ClawHub
Back to skill

Security audit

admapix

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AdMapix analytics skill, with the main considerations being third-party API sharing, broad triggers, and unpinned install instructions.

Install only if you are comfortable sending ad/app intelligence queries and targets to AdMapix using your API key. Prefer a pinned or organization-approved installer command where possible, and avoid using the skill for private, confidential, or unrelated business data unless that sharing is acceptable.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:20
Finding

Unpinned npm Package Execution During Installation

Content
View full analysis
Remediation
View remediation
install admapix ``` 2. Document the exact package version that was tested with this Skill and update it only after security review. 3. Publish and verify package provenance, signatures, or expected integrity hashes where supported. 4. Prefer a reproducible, lockfile-backed installation process instead of resolving a mutable latest release. 5. Use an organization-controlled registry or allowlist when installation occurs in managed environments. 6. Run installation under a non-privileged account with access limited to the files and credentials required for installation. 7. Apply the corrected command consistently in both `README.md` and `README_CN.md`. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md
**Reuse data:** If the user asks follow-up questions about already-fetched data, analyze existing results first. Only make new API calls when needed.

## Output Guidelines

1. **Language consistency** — ALL output (headers, labels, insights, hints, errors, disclaimers) must match the user's detected language. See "Language Handling" section above.
2. **Route-appropriate output** — Don't force H5 links on analytical questions; don't dump tables for browsing

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run npx clawhub install admapix without pinning a specific package version. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if the package is later compromised, typosquatted, or updated with malicious code. Because npx executes code during installation/use, the risk is real even though it appears only in documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The installation command uses npx clawhub without pinning an exact package version, so users may execute whatever version is current at install time. If the upstream package, dependency chain, or publication account is compromised, this can lead to execution of attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list contains many broad, common phrases such as 'market analysis', 'revenue', 'search ads', and 'competitor analysis' that can match ordinary user conversation outside the intended domain. This can cause over-invocation of the skill, unintentionally sending user prompts to the external AdMapix service when the user did not mean to use this integration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill is designed to transmit user-supplied search terms and analysis targets to an external API endpoint at api.admapix.com, authenticated with an API key. While this is core functionality, it is still a real data egress path: accidental activation or sensitive user input could be sent to a third party without sufficient minimization or consent.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $SKILLBOSS_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill is designed to transmit user-supplied search terms and analysis targets to an external API endpoint at api.admapix.com, authenticated with an API key. While this is core functionality, it is still a real data egress path: accidental activation or sensitive user input could be sent to a third party without sufficient minimization or consent.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $SKILLBOSS_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
-H "X-API-Key: $SKILLBOSS_API_KEY"

# POST
curl -s -X POST "https://api.admapix.com/api/data/{endpoint}" \
  -H "X-API-Key: $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{...}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly defines a delivery object containing externalUserId for H5 page generation context, but provides no privacy notice, purpose limitation, minimization guidance, or handling requirements. This creates a real risk that integrators will transmit stable user identifiers to a third-party API unnecessarily or without consent, increasing privacy, compliance, and data-sharing exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 122)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 139)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 177)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 191)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 192)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 193)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 194)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The workflow examples and labels prominently prescribe Chinese-language phrasing such as user queries and presentation terms, but the document does not state that Chinese is optional or region-specific. This can violate language/locale policy because it nudges the skill toward a fixed language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file instructs consumers to extract query.country_info.country_name specifically as a Chinese country name and gives examples with Chinese-formatted values such as "116亿". This imposes a locale-specific representation in the skill documentation without indicating user opt-in or an alternative language/locale path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The file is presented bilingually, but many labels and endpoint semantics are anchored to Chinese-language field labels and examples throughout the document without stating whether language is configurable or region-specific. This can be a locale-policy concern if the skill effectively assumes Chinese output or interaction without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file includes bilingual headings and example prompts, which implicitly imposes specific languages without documenting whether the skill supports user language preference or is intended for a Chinese/English audience only. Under the language/locale policy rule, this is a natural-language policy concern because no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The title presents both English and Chinese, and later sections continue using Chinese labels and example locale values. This can impose a language/locale expectation on users without an explicit opt-in or justification, which matches the language/locale policy category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Across multiple sections, the tables are structured only as 'User says (EN)' and 'User says (CN)', which implies the skill recognizes or expects only those languages. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy concern unless the restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.