ClawHub
Back to skill

Security audit

Pub Clawddocs

Security checks for vulnerabilities and agentic risk

Overview

This is not clearly malicious, but a docs-branded skill gives broad authenticated API instructions, including email/SMS sending and sensitive uploads, without enough user-control or privacy guidance.

Review this before installing if you expected a read-only documentation helper. Use it only with a limited SKILLBOSS_API_KEY, avoid sending secrets or private documents/media/audio, and require explicit user approval before any email, SMS, document upload, media upload, or file download command is run.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:75
Finding

Unvalidated Remote Response URL Download

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
chat-models.md:31
Finding

Unqualified and Unbundled run.mjs Helper Can Be Spoofed Through PATH

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (35)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Including email and SMS verification/sending capabilities inside a documentation-focused skill creates unjustified outbound communication capability. If invoked by an agent or user expecting read-only documentation help, this can be abused for spam, phishing, unwanted OTP workflows, or unauthorized contact with third parties.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is presented as a narrow 'documentation expert' but actually exposes a broad general-purpose API broker with chat, media generation, search, document parsing, email, and SMS features. This scope mismatch is dangerous because users and orchestrators may grant trust or invoke the skill under false assumptions, enabling unexpected external actions and data flows far beyond documentation lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill repeatedly instructs sending prompts, documents, audio, phone numbers, and other content to an external aggregator service and downstream providers, but it does not warn users about these transmissions. This omission can lead to inadvertent disclosure of sensitive user data, credentials, documents, or communications metadata to third parties.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The base URL and authentication guidance establish that the skill is designed around remote API use with bearer credentials. This is not inherently malicious, but in context it signals broad third-party data transmission and credential use that are under-disclosed for a skill advertised as documentation-focused.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This models-listing call reaches an external API with authentication, exposing usage metadata and relying on third-party network access. The risk is contextual: it contributes to a broad live-integration surface hidden behind a docs-oriented label.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This models-listing call reaches an external API with authentication, exposing usage metadata and relying on third-party network access. The risk is contextual: it contributes to a broad live-integration surface hidden behind a docs-oriented label.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This filtered model query is another authenticated external request. While routine, it still expands the live network surface of a skill that is described too narrowly, creating potential for unexpected data egress and trust confusion.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Filter by type:

bash
curl -s "https://api.heybossai.com/v1/models?types=image" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Fetching full docs for specific models involves external API interaction and may reveal model interests or planned usage. In isolation this is mild, but combined with the misleading skill identity it contributes to an under-disclosed third-party integration risk.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Get full docs for specific models:

bash
curl -s "https://api.heybossai.com/v1/models?ids=mm/img,bedrock/claude-4-5-sonnet" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The chat completion example transmits message content to an external service and likely onward to downstream providers. This can expose sensitive prompts or conversational data, and the lack of strong warnings makes the risk more significant in this context.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Chat

bash
curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The media-generation sections add image, video, audio, and background-removal capabilities that are unrelated to a documentation expert role. This broadens the attack surface and increases the chance that user prompts, files, or URLs are sent to external services unexpectedly under a misleading skill identity.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This generation request sends prompt content to an external endpoint and may incur downstream provider processing. Because the skill is not transparently marketed as a generation/integration skill, the external transmission is more dangerous than a typical API example.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This generation request sends prompt content to an external endpoint and may incur downstream provider processing. Because the skill is not transparently marketed as a generation/integration skill, the external transmission is more dangerous than a typical API example.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This example both performs an external API call and fetches a returned URL to save content locally. That combines remote transmission with follow-on retrieval from a possibly different host, increasing risk of unexpected downloads, local file creation, and handling of untrusted remote content.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Save to file:

bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The video generation request sends prompt data externally for processing. In this skill, such non-docs capability broadening makes the transmission more problematic because it may bypass user expectations about what the skill will do.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The video generation request sends prompt data externally for processing. In this skill, such non-docs capability broadening makes the transmission more problematic because it may bypass user expectations about what the skill will do.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The image-to-video example sends both prompt text and an image URL to an external service, which may expose sensitive media or internal resources referenced by URL. This is a meaningful data-egress concern, especially given the mismatch between declared purpose and actual behavior.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Image-to-video:

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The TTS request transmits user text to a remote provider chain for synthesis. Sensitive text may be exposed, and the transmission is insufficiently disclosed for a skill that users may assume is primarily informational/documentary.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The TTS request transmits user text to a remote provider chain for synthesis. Sensitive text may be exposed, and the transmission is insufficiently disclosed for a skill that users may assume is primarily informational/documentary.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Uploading audio data to a remote endpoint can disclose confidential speech, biometrics, or personal information. The risk is elevated because the skill's framing does not prepare users for high-sensitivity media upload to third parties.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Uploading audio data to a remote endpoint can disclose confidential speech, biometrics, or personal information. The risk is elevated because the skill's framing does not prepare users for high-sensitivity media upload to third parties.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The music-generation request sends user prompts externally and triggers creative model execution unrelated to documentation assistance. This broad capability increases data-sharing and cost exposure under a misleading trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Music Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This image-processing call transmits image inputs or references to an external service. That may reveal sensitive visuals or accessible URLs, which is not clearly signposted by the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This image-processing call transmits image inputs or references to an external service. That may reveal sensitive visuals or accessible URLs, which is not clearly signposted by the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The document-processing example uploads or references documents for remote parsing/extraction, potentially exposing sensitive files and their contents to a third party. For a docs-related skill this might seem more contextually plausible, but the absence of privacy warnings still makes it dangerous.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Document Processing

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

External web-search requests can disclose search intent and sensitive research topics to a third-party provider. Because this is part of a much broader hidden integration layer, users may not realize their queries are leaving the environment.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

Web Search

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.