ClawHub
Back to skill

Security audit

Evalpal

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it can send the EvalPal API key to any configured API URL despite claiming HTTPS-only API use.

Review before installing. Use a dedicated, low-privilege EvalPal API key, leave EVALPAL_API_URL unset unless you control and trust the exact HTTPS endpoint, and avoid running sensitive or regulated evaluations unless your policy permits sending that data to EvalPal or the configured service. Rotate the API key if it may have been used with an untrusted endpoint.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check-status.sh:12
Finding

Unvalidated API base URL can disclose the EvalPal bearer credential

Content
View full analysis
/dev/null) || { echo "Error: Could not reach EvalPal API" >&2 exit 1 } ``` #### `scripts/run-eval.sh` ```sh API_URL="${EVALPAL_API_URL:-https://evalpal.dev}" ``` ```sh if [ -n "$_body" ]; then _response=$(curl -s -w "\n%{http_code}" -X "$_method" \ -H "Authorization: Bearer $EVALPAL_API_KEY" \ -H "Content-Type: application/json" \ -d "$_body" \ "${API_URL}${_path}" 2>/dev/null) || { echo "Error: Could not reach EvalPal API" >&2 exit 1 } else _response=$(curl -s -w "\n%{http_code}" -X "$_method" \ -H "Authorization: Bearer $EVALPAL_API_KEY" \ -H "Content-Type: application/json" \ "${API_URL}${_path}" 2>/dev/null) || { echo "Error: Could not reach EvalPal API" >&2 exit 1 } fi ``` #### `scripts/list-evals.sh` ```sh API_URL="${EVALPAL_API_URL:-https://evalpal.dev}" ``` ```sh _response=$(curl -s -w "\n%{http_code}" -X GET \ -H "Authorization: Bearer $EVALPAL_API_KEY" \ -H "Content-Type: application/json" \ "${API_URL}${_path}" 2>/dev/null) || { echo "Error: Could not reach EvalPal API" >&2 exit 1 } ``` ### Technical Analysis Authenticated network access is necessary for the Skill's declared EvalPal functionality. Sending `EVALPAL_API_KEY ...[truncated 2551 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code substantially matches the core declared purpose of triggering an EvalPal evaluation and checking results. However, the description also claims the skill can 'list available evaluations,' and this code chunk contains no functionality for listing eval definitions or available evaluations. No unrelated triggers or suspicious undeclared capabilities are present; the mismatch is specifically an overstatement of implemented functionality in the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README instructs users to run remote evaluations through the EvalPal API but does not clearly warn that prompts, test cases, outputs, and related metadata may be transmitted off-host over the network to a third-party service. In an agent skill context, this can cause unintentional disclosure of sensitive evaluation data or model outputs, especially when users assume commands are local or do not realize the scope of data sent to the external API.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises shell-based execution via bash scripts but does not declare any explicit tool scope such as permissions or allowed-tools. That creates a trust and containment gap: an agent or platform may permit broader shell access than users expect, increasing the chance of unintended command execution or misuse if the skill is invoked in a sensitive environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run-eval.sh (reported line 46)May include surrounding context.

sh
fi

# Check for required tools
for tool in curl jq; do
  if ! command -v "$tool" >/dev/null 2>&1; then
    echo "Error: '$tool' is required but not installed"
    exit 1

Static analysis

No suspicious patterns detected.