reported line 191)May include surrounding context.

python
"graphs": {
    "agent": "./src/graph.ts"
  },
  "env": ".env"
}""",
            ".env.example": """# OpenAI Configuration
OPENAI_API_KEY=your_openai_key_here

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/example-configs.md (reported line 223)May include surrounding context.

md
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/example-configs.md (reported line 243)May include surrounding context.

md
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/example-configs.md (reported line 273)May include surrounding context.

md
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/quick-reference.md (reported line 185)May include surrounding context.

md
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-agent.py (reported line 81)May include surrounding context.

python
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-agent.py (reported line 139)May include surrounding context.

python
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-agent.py (reported line 209)May include surrounding context.

python
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-agent.py (reported line 267)May include surrounding context.

python
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-agent.py (reported line 361)May include surrounding context.

python
# WEATHER_API_KEY=""",
            ".gitignore": """node_modules/
dist/
.env
*.log
.DS_Store""",
            "src/graph.ts": """import { StateGraph, END } from "@langchain/langgraph";

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrase "LangGraph agent" is overly generic for a skill that is supposed to activate for Warden-specific requests. In a skill-routing system, this can cause the agent to invoke this skill for unrelated LangGraph tasks, unnecessarily exposing downstream instructions, scripts, and deployment guidance outside the intended context and potentially leading to confused-deputy behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The statement that the skill triggers when users mention "Warden or LangGraph agents" creates an ambiguous activation boundary and broadens scope beyond the declared purpose of the skill. In agent ecosystems, such broad routing can misfire on unrelated requests, causing unintended use of specialized crypto/Web3 build instructions and weakening separation between skills.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill includes actionable shell, network, environment-variable, and file-write operations but declares no explicit tool scope or permissions boundary. In an agent-skill context, this increases the chance that a caller or downstream runtime will grant broader capabilities than intended, enabling command execution, outbound requests, and local file modification without clear restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

Test your agent's API:

bash
curl -X POST http://localhost:8000/invoke \
  -H "Content-Type: application/json" \
  -d '{"input": "test query"}'

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment-guide.md (reported line 24)May include surrounding context.

md
apis: {
    coingecko: {
      key: process.env.COINGECKO_API_KEY,
      baseUrl: 'https://api.coingecko.com/api/v3'
    },
    alchemy: {
      key: process.env.ALCHEMY_API_KEY!,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment-guide.md (reported line 32)May include surrounding context.

md
},
    weather: {
      key: process.env.WEATHER_API_KEY!,
      baseUrl: 'https://api.weatherapi.com/v1'
    }
  },
  server: {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment-guide.md (reported line 303)May include surrounding context.

All API calls require the x-api-key header with your LangSmith API key:

bash
curl YOUR_AGENT_URL/runs/wait \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: [YOUR-LANGSMITH-API-KEY]' \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide recommends request logging for all requests without discussing redaction, minimization, or excluding sensitive routes. In an agent deployment context, request paths and associated logging patterns often expand to include bodies, prompts, API inputs, or user-supplied data later, which can expose secrets, personal data, or confidential prompts in logs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest context for this skill says it should be used for creating new Warden agents and explicitly notes 'not community examples.' However, the embedded description in this guide says the skill is for building agents using Warden's community templates, which is the opposite of the stated scope. This is a direct documentation-level contradiction about intended behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.