ClawHub
Back to skill

Security audit

Anthropic Chat

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Anthropic API client with disclosed external API use, though its script is currently broken and users should be careful with sensitive prompts.

Install only if you intend to use your Anthropic API key and send task content to Anthropic's API. Avoid including secrets, regulated data, or proprietary material unless that transfer is approved. Expect the current script to fail until the TASK input handling bug is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
anthropic-chat.js:17
Finding

Undefined TASK Variable Causes Unconditional Runtime Failure

Content
View full analysis

Vulnerability Details

File Location: anthropic-chat.js, lines 17–22
Vulnerability Type: Use of an undeclared variable resulting in denial of service
Risk Level: Low

Vulnerable Code

js
const body = JSON.stringify({
  model: MODEL,
  max_tokens: MAX_TOKENS,
  messages: [{ role: 'user', content: TASK || 'Hello, Claude.' }]
});

Technical Analysis

The identifier TASK is referenced without being declared, imported, or populated from command-line input or another defined source. In Node.js, evaluating an undeclared identifier raises a ReferenceError. The || 'Hello, Claude.' fallback cannot handle this condition because JavaScript must first evaluate TASK, which throws before the fallback operand can be selected.

Consequently, body construction always fails during normal execution, before the HTTPS request is created or sent. This contradicts the documented behavior that a natural-language task is accepted and forwarded to the Anthropic Messages API.

Attack Path

  1. A user or automated process invokes anthropic-chat.js.
  2. The environment contains a valid ANTHROPIC_API_KEY, allowing execution to pass the initial API-key check.
  3. The script reaches the request-body construction at line 21.
  4. JavaScript evaluates the undeclared TASK identifier and raises ReferenceError: TASK is not defined.
  5. The process terminates before sending the API request or returning a model response.

No special privileges or attacker-controlled input are required to trigger the failure.

Impact Assessment

The issue causes complete loss of availability for the skill: all otherwise valid invocations fail before reaching the Anthropic API. It does not provide access to additional privileges, expose the API key, enable code execution, or affect resources beyond the failing process. The practical scope is limited to disruption of this skill and any workflow that depends on it.

Remediation
View remediation

Remediation Suggestions

Explicitly define and validate the task before constructing the request body. For example:

js
const TASK = process.argv.slice(2).join(' ').trim();
const taskContent = TASK || 'Hello, Claude.';

const body = JSON.stringify({
  model: MODEL,
  max_tokens: MAX_TOKENS,
  messages: [{ role: 'user', content: taskContent }]
});

If an empty task should be rejected rather than replaced with a default, terminate with a clear usage message:

js
const TASK = process.argv.slice(2).join(' ').trim();

if (!TASK) {
  console.error('Usage: anthropic-chat.js <task>');
  process.exit(1);
}

Add an automated smoke test that invokes the script with a task and verifies that request construction does not raise a ReferenceError. The input mechanism should also be documented in SKILL.md so runtime behavior and usage instructions remain consistent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · anthropic-chat.js (reported line 14)May include surrounding context.

js
if (!API_KEY) {
  console.error('Error: ANTHROPIC_API_KEY environment variable is not set.');
  console.error('Please set it in your environment or .env file.');
  process.exit(1);
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly says it uses the user's existing Anthropic API key and sends requests through the Anthropic Messages API, but it does not clearly warn users that their prompts and potentially sensitive task content will be transmitted to an external third-party service. This can lead to inadvertent disclosure of secrets, internal data, or regulated information because users may assume the skill operates locally or within the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This script sends user-provided content to Anthropic's external API, but the code provides no disclosure, consent flow, or guardrails about what may be transmitted. In an agent-skill context, that can lead to accidental leakage of sensitive prompts, secrets, or proprietary data to a third party when users may not expect remote processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · anthropic-chat.js (reported line 24)May include surrounding context.

js
messages: [{ role: 'user', content: TASK || 'Hello, Claude.' }]
});

const url = new URL('https://api.anthropic.com/v1/messages');
const options = {
  hostname: url.hostname,
  port: 443,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill's natural-language documentation is entirely in Chinese, and there is no indication that this locale restriction is optional, user-selected, or required for a region-specific purpose. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

No manifest is available, so the skill has no stated purpose justifying access to sensitive environment variables. The code explicitly reads an Anthropic API key from the environment, which is a privileged capability not grounded in any declared intent.

Content

No source excerpt is available for this finding.