ClawHub
Back to skill

Security audit

Agent Anchor

Security checks for vulnerabilities and agentic risk

Overview

This skill’s dashboard purpose is coherent, but it asks users to persist agent state and run an unauthenticated local web server without enough scoping or privacy safeguards.

Review this carefully before installing. Only use it if you can verify the external repository, keep any state files free of secrets or private personal data, and run the dashboard bound to localhost with appropriate file permissions. Do not expose port 3456 on a public or shared network.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:21
Finding
Unauthenticated Dashboard Server Exposed on All Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21-24 **Vulnerability Type**: Unauthenticated network exposure caused by unsafe server configuration **Risk Level**: Medium ### Vulnerable Code ```bash cd ~/workspace git clone <agent-anchor-repo> cd agent-anchor python3 -m http.server 3456 ``` ### Technical Analysis The documented command starts Python's built-in HTTP server without an explicit bind address. By default, `python3 -m http.server 3456` listens on all available network interfaces rather than only the loopback interface. The server also provides neither authentication nor transport encryption. It recursively serves files beneath the current `agent-anchor` directory and may expose directory listings. This is particularly relevant because the documentation states that the dashboard handles agent state, task information, contacts, activity history, and cron-job details. If those resources are stored beneath the served directory, any party capable of reaching TCP port 3456 may be able to retrieve them. The audited package contains only `SKILL.md`, so the presence and sensitivity of files in the unspecified external repository cannot be independently verified. The confirmed defect is therefore the unsafe server configuration in the installation instructions, while the exact exposed data depends on the contents of the repository fetched by the user. ### Attack Path 1. A user follows the documented installation procedure and clones the external dashboard repository. 2. The user runs `python3 -m http.server 3456` from the repository directory. 3. Python binds the server to all available network interfaces. 4. An attacker on the same network, or any network from which port 3456 is reachable, identifies the host and connects to `http://<host-address>:3456/`. 5. The attacker browses directory listings or directly requests predictable files such as state and configuration files. 6. Any sensitive files stored beneath the served dir ...[truncated 755 chars]
Remediation
<![CDATA[ ## Remediation Suggestions Bind the development server explicitly to the loopback interface: ```bash python3 -m http.server 3456 --bind 127.0.0.1 ``` Additionally: 1. Store agent state, contacts, task data, cron details, credentials, and other sensitive resources outside the web server's document root. 2. Do not rely on Python's development HTTP server when remote dashboard access is required. 3. For remote access, use a production server with authentication, authorization, TLS, restrictive network rules, and logging. 4. Disable directory listing and permit access only to explicitly required static assets. 5. Document firewall requirements and advise users not to expose port 3456 to public or untrusted networks. 6. Replace the unspecified repository placeholder with an immutable, verifiable source and review its contents before instructing users to serve it. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly advertises continuous state snapshots and persistence across crashes, but provides no warning about the sensitivity of the stored data or the privacy/security implications of retaining agent memory, task history, contacts, and activity records. In an agent context, this can lead users to persist sensitive operational or personal data without informed consent, increasing the risk of accidental disclosure if the state file is accessed, copied, or exposed by the local server.

Static analysis

No suspicious patterns detected.