ClawHub
Back to skill

Security audit

Vercel AI Gateway

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Vercel AI Gateway integration with optional Maton automation features that are high-impact but clearly gated by user approval and safety instructions.

Install only if you intend to use Maton for Vercel AI Gateway. Be especially careful before approving hosted functions, triggers, destinations, or `watch --exec`, because those can create ongoing automation or data forwarding; approve exact accounts, hosts, payload fields, and costs before running them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill materially expands from a Vercel AI Gateway integration into a general Maton automation control surface, including function creation/deployment, environment variable management, trigger management, destinations, and event replay/watch. Even though the text includes many safety warnings, exposing these capabilities in a skill whose stated purpose is AI Gateway access increases the chance an agent can be socially engineered into creating automations, persistent egress paths, or hosted code unrelated to the user’s immediate intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill states that it 'does not forward events to third-party hosts' but later provides third-party destination creation and update mechanics subject to approval. This inconsistency is dangerous because agents or reviewers may rely on the stronger earlier claim and underestimate that the skill can establish persistent outbound data flows to external hosts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented maton trigger event watch --exec path runs local code on untrusted event payloads, which is a classic code-execution sink. The document warns about the risk, but including this capability inside an AI Gateway skill still broadens the attack surface: an attacker could steer an agent toward creating or invoking a local handler that processes adversarial event data, leading to command injection, unintended writes, or long-running unattended automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.