T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:24- Finding
Mutable External Setup Instructions Can Influence Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
embedding-api
Security checks for vulnerabilities and agentic risk
Overview
This embedding skill is mostly documentation, but it points agents to mutable remote setup instructions and advertises broad non-embedding API access beyond its stated purpose.
Review before installing. Use this only if you are comfortable sending embedding inputs to SkillBoss with your API key, and avoid sensitive text unless you have checked SkillBoss's data handling terms. Prefer pinned or ClawHub-reviewed installation paths over the remote setup document or unpinned git clone, and treat the skill as a broad SkillBoss API gateway rather than an embedding-only integration.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:14- Finding
Manual Installation Uses an Unpinned Remote Repository
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises scraping, social data, web search, image, and video access within an embedding-branded package, which is a significant capability expansion unrelated to the declared purpose. In agent environments, this can cause overbroad trust, accidental invocation of sensitive external services, and unintended transmission or collection of data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation text 'USE THIS when the user needs embedding api' is overly broad and lacks boundaries on when not to use the skill. In an autonomous agent context, vague triggers can cause unnecessary third-party calls and send user prompts externally even when a local or safer option would suffice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill omits clear warning that prompts and authentication tokens are sent to a third-party API during setup, testing, and normal use. Without transparent disclosure, users and agents may expose sensitive text, metadata, or credentials to an external provider without informed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is marketed as an embedding API, but it expands setup and usage into a broad multi-API gateway covering unrelated capabilities. This weakens least-privilege expectations and can mislead agents or users into authorizing a tool with much broader downstream access than its stated purpose suggests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
This finding flags the endpoint URL itself in the curl example. The URL alone is not dangerous, but it contributes to an externally connected workflow that should be treated as a real data egress path requiring disclosure and scope controls.
- Content
Quick Test
bash curl -X POST "https://api.skillboss.co/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
This finding flags the endpoint URL itself in the curl example. The URL alone is not dangerous, but it contributes to an externally connected workflow that should be treated as a real data egress path requiring disclosure and scope controls.
- Content
Quick Test
bash curl -X POST "https://api.skillboss.co/v1/run" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This finding duplicates the same Python external transmission behavior: a third-party HTTPS request with authorization and prompt data. While not inherently malicious, it becomes security-relevant because the surrounding skill under-discloses third-party data handling and presents broader-than-expected capabilities.
- Content
python import requests response = requests.post( "https://api.skillboss.co/v1/run", headers={"Authorization": "Bearer $SKILLBOSS_API_KEY"}, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This finding duplicates the same Python external transmission behavior: a third-party HTTPS request with authorization and prompt data. While not inherently malicious, it becomes security-relevant because the surrounding skill under-discloses third-party data handling and presents broader-than-expected capabilities.
- Content
python import requests response = requests.post( "https://api.skillboss.co/v1/run", headers={"Authorization": "Bearer $SKILLBOSS_API_KEY"}, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
This finding flags the endpoint URL in the Python sample. The presence of a third-party endpoint is expected for an API skill, but still indicates a real external transmission path that matters in agent contexts where users may not expect off-platform processing.
- Content
md import requests response = requests.post( "https://api.skillboss.co/v1/run", headers={"Authorization": "Bearer $SKILLBOSS_API_KEY"}, json={ "model": "openai/text-embedding-3-large",
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The 'When To Use This Skill' section provides permissive trigger examples but no exclusions, safety checks, or user-consent requirements. This can lead agents to route broad classes of requests through a third-party service without confirming necessity, privacy expectations, or whether the user intended external processing.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
The API reference documents a third-party POST endpoint authenticated by bearer token, confirming that normal operation sends content and credentials externally. The issue is not the existence of the endpoint itself, but the lack of sufficient user warning and the mismatch between narrow branding and broad reachable capabilities.
- Content
Endpoint
text POST https://api.skillboss.co/v1/run Authorization: Bearer $SKILLBOSS_API_KEY
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The agent instructions recommend chat and reasoning models that are unrelated to embeddings, despite the skill being presented as embedding-focused. This creates scope confusion and may cause an agent to invoke non-embedding services, broadening data exposure and behavior beyond what a user intended.
- Content
Static analysis
No suspicious patterns detected.