ClawHub
Back to skill

Security audit

Github Bounty Finder

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal bounty-scanning CLI, but users should handle the required API tokens carefully.

Use least-privilege, revocable GitHub and Algora tokens; keep any .env file out of source control and rotate tokens if exposed. For stricter environments, ask the publisher for pinned dependency versions and a lockfile before installing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The command writes a GitHub token directly into a .env file from the shell, which may normalize insecure handling of credentials and increase risk of accidental disclosure. While not credential theft by itself, the documentation encourages storage of sensitive secrets in plaintext without safeguards, creating a realistic path to exposure.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

md
clawhub install github-bounty-finder

# Configure
echo "GITHUB_TOKEN=your_token" > .env
echo "ALGORA_API_KEY=your_key" >> .env

# Scan for bounties

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The Algora API key is written to a plaintext .env file with no warning about secure storage or repository exclusion. In the context of a developer tool likely used inside project directories, this raises the chance of committing or sharing active API credentials unintentionally.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
# Configure
echo "GITHUB_TOKEN=your_token" > .env
echo "ALGORA_API_KEY=your_key" >> .env

# Scan for bounties
github-bounty-finder scan

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
### Getting API Keys

1. **GitHub Token**: 
   - Go to GitHub Settings → Developer settings → Personal access tokens
   - Create a token with `public_repo` scope

2. **Algora API Key**:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/cli.js (reported line 99)May include surrounding context.

js
console.log(`   ALGORA_API_KEY: ${process.env.ALGORA_API_KEY ? chalk.green('✓ Set') : chalk.red('✗ Not set')}\n`);
    
    if (!process.env.GITHUB_TOKEN || !process.env.ALGORA_API_KEY) {
      console.log(chalk.yellow('📝 Create a .env file with:\n'));
      console.log('   GITHUB_TOKEN=your_github_token');
      console.log('   ALGORA_API_KEY=your_algora_api_key\n');
    }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · clawhub.json (reported line 85)May include surrounding context.

json
},
  "requirements": [
    "Node.js 18.0.0 or higher",
    "GitHub Personal Access Token (free)",
    "Algora API Key (free)"
  ],
  "changelog": [

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly instructs users to place long-lived API credentials into a local .env file but provides no guidance on secret hygiene such as adding .env to .gitignore, avoiding shell history leakage, or using a secure secret manager. This can lead to accidental credential exposure through source control, local backups, logs, or copied setup snippets, especially for less experienced users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description says the skill will "Scan Algora/GitHub for high-value bounties" but does not define specific trigger phrases, scope limits, or negative examples, which could make activation criteria overly broad in orchestration systems that rely on manifest text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest explicitly requires a GitHub Personal Access Token and Algora API key but provides no warning about how those credentials are handled, stored, or transmitted. In a network-scanning automation tool, that omission increases the risk of users supplying sensitive tokens without informed consent, especially if the skill later sends them to external services or logs them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/scanner.js (reported line 64)May include surrounding context.

js
try {
      // Algora API endpoint (adjust based on actual API)
      const response = await axios.get('https://api.algora.io/v1/bounties', {
        headers: {
          'Authorization': `Bearer ${this.algoraApiKey}`
        },

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The markdown instructs users to place a GitHub personal access token and an Algora API key in a .env file, but it does not include any caution about handling these secrets securely. Because credential storage and transmission can affect user privacy and account security, the skill description should disclose this risk and basic safe-handling expectations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range instead of an exact pinned version, so installs can drift to newer releases over time. This weakens build reproducibility and can unintentionally pull in vulnerable or malicious upstream updates, creating supply-chain risk even though the manifest itself is not directly exploitable.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"author": "OpenClaw Skills",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

Axios has multiple known advisories, and because the manifest does not pin a specific version, it is impossible to verify from this file whether the installed release is affected. In a scanner skill that likely makes outbound HTTP requests, a vulnerable HTTP client could enable SSRF-related bypasses, header mishandling, or other request/response security issues depending on usage.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using a non-exact version for chalk allows future compatible releases to be installed implicitly. In a CLI skill that depends on third-party npm packages, this increases supply-chain exposure and makes the runtime contents less predictable.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"

Unverifiable Dependency: chalk has 1 known advisory(ies) (MAL-2025-46969 (Malicious code in chalk (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
62% confidence
Finding

A known advisory exists for chalk, and the unpinned manifest prevents confirming whether the resolved version is safe. Because chalk is typically used only for terminal formatting, the practical exploitability in this skill is lower, but it still represents avoidable supply-chain uncertainty.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The commander dependency is not pinned to a single exact release, so different environments may resolve different package contents. This is a classic software supply-chain hygiene issue that can expose consumers to unreviewed upstream changes.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"dependencies": {
    "axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dotenv package is specified with a caret range, allowing automatic uptake of later patch/minor versions. While common in development, it still creates avoidable supply-chain and reproducibility risk for a distributed skill.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
"axios": "^1.6.0",
    "chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The node-fetch dependency is not pinned, which permits version drift and complicates verification against known advisories. For tooling that performs network access, dependency integrity matters because compromised libraries can directly affect outbound requests and data handling.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json
"chalk": "^4.1.2",
    "commander": "^11.1.0",
    "dotenv": "^16.3.1",
    "node-fetch": "^2.7.0"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: node-fetch has 3 known advisory(ies) (CVE-2022-0235 (node-fetch forwards secure headers to untrusted sites); CVE-2022-2596 (node-fetch Inefficient Regular Expression Complexity ); CVE-2020-15168 (The `size` option isn't honored after following a redirect in node-fetch)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

Node-fetch has multiple historical advisories, and the unpinned range means the actual installed version cannot be validated from the manifest alone. Since this skill appears to scan remote services, an affected fetch library could expose request metadata, mishandle redirects, or introduce denial-of-service risk through inefficient parsing behavior.

Content

No source excerpt is available for this finding.