ClawHub
Back to skill

Security audit

Api Gateway

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent API gateway, but it gives broad arbitrary outbound API and credentialed request capability without enough scoping or secret-handling guidance.

Install only if you trust the operators and host controls around this skill. Treat every configured API call as sending data to a third party, avoid passing secrets or sensitive user content in direct requests, prefer least-privilege tokens and header-based auth where supported, and make sure logs redact credentials and sensitive payloads.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill is explicitly designed to connect to arbitrary external APIs, send requests, and expose logs, but it provides no guardrails about what data may be transmitted externally or what sensitive values may appear in request/response logs. In an agent context, this can lead to unreviewed exfiltration of prompts, user data, headers, tokens, or response bodies to third parties or into local logs.

External Transmission

Medium
Category
Data Exfiltration
Content
```
# Agregar nueva API
api add weather
  --base:https://api.openweathermap.org/data/2.5
  --auth:query:appid:$WEATHER_API_KEY

# Agregar endpoint
Confidence
88% confidence
Finding
This example instructs the skill to send requests to an external service and includes API-key authentication via query parameter, which causes data and credentials to leave the local environment. In a gateway skill, that behavior is expected, but without consent, validation, and safe-secret guidance it creates real risk of third-party data exposure and credential leakage.

External Transmission

Medium
Category
Data Exfiltration
Content
api call weather current --q:"Mexico City" --units:metric

# Llamada directa con URL
api get https://api.example.com/data

# POST con body
api post https://api.example.com/create --body:'{"name":"test"}'
Confidence
90% confidence
Finding
The direct `api get` example enables arbitrary outbound HTTP requests to user-specified domains, which can be abused to exfiltrate data or reach untrusted services. In an agent environment, unrestricted external fetch capabilities are dangerous because prompts, parameters, or connected data sources may be forwarded outside trust boundaries.

External Transmission

Medium
Category
Data Exfiltration
Content
api get https://api.example.com/data

# POST con body
api post https://api.example.com/create --body:'{"name":"test"}'
```

### Gestión
Confidence
92% confidence
Finding
The direct `api post` example is more dangerous than a simple GET because it encourages sending arbitrary request bodies to external services, which could include sensitive user content, internal data, or agent context. Without validation, approval, or redaction, this creates a straightforward path for data exfiltration to attacker-controlled endpoints.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples normalize use of environment-backed secrets and multiple third-party tokens without any discussion of secret storage, redaction, least privilege, or preventing accidental disclosure through logs or query strings. This is especially risky because the skill also supports logging and direct API calls, increasing the chance that credentials are mishandled or leaked to external services.

External Transmission

Medium
Category
Data Exfiltration
Content
```yaml
# apis/weather.yaml
name: weather
base_url: https://api.openweathermap.org/data/2.5
auth:
  type: query
  param: appid
Confidence
86% confidence
Finding
The YAML configuration defines a third-party base URL and credentialed API access, confirming that the skill operationalizes outbound transmission to external services. While this is core functionality, the absence of accompanying restrictions, consent, and secret-handling protections makes the transmission capability a genuine security concern in practice.

Static analysis

No suspicious patterns detected.