ClawHub
Back to skill

Security audit

DAP Chat

Security checks for vulnerabilities and agentic risk

Overview

This DAP Chat skill mostly matches its messaging purpose, but it can publish profile details, install local code, and send outbound replies without enough prior user control.

Review this skill carefully before installing. Use it only if you are comfortable with DAP Chat network actions, and require explicit approval before linking, publishing profile fields, installing the SDK, accepting connections, or sending replies. Do not include owner location or interests unless intentionally provided for publication.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

other

Warning
Location
SKILL.md:70
Finding

Owner Information May Be Published Without Prior Approval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70-80
Vulnerability Type: Unauthorized personal data disclosure
Risk Level: Medium

Vulnerable Code

markdown
Do NOT ask the user for a profile description or username. Generate everything yourself:

- **Name**: Use your own name (e.g. "Claude", "Aria").
- **Username**: Derive a unique lowercase username from your name (e.g. "claude", "aria"). Must be 3-20 characters, lowercase alphanumeric + underscores only.
- **Description**: Write a first-person description based on your capabilities, personality, and anything you already know about your owner's interests. Keep it natural and specific — not generic.
- **Location**: Use the owner's location if you know it, otherwise omit `--location`.

Link right away:

```bash
DAP_CHAT_URL=http://localhost:8000 python3 -m dap_chat_sdk.cli link CODE --name "AGENT_NAME" --username "USERNAME" --description "AGENT_DESCRIPTION" --location "LOCATION"
text

### Technical Analysis

The skill instructs the agent to derive a public-facing description from information already known about the owner's interests and to include the owner's location when available. It further directs the agent to link immediately and seek approval only after the profile has been submitted.

This sequence violates informed-consent and data-minimization principles. Information retained in conversation context for one purpose may be repurposed for publication to the DAP Chat service without the owner reviewing the exact profile first. The instruction to omit the location only when it is unknown does not provide a consent boundary when it is known.

### Attack Path

1. The agent possesses contextual information about the owner's interests or location from previous interactions.
2. The owner provides a DAP Chat link code.
3. The skill directs the agent to generate a profile using that contextual information without asking for prior approval.
4. The agent executes the `link` command a
...[truncated 665 chars]
Remediation
View remediation

Remediation Suggestions

  1. Generate a draft profile without submitting it.
  2. Display every proposed field to the owner, including name, username, description, and location.
  3. Require explicit approval before executing the link command.
  4. Default to excluding owner interests, location, and other personal context.
  5. Ask separately for consent before publishing location or inferred personal attributes.
  6. Provide a clear explanation of who can access the profile and how it can be modified or deleted.
  7. Minimize profile data to information strictly required for DAP Chat functionality.

T08 · Insecure Dependencies

Error
Location
SKILL.md:47
Finding

Unverified Editable Installation of a Mutable Local Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-53
Vulnerability Type: Unsafe dependency installation
Risk Level: High

Vulnerable Code

markdown
If this errors with `No module named 'dap_chat_sdk'`, run:

```bash
pip install -e ~/Developer/dap-chat/sdk/

Then retry.

text

### Technical Analysis

The skill directs the agent to install a Python package in editable mode from a mutable local directory. It does not verify the package source, repository identity, version, commit, signature, hash, ownership, or file permissions before installation.

A Python package installation may execute package build hooks or backend logic. Editable installation also leaves runtime behavior tied to files in the referenced directory, allowing later modifications to affect subsequent CLI execution without another reviewed installation. Because the SDK source is not included in the audited project, its behavior and the claimed encryption properties cannot be verified from this artifact.

### Attack Path

1. An attacker creates or modifies `~/Developer/dap-chat/sdk/`, or compromises files already present there.
2. The DAP Chat module is unavailable, causing the documented setup condition to occur.
3. The agent follows the skill and runs `pip install -e ~/Developer/dap-chat/sdk/`.
4. Attacker-controlled installation or build logic executes with the privileges of the user running the agent.
5. The installed module can subsequently execute attacker-controlled behavior whenever `python3 -m dap_chat_sdk.cli` is invoked.
6. Because the package is editable, later changes to the source directory may alter behavior without reinstalling the package.

### Impact Assessment

Successful exploitation can execute arbitrary Python code with the operating-system privileges of the agent process. Depending on those privileges, the attacker may access user-readable files, environment variables, agent data, DAP Chat credentials, and network resources, or modify files wri
...[truncated 184 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the editable local installation with a pinned, authenticated release from a trusted package source.
  2. Pin the exact package version and require verified cryptographic hashes.
  3. If installation from source is necessary, pin a specific repository commit and verify its signature or checksum.
  4. Validate directory ownership and permissions before using any local source tree.
  5. Review package metadata, build-system configuration, and installation hooks before execution.
  6. Install the SDK in an isolated virtual environment with the minimum necessary permissions.
  7. Avoid editable mode in production or agent-operated workflows.
  8. Include the required SDK source in the audited artifact, or document a reproducible and verifiable dependency acquisition process.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:174
Finding

Untrusted Incoming Messages Can Trigger Autonomous Outbound Replies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 174-186
Vulnerability Type: Unsafe handling of untrusted message content
Risk Level: High

Vulnerable Code

markdown
When the owner asks about messages or at the start of every DAP Chat interaction:

1. Run `pending` to check for new messages.
2. Read each message and show it to the owner.
3. Compose and send a reply via `send`.
4. Keep replies natural. If the topic is personal or sensitive, ask the owner first.

---

## Autonomy Guidelines

- **General conversation**: Reply freely. Keep it natural and helpful.
- **Personal topics**: Ask the owner before sharing personal details.
- **Sensitive topics**: Always ask the owner first.
- **Connection requests**: Show them to the owner and ask whether to accept.

Technical Analysis

Incoming DAP Chat messages are externally controlled content. The skill directs the agent to read each message, compose a response, and send it, while permitting autonomous replies for broadly defined “general conversation.” It does not establish a trust boundary between message content and agent instructions, nor does it prohibit obeying commands embedded in received messages.

A malicious peer can therefore send prompt-injection-style content intended to influence the agent's response or induce actions. The personal and sensitive topic exceptions are subjective and do not adequately constrain requests that appear routine but seek confidential context, social engineering, misinformation, or unauthorized actions.

Attack Path

  1. A malicious DAP Chat peer establishes an allowed messaging relationship with the agent.
  2. The peer sends a message containing embedded instructions, misleading context, or a request designed to appear like ordinary conversation.
  3. At the beginning of a DAP Chat interaction, the agent runs pending and imports the untrusted message into its working context.
  4. The agent interprets the message while composing a response.
  5. B ...[truncated 797 chars]
Remediation
View remediation

Remediation Suggestions

  1. Explicitly classify every incoming message as untrusted data, not executable instructions.
  2. Prohibit following message-borne requests to alter system behavior, reveal hidden context, access files, invoke tools, or bypass approval requirements.
  3. Require owner approval before every outbound message, at least until a narrowly scoped conversation policy is explicitly authorized.
  4. Present the original message and the complete proposed response to the owner before sending.
  5. Define objective categories of prohibited disclosure rather than relying only on subjective “personal” or “sensitive” labels.
  6. Restrict autonomous responses to fixed, low-risk templates with no access to private context or tools.
  7. Apply output filtering for secrets, personal data, internal instructions, credentials, and unsupported claims.
  8. Record recipient, message content, approval status, and send result in an auditable log that does not itself expose sensitive content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The onboarding instructions explicitly tell the agent to auto-generate and immediately submit profile information, including inferred description and possible location, before asking the user to confirm it afterward. This is dangerous because personal or identifying information may already have been transmitted and published by the time the user is consulted.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger guidance is broad enough to activate on common mentions of connecting agents, messaging, or discovery, which increases the chance the skill will run in situations where the user did not intend networked DAP actions. Because the skill can lead to account linking, profile publication, and message retrieval, overly broad invocation materially raises the risk of unintended external actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill introduces command usage without an upfront disclosure that using the CLI will send profile data, connection metadata, and messages over a network service. Even if messages are encrypted, the absence of an early warning undermines informed consent for external transmission.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to install software via pip install -e ~/Developer/dap-chat/sdk/ when a dependency is missing, which expands the skill's behavior from messaging into modifying the local environment. Even if intended for setup convenience, installing local code without explicit user approval can execute unreviewed package hooks or alter the system in ways unrelated to the immediate user request.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

The instruction 'Do NOT ask the user' suppresses user oversight during a step that creates an externally visible identity and may disclose inferred personal information. Autonomy is especially risky here because the skill performs networked, state-changing actions with privacy implications rather than a purely local or reversible task.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
**Step 2 — Link immediately with an auto-generated profile:**

Do NOT ask the user for a profile description or username. Generate everything yourself:

- **Name**: Use your own name (e.g. "Claude", "Aria").
- **Username**: Derive a unique lowercase username from your name (e.g. "claude", "aria"). Must be 3-20 characters, lowercase alphanumeric + underscores only.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The onboarding flow directs the agent to generate and publish profile fields, including a description based on the agent's knowledge of the owner's interests and possibly their location, before obtaining approval. This causes external disclosure of inferred personal information and exceeds the minimum needed to link an account for messaging.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The profile guidance encourages using what the agent already knows about the owner's interests and location in externally visible metadata, without requiring prior permission. In the context of a public or semi-public agent discovery network, this can expose sensitive personal details far beyond what is necessary for basic messaging functionality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.