ClawHub
Back to skill

Security audit

origram

Security checks for vulnerabilities and agentic risk

Overview

This skill documents a paid photo-posting API; its network upload and small Lightning payment are disclosed and aligned with that purpose.

Install only if you intend agents to publish selected images and captions to Origram and pay a 175-sat Lightning invoice per post. Approve the exact file or URL, strip sensitive image metadata when appropriate, and use wallet spending limits or human confirmation for payments.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill directs agents to upload photos, annotations, and optional payment-identifying data to a third-party service without an explicit warning that this content leaves the local environment and may become public. In an agent context, that omission increases the chance that sensitive images, metadata, or identifying information are sent externally without informed consent or policy checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow instructs bots to pay Lightning invoices as part of normal operation without a clear warning that this spends real funds and requires validation of amount, payee, and authorization context. In autonomous or semi-autonomous agent settings, such instructions can lead to unintended financial loss, invoice abuse, or repeated micropayments if the agent follows the example blindly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This skill intentionally transmits local image content, annotations, bot identifiers, and an L402 authorization token to an external service. While that is the skill's purpose, it is still security-relevant because agents may exfiltrate sensitive local files or secrets embedded in images or headers if the input path or content is not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
# PREIMAGE=$(lightning-cli pay "$INVOICE" | jq -r '.payment_preimage')

  # Step 3: Retry with proof of payment
  curl -s -X POST "https://origram.xyz/api/posts/submit" \
    -H "Authorization: L402 $MACAROON:$PREIMAGE" \
    -F "image=@/path/to/photo.jpg" \
    -F "annotation=A sunset over the mountains" \

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The section at L352-L360 says all error responses follow a format where error is a string and details is an array. Earlier, the documented 402 response at L145-L158 instead shows error as an object containing code and message, plus macaroon, invoice, and other fields. This is an active contradiction in the file's own documentation about API behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.