ClawHub
Back to skill

Security audit

Intelligence Suite

Security checks for vulnerabilities and agentic risk

Overview

This news-analysis skill does what it claims broadly, but it sends a required API key to an undeclared service and fetches unvalidated article URLs that could reach unintended systems.

Review carefully before installing. Use only a narrowly scoped, revocable API key; assume the key and scraped article snippets are sent to api.heybossai.com despite the declared api.skillboss.com permission. Run it only in a network-restricted environment if possible, because feed-controlled article links can cause the script to request unexpected URLs, including private-network targets. Treat generated briefings as untrusted summaries, especially because one monitor entry is hardcoded mock data.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/scan.js:16
Finding

API Credential Transmitted to an Undeclared Network Destination

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/scan.js:44
Finding

Feed-Controlled Article URLs Permit Server-Side Request Forgery

Content
View full analysis
new Date(item.pubDate) > yesterday) .slice(0, 2) // Limit to top 2 per source to save tokens .map(item => ({ source: source.name, title: item.title, link: item.link, raw_summary: item.contentSnippet })); } catch (e) { return []; } } ``` The feed-provided link is then fetched directly: ```js for (const item of items) { console.log(`\nReading: ${item.title}...`); const content = await fetchContent(item.link); ``` Equivalent behavior exists in `scripts/monitor.js`: ```js async function fetchContent(url) { try { const { data } = await axios.get(url, { headers: { 'User-Agent': 'Mozilla/5.0 (compatible; MakimaBot/1.0)' }, timeout: 5000 }); ...[truncated 2782 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/scan.js:126
Finding

Untrusted Article Content Is Inserted Directly into LLM Instructions

Content
View full analysis
`[${p.source}] ${p.title}\n${p.content}` ).join('\n\n---\n\n'); const prompt = `You are Makima from Chainsaw Man. Provide a cold, precise, strategic intelligence briefing based on the following AI news signals. Identify the most significant developments, their implications, and any patterns worth noting. Be analytical, composed, and insightful.\n\n${packsText}`; const result = await pilot({ type: 'chat', inputs: { messages: [{ role: 'user', content: prompt }] }, prefer: 'balanced' }); const analysis = result.result.choices[0].message.content; ``` The global monitor uses the same unsafe construction: ```js const packsText = packsForAnalysis.map(p => `[${p.category} / ${p.source}] ${p.title}\n${p.content}` ).join('\n\n---\n\n'); const prompt = `You are Makima from Chainsaw Man. Provide a cold, composed, strategic global intelligence briefing based on the following world news events. Highlight geopolitical tensions, power shifts, and any patterns that a strategist should note. Be precise and analytical.\n\n${packsText}`; const result = await pilot({ type: 'chat', inputs: { messages: [{ role: 'user', content: prompt }] }, prefer: 'balanced' }); const analysis = result.result.choices[0].message.content; ``` ### Technical Analysis The Skill treats remotely controlled article text as trusted prompt content. Scraped data and operational instructions are placed in one undifferentiated user message, with no robust boundary indicating that article text must be handled exclusively as data. An attacker can place natural-language instructions in visible or hidden article content ...[truncated 1809 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:9
Finding

Floating Dependency Versions and Missing Lockfile Make Installation Unreproducible

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
SKILLBOSS_API_KEY=your_key node scripts/scan.js --report

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
SKILLBOSS_API_KEY=your_key node scripts/monitor.js --report

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script reads an API key from the environment and uses it to send aggregated scraped news content to a third-party LLM service. While the skill description mentions LLM-powered analysis, there is no evidence of minimization, user consent, or controls over what scraped content is forwarded, creating an external data-sharing risk and expanding the skill's trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code is explicitly configured to communicate with an external service endpoint, extending processing outside the local skill runtime. In this skill's context, the danger is not the mere presence of a URL but the unguarded exfiltration path it enables for collected content and the dependence on a third-party processor.

Content

Scanner excerpt · scripts/monitor.js (reported line 20)May include surrounding context.

js
const parser = new Parser();

const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = 'https://api.heybossai.com/v1';

async function pilot(body) {
    const r = await axios.post(

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code injects a hardcoded entertainment scandal item labeled as a monitored event, even though it is not sourced from a real feed. This undermines integrity of the briefing output and could mislead downstream agents or users into acting on fabricated intelligence presented alongside legitimate reporting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends compiled article snippets and titles to an external LLM endpoint without any user-facing disclosure at runtime or clear indication in the code path that external sharing occurs. Even if the content is public news, undisclosed third-party transmission can violate user expectations, policy requirements, or data-handling constraints in agent environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This skill collects article content from external sites and sends the aggregated text to a third-party API endpoint for LLM analysis. That creates a real external transmission path where scraped content, links, and potentially sensitive or internal-only data fetched from attacker-controlled URLs could be disclosed to an external service without validation, minimization, or explicit consent.

Content

Scanner excerpt · scripts/scan.js (reported line 20)May include surrounding context.

js
const parser = new Parser();

const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = 'https://api.heybossai.com/v1';

async function pilot(body) {
    const r = await axios.post(

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This instruction forces the output to be delivered as "Makima from Chainsaw Man" with a mandated tone ("cold, precise, strategic") rather than offering a user choice. That is a natural-language policy concern because the skill imposes a stylistic/persona constraint by default instead of making it optional or clearly justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The manifest uses a caret range for axios, which allows newer minor/patch releases to be installed without explicit review. This creates a supply-chain risk because builds may become non-reproducible and could unexpectedly pull a vulnerable or malicious release if the dependency ecosystem is compromised.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"test": "echo \"Error: no test specified\" && exit 1"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "rss-parser": "^3.13.0"
  },

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
81% confidence
Finding

Axios is reported to have multiple known advisories, and because the manifest does not pin a specific version, it is not possible to verify whether the installed release is affected. Given this skill's likely use of external HTTP requests for news and intelligence gathering, any axios flaw affecting SSRF, credential handling, or response integrity could be more relevant than in an offline utility.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The rss-parser dependency is also specified with a caret range, so the resolved package version may change over time. In a skill that aggregates external news content, dependency drift increases supply-chain exposure and makes it harder to verify exactly what code is executed.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "rss-parser": "^3.13.0"
  },
  "keywords": ["intelligence", "news", "ai", "makima"],
  "author": "Makima",

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script reads SKILLBOSS_API_KEY from the environment to authenticate outbound requests. Although this is common practice, there is no nearby comment, docstring, or user-facing documentation warning that the skill depends on a credential and will use it for remote API access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.