ClawHub
Back to skill

Security audit

AgentRef

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AgentRef REST API helper that can perform sensitive merchant actions only with an API key and repeated confirmation guardrails.

Install only if you intend to let an agent use your AgentRef account. Prefer a dedicated, least-privilege AGENTREF_API_KEY, start with read-only scopes for inspection, and grant write scopes only when you want confirmed changes to programs, affiliates, flags, or payouts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/endpoints.md (reported line 100)May include surrounding context.

md
- Important outputs: Updated program record
- Risks / write access: Write. This can change live program behavior, visibility, or payout rules. Read the program first and confirm the exact patch.

### DELETE /api/v1/programs/{id}

- Method: `DELETE`
- Path: `/api/v1/programs/{id}`

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/endpoints.md (reported line 78)May include surrounding context.

md
- Method: `POST`
- Path: `/api/v1/programs`
- Purpose: Create a new program.
- Important inputs: JSON body with `name`, `commissionType`, `commissionPercent`; optional `description`, `website`, `landingPageUrl`, `cookieDuration`, `payoutThreshold`, `payoutFrequency`, `autoApproveAffiliates`, `portalSlug`, `currency`; supports `Idempotency-Key`
- Important outputs: Created program record
- Risks / write access: Write. Creates a new program and should only happen with explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/endpoints.md (reported line 96)May include surrounding context.

md
- Method: `POST`
- Path: `/api/v1/programs`
- Purpose: Create a new program.
- Important inputs: JSON body with `name`, `commissionType`, `commissionPercent`; optional `description`, `website`, `landingPageUrl`, `cookieDuration`, `payoutThreshold`, `payoutFrequency`, `autoApproveAffiliates`, `portalSlug`, `currency`; supports `Idempotency-Key`
- Important outputs: Created program record
- Risks / write access: Write. Creates a new program and should only happen with explicit user confirmation.