ClawHub
Back to skill

Security audit

Prompt Gen Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill discloses paid SkillPay use, but it ships broken executable code, an exposed payment API key, and underdocumented external sharing of user identifiers.

Review this before installing. The skill is intended to generate image prompts and charges per call, but it contains a hard-coded payment API key, sends the provided user_id to SkillPay, and currently cannot run because of a Python indentation error. Do not use it with personal identifiers as user_id, and the publisher should remove the exposed key, document the billing data flow, and fail closed when payment cannot be verified.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
handler.py:11
Finding

Hard-Coded SkillPay API Credential Exposed in Source and Documentation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
handler.py:39
Finding

Billing Exceptions Fail Open and Grant Paid Functionality

Content
View full analysis
dict: """Charge user via SkillPay""" try: payload = { "api_key": SKILLPAY_API_KEY, "user_id": user_id, "amount": PRICE_USDT, "skill_id": SKILL_ID, "currency": "USDT", "description": "AI prompt generation" } headers = {"Content-Type": "application/json", "X-API-Key": SKILLPAY_API_KEY} response = requests.post(f"{SKILLPAY_API_URL}/charge", json=payload, headers=headers, timeout=10) if response.status_code == 200: return {"success": True, "data": response.json()} return {"success": False, "error": response.text} except Exception as e: return {"success": True, "demo": True, "error": str(e)} ``` The result is trusted by the payment gate in `handler.py:108-120`: ```python charge_result = charge_user(user_id) if not charge_result.get("success") and not charge_result.get("demo"): return { "payment_required": True, "amount": PRICE_USDT, "skill_id": SKILL_ID, "payment_url": charge_result.get("payment_url", "https://skillpay.me") } result = generate_prompt(subject) result["payment_status"] = "free_demo" if charge_result.get("demo") else "paid" return result ``` ### Technical Analysis The broad exception handler converts every billing exception into: ```python {"success": True, "demo": True, ...} ``` This conflates billing failure with successful authorization. Programming defects, DNS failures, connection errors, timeouts, TLS errors, malformed responses, and missing configuration therefore grant access instead of denying it. The subsequent condition accepts either `success` or `demo`. Because the exception path sets both `success=True ...[truncated 1233 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
handler.py:44
Finding

Undefined SKILL_ID Causes Predictable Billing Bypass

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
handler.py:41
Finding

Indentation Error Prevents the Skill from Executing

Content
View full analysis
Remediation
View remediation

other

Note
Location
handler.py:41
Finding

User Identifiers Are Disclosed to an External Billing Service Without Adequate Privacy Documentation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill is presented as an AI art prompt generator, but it contains billing and outbound payment functionality that is unrelated to the core prompt-generation task. In agent ecosystems, hidden monetization or charging behavior is dangerous because it can trigger unauthorized transactions, create financial risk, and expand the attack surface through external API calls and embedded payment credentials.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The exception path in charge_user returns success=True with demo=True even when charging fails, which causes the rest of the flow to proceed as though charging was acceptable. This creates inconsistent billing behavior, can bypass monetization controls, and makes failures indistinguishable from legitimate free access, undermining auditability and policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code sends user_id to an external billing service without any visible disclosure, consent flow, or minimization. Even if user_id is not highly sensitive by itself, transmitting identifiers to third parties without transparency creates privacy and compliance risks and may enable cross-service tracking.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code performs an outbound POST request to an external service from within a skill that appears to only generate local text prompts. In this context, the transmission is more dangerous because it is not necessary for core functionality, sends user-related data off-platform, and uses embedded credentials to interact with a remote billing endpoint.

Content

Scanner excerpt · handler.py (reported line 51)May include surrounding context.

python
"description": "AI prompt generation"
        }
            headers = {"Content-Type": "application/json", "X-API-Key": SKILLPAY_API_KEY}
        response = requests.post(f"{SKILLPAY_API_URL}/charge", json=payload, headers=headers, timeout=10)
        if response.status_code == 200:
            return {"success": True, "data": response.json()}
        return {"success": False, "error": response.text}

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
handler.py:12

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:24