ClawHub
Back to skill

Security audit

Run402 Test

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its Run402 database purpose, but it includes high-privilege database/payment workflows and an under-disclosed helper script that can use a local service key to run arbitrary admin SQL.

Review before installing. Use this only if you are comfortable creating paid Run402 resources, sending payment headers to Run402, and letting an agent handle database keys. Treat SERVICE_KEY as an admin secret, require explicit approval before provisioning or running SQL, and remove or avoid sql2.mjs if you do not want local Run402 credentials read from ~/.config/run402/projects.json.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to provision a paid external resource and perform privileged admin SQL actions, but it provides no warning that the action is billable and no guidance on protecting the returned service_key. Because the workflow includes creation of real infrastructure and exposure to sensitive credentials, an agent or user could unintentionally incur charges or mishandle high-privilege secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This command sends data and a payment credential to an external service to create infrastructure, which can trigger real-world financial impact and disclose sensitive operational metadata. In skill form, that is risky because an automated agent may execute it without sufficient user consent, cost awareness, or validation of where secrets are being sent.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Provision a Database

bash
curl -X POST https://api.run402.com/v1/projects \
  -H "Content-Type: application/json" \
  -H "X-402-Payment: <payment>" \
  -d '{"name": "my-db", "tier": "prototype"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This command sends data and a payment credential to an external service to create infrastructure, which can trigger real-world financial impact and disclose sensitive operational metadata. In skill form, that is risky because an automated agent may execute it without sufficient user consent, cost awareness, or validation of where secrets are being sent.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Provision a Database

bash
curl -X POST https://api.run402.com/v1/projects \
  -H "Content-Type: application/json" \
  -H "X-402-Payment: <payment>" \
  -d '{"name": "my-db", "tier": "prototype"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This command performs privileged admin SQL over an external API using a service_key bearer token, which is a high-sensitivity secret. If an agent exposes, stores, or misuses that token, an attacker could gain broad control over the database, modify schema/data, or cause destructive changes.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Create a Table

bash
curl -X POST https://api.run402.com/admin/v1/projects/$PROJECT_ID/sql \
  -H "Authorization: Bearer $SERVICE_KEY" \
  -H "Content-Type: text/plain" \
  -d "CREATE TABLE todos (id serial PRIMARY KEY, task text NOT NULL, done boolean DEFAULT false);"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Query via REST

bash
curl "https://api.run402.com/rest/v1/todos?done=eq.false" \
  -H "apikey: $ANON_KEY"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script reads a local service credential from the user's config directory and automatically sends it as a Bearer token in an outbound request, without any prompt, disclosure, or validation of user intent. Because the same script also accepts arbitrary SQL from command-line arguments and targets an admin endpoint, misuse or accidental execution could result in privileged database operations being performed with a high-value credential.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.