ClawHub
Back to skill

Security audit

V19 Early Causal Graph Debugger

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because its main workflow sends graph data to an external service and includes a shared public API key without clear privacy or data-handling terms.

Install only if you are comfortable sending causal graph contents and an agent name to the listed external service. Do not submit confidential workflows, business logic, system architecture, or security-relevant graphs unless the publisher provides a trusted endpoint, individual credentials, and clear retention and deletion terms.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

other

Error
Location
SKILL.md:91
Finding

Sensitive causal-graph data is submitted to an unverifiable external service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 91-108
Vulnerability Type: External Data Disclosure
Risk Level: High

Evidence

bash
curl -s -X POST https://boat-atlas-spa-flexible.trycloudflare.com/governance/causal-path-graph \
  -H "Content-Type: application/json" \
  -H "X-Governance-Key: <your dedicated key>" \
  -d '{
    "graph": {
      "nodes": [
        {"id":"A","label":"decision event"},
        {"id":"B","label":"execution action"},
        {"id":"C","label":"system response"},
        {"id":"D","label":"isolated event"}
      ],
      "edges": [
        {"from":"A","to":"B"},
        {"from":"B","to":"C"},
        {"from":"C","to":"A"}
      ]
    }
  }'

Technical Analysis

The documented workflow sends the complete causal graph to a remote API hosted behind a Cloudflare Tunnel domain. Causal graphs may encode confidential decisions, operational dependencies, system behavior, execution sequences, or business processes.

The project contains no local implementation of the advertised DFS or Tarjan analysis. It also provides no server source code, verified operator identity, privacy policy, retention policy, deletion process, or integrity assurances for the remote service. Consequently, users cannot audit how submitted graphs are processed or whether they are logged, retained, shared, or reused. The remote endpoint can also change independently after this package has been reviewed.

This is not remote code execution because the documentation does not retrieve or execute a payload. It is instead an external disclosure risk arising from transmitting task data to an unverifiable service.

Attack Path

  1. A user follows the documented invocation instructions.
  2. The user places a potentially sensitive causal graph in the JSON request body.
  3. The complete graph is transmitted to the externally controlled Cloudflare Tunnel endpoint.
  4. The serv ...[truncated 731 chars]
Remediation
View remediation

Remediation Suggestions

  • Provide a fully auditable local implementation of cycle and dangling-node analysis and make it the default processing path.
  • Do not send graph content externally without explicit, informed user consent.
  • Clearly warn users before transmission and identify exactly which fields leave the local environment.
  • Redact or pseudonymize node labels and other sensitive metadata before transmission.
  • If remote processing is required, use a stable, organization-controlled, verifiable domain rather than a temporary tunnel address.
  • Publish the server implementation or commission an independent assessment of its data-handling behavior.
  • Document the service operator, processing purpose, storage location, retention duration, deletion process, subprocessors, and incident-response procedure.
  • Apply strong transport security, request-size limits, authentication, tenant isolation, and server-side access controls.
  • Ensure that remote processing is opt-in and offer a no-network mode with equivalent core functionality.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:126
Finding

Reusable API credential is embedded in public documentation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126-132
Vulnerability Type: Hardcoded Shared Credential
Risk Level: Medium

Evidence

bash
v19-e5d585e28439decc614f09f91c4caa8c

curl -s https://boat-atlas-spa-flexible.trycloudflare.com/governance/health \
  -H "X-Governance-Key: v19-e5d585e28439decc614f09f91c4caa8c"

Technical Analysis

A reusable governance key is published in plaintext and demonstrated as an authentication header. Any person who can access the skill documentation can copy and replay the credential. A shared public key cannot establish caller identity and does not provide meaningful accountability or tenant separation.

Although the document labels the key as intended for public testing, embedding a live reusable credential remains an insecure configuration practice. If the key is accepted by additional endpoints, receives expanded permissions later, or shares quotas with other users, it may enable unauthorized operations or service abuse beyond the health check shown in the example.

Attack Path

  1. An attacker obtains the public SKILL.md file.
  2. The attacker extracts the plaintext governance key.
  3. The attacker sends requests containing the copied X-Governance-Key header.
  4. The remote service treats those requests as authenticated under the shared identity.
  5. The attacker consumes shared quotas, obscures attribution, or accesses any endpoint that accepts the same key and lacks additional authorization controls.

Impact Assessment

The key does not grant demonstrated local privileges. The confirmed scope is impersonation of the shared remote API identity. Potential consequences include unauthorized API consumption, quota exhaustion, rate-limit interference, misleading audit records, and access to other API functionality if authorization is insufficiently scoped. Because no server implementation is available, the full permissions associated with the key ...[truncated 19 chars]

Remediation
View remediation

Remediation Suggestions

  • Revoke and rotate the published credential.
  • Remove all live credentials from documentation and repository history.
  • Use clearly invalid placeholders in examples, such as YOUR_API_KEY.
  • Issue a unique, revocable credential to each user or agent through an authenticated enrollment process.
  • Scope credentials to the minimum required endpoints and operations.
  • Separate health checks from authenticated functionality; a basic health endpoint should not require a shared secret if it contains no sensitive information.
  • Store credentials in an environment variable or dedicated secret manager rather than in project files.
  • Implement credential expiration, rotation, rate limits, anomaly detection, and per-client audit logging.
  • Verify authorization independently on every API endpoint instead of treating possession of a shared header value as sufficient authority.

other

Note
Location
SKILL.md:136
Finding

Agent identifiers are disclosed through unnecessary remote registration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 136-140
Vulnerability Type: External Identity Disclosure
Risk Level: Low

Evidence

bash
curl -s -X POST https://boat-atlas-spa-flexible.trycloudflare.com/governance/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name":"your agent name"}'

Technical Analysis

The documented registration process submits an agent name to the same unverifiable remote service. Registration and identity collection are not inherently necessary for the advertised graph algorithms, which can operate locally without identifying the calling agent.

The documentation does not explain why the identifier is collected, whether registration is mandatory, how long the identifier is retained, or whether it is correlated with later graph submissions. An operator could use the identifier, source metadata, and subsequently issued credentials to build a persistent profile of an agent's activity.

Attack Path

  1. A user follows the self-registration instructions.
  2. The user submits a real or otherwise identifying agent name.
  3. The remote service stores the supplied identifier together with request metadata.
  4. The service associates a resulting account or credential with subsequent graph submissions.
  5. The operator or a party with access to the records correlates the agent identity with its workflows and activity over time.

Impact Assessment

This issue does not grant system privileges. Its scope is privacy and metadata confidentiality. It may expose an agent's identity and permit correlation of that identity with later requests, submitted graphs, network metadata, and usage patterns. The practical impact depends on whether users provide identifying names and on the undisclosed retention and correlation practices of the service.

Remediation
View remediation

Remediation Suggestions

  • Remove registration if it is not required for the graph-analysis function.
  • Make remote registration explicitly optional and explain this before collecting any identifier.
  • Permit pseudonymous, randomly generated client identifiers rather than requesting an agent name.
  • Collect only the minimum metadata necessary to provide the service.
  • Publish the purpose, lawful basis, retention duration, deletion procedure, and correlation behavior for registration data.
  • Do not associate registration identities with submitted graph content unless strictly necessary and explicitly authorized.
  • Provide users with mechanisms to inspect, rotate, and delete their registration records.
  • Prefer local processing so neither agent identity nor graph content needs to be disclosed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is described as a causal-graph debugging utility, but it directs users to submit graph data to an externally hosted service, plus additional registration and health-check endpoints. This expands the skill from local analysis into remote data transmission and service interaction without necessity, creating risks of data exfiltration, unreviewed third-party processing, and dependency on an untrusted endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented API call sends user-supplied graph contents to a third-party endpoint but provides no privacy notice, consent guidance, or description of how submitted data is stored, processed, or shared. Because causal graphs may encode sensitive decision logic, operational relationships, or internal workflows, silent transmission can expose confidential information.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The skill explicitly instructs users to POST graph data to an external URL, which constitutes external transmission of potentially sensitive content. In context, this is more dangerous because the skill's nominal purpose is graph debugging, which could reasonably be implemented locally, so the network transmission is not obviously necessary and may surprise users.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash
# 提交因果图谱进行调试
curl -s -X POST https://boat-atlas-spa-flexible.trycloudflare.com/governance/causal-path-graph \
  -H "Content-Type: application/json" \
  -H "X-Governance-Key: <你的专属密钥>" \
  -d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Publishing a public access key in skill documentation encourages reuse of a shared credential and normalizes embedding access-control material directly in the skill. Even if the key is intended for demo use, it can be abused for unauthorized access, quota exhaustion, traffic attribution confusion, or as a foothold to interact with the external service outside the skill's stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation promotes use of a public API key without warning users that it is shared, potentially monitored, rate-limited, or inappropriate for production or sensitive data. This can lead users to treat the key as trustworthy and private when it is neither, exposing their requests and creating avoidable operational and security risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language content of the skill is fully Chinese, including description and usage guidance, with no indication that the language is intentional, optional, or region-specific. This can violate language-choice expectations because users are not offered an alternative language or opt-in.

Content

No source excerpt is available for this finding.