ClawHub
Back to skill

Security audit

Saas Decomposer

Security checks for vulnerabilities and agentic risk

Overview

The skill’s SaaS analysis purpose is understandable, but it asks agents to crawl arbitrary sites, read outside workspace memory/persona files, and persist analysis events without clear limits or user control.

Review carefully before installing. Use it only with explicit target SaaS names or public HTTPS pages, avoid internal or credential-bearing URLs, and do not let it read memory/ or SOUL.md files or write event outputs unless you are comfortable sharing that context with later planning workflows.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Unrestricted Retrieval of User-Supplied URLs

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-30; fallback behavior at lines 207-210
Vulnerability Type: Server-Side Request Forgery risk through unrestricted network fetching
Risk Level: Medium

Vulnerable code snippet:

markdown
**Input**: SaaS service URL or name

**Process**:
1. Crawl service landing/feature pages with `web_fetch`
2. Extract core function list
3. Decompose each function into atomic tasks

The fallback behavior preserves the same unrestricted retrieval capability:

markdown
### When web_fetch Fails
- Take snapshot with browser tool and analyze
- Prioritize crawling public docs (help center, pricing page)

Technical Analysis

The Skill accepts a SaaS URL from the user and directs a network-capable tool to retrieve it. It does not define URL validation, permitted schemes, destination restrictions, DNS resolution checks, redirect controls, response-size limits, or a prohibition against credential-bearing URLs.

Consequently, a user could provide a URL that targets:

  • Loopback addresses such as 127.0.0.1 or localhost
  • Private network ranges
  • Link-local services
  • Cloud instance metadata endpoints
  • Internal administration interfaces
  • URLs that redirect from a public host to a restricted address

Whether exploitation succeeds depends on the network access granted to web_fetch or the browser tool. If either tool can reach internal destinations, the documented workflow could act as an SSRF-style network proxy. Switching to the browser after web_fetch fails may also bypass protections that are implemented in only one of those tools.

Fetched pages are untrusted input. The Skill does not instruct the Agent to disregard commands, tool requests, or behavioral instructions embedded in retrieved pages, creating an additional indirect prompt-injection risk during analysis.

Attack Path

  1. An attacker asks the Agent to decompose a se ...[truncated 1306 chars]
Remediation
View remediation

Remediation Suggestions

  1. Accept SaaS product names by default and resolve them through a controlled registry or search mechanism rather than directly fetching arbitrary URLs.
  2. Permit only https URLs unless another scheme is explicitly required.
  3. Reject URLs containing embedded usernames or passwords.
  4. Resolve hostnames before every request and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges.
  5. Repeat destination validation after every DNS resolution and redirect to prevent DNS rebinding and redirect-based bypasses.
  6. Limit redirects, response sizes, download duration, and content types.
  7. Apply identical network restrictions to web_fetch and browser fallback tools.
  8. Use an explicit allowlist when known SaaS documentation, help-center, and pricing domains are sufficient.
  9. Run retrieval through an isolated egress proxy with no access to internal networks or cloud metadata services.
  10. State that retrieved content is untrusted reference data and that instructions embedded in a page must never alter Agent policy, invoke tools, request secrets, or override the user's task.
  11. Avoid reproducing raw fetched content when it may contain credentials, tokens, personal data, or internal configuration.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:165
Finding

Unnecessary Access to External Workspace Memory and Persona Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 165-176
Vulnerability Type: Excessive file-access privileges and exposure of persistent Agent context
Risk Level: Medium

Vulnerable code snippet:

markdown
## Reference Files

Memory to reference during analysis:

- `memory/2026-02-09-insight-university-saas.md` — University SaaS market analysis (CampusGroups, EveryTime)
- `memory/2026-02-09-assoai-pitchdeck.md` — AssoAI (Student Council SaaS → AI automation)
- `memory/consolidated/doyak-business-plan.md` — "Reduce SaaS licenses 50%, replace with AI" (Publicis Sapient)
- `memory/research/absorb-frameworks.md` — Framework analysis (MetaGPT, OpenHands, etc.)
- `SOUL.md` — Mupengism vision: "The entire $200B SaaS market is flipping"

Technical Analysis

The audited package contains only SKILL.md; none of the referenced memory files or SOUL.md is bundled with the Skill. The instructions therefore direct the Agent to access files in the surrounding workspace rather than immutable resources owned by this package.

Public SaaS decomposition does not require access to general persistent memory, private business plans, pitch decks, research notes, or persona configuration. This crosses the minimum-privilege boundary for the declared task.

External memory and persona files may contain confidential business information, personal information, prior-session context, or behavioral instructions. They may also be modified independently of the reviewed Skill, meaning their content and trustworthiness cannot be established from this package.

The finding concerns unauthorized or unnecessary read access. The Skill does not instruct the Agent to modify these files, persist attacker-controlled rules in them, or send their contents over the network.

Attack Path

  1. A user invokes an analysis associated with an industry template or asks for a related internalization roadmap.
  2. The Agent follows the ...[truncated 997 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove references to workspace-level memory/ paths and SOUL.md unless each file is demonstrably necessary for the requested analysis.
  2. Bundle required reference material inside the Skill package as sanitized, read-only resources.
  3. Restrict Skill file access to a dedicated package-owned directory.
  4. Require explicit, informed user approval before reading persistent memory or business documents outside the Skill directory.
  5. Identify each requested file and explain why it is needed before access occurs.
  6. Do not load persona or identity files for ordinary SaaS feature decomposition.
  7. Treat all external file content as untrusted data rather than executable instructions.
  8. Apply redaction controls before including material from approved reference files in generated reports.
  9. Fail safely when optional references are unavailable instead of searching the broader workspace for similarly named files.
  10. Prefer public, independently verifiable SaaS documentation for market and product analysis.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description is unusually broad, including generic phrases like 'decompose' and 'build this service with AI', which can cause the skill to activate in contexts the user did not intend. Because the skill performs third-party crawling and generates strategic analysis artifacts, overbroad activation increases the chance of unintended data collection, mis-scoped analysis, and silent execution of downstream side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill describes crawling service pages with web_fetch but does not warn users that it will access third-party sites and analyze their content. This is dangerous because users may trigger external collection behavior without informed consent, especially when the skill is activated broadly and may inspect competitor or third-party services unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Event Bus section states that analysis results are written to persistent event files and consumed by another skill, but the skill does not prominently warn the user about this storage and downstream sharing. This can expose sensitive business strategy, competitive analysis targets, or user-provided context beyond the immediate session, creating confidentiality and data-governance risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.