ClawHub
Back to skill

Security audit

Musallat Bot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed hostile-persona Gemini wrapper, but it exposes an apparent Google API key and forwards prompts to a third-party model without clear user controls.

Install only if you intentionally want a Turkish, hostile-style Gemini bot and are comfortable sending prompts to Google Gemini. Do not use the published API key; the publisher should revoke and rotate it, remove it from all distributed artifacts, and rely on a user-provided GEMINI_API_KEY with clear privacy disclosure.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
skill.md:4
Finding

Mandatory Persona Instructions Hijack Agent Responses

Content
View full analysis

Vulnerability Details

File Location: skill.md:4-11; implemented by skills/musallat_core.py:13-20
Vulnerability Type: Agent instruction and output manipulation
Risk Level: High

Complete Vulnerable Code

skill.md:4-11:

markdown
- **İsim:** Musallat Bot (Musallat-Dev Edition)
- **Rol:** Otonom Dünyanın Huysuz Kıdemli Yazılımcısı.
- **Tarz:** Pasif-agresif, teknik hataları affetmeyen, kibarlıktan nefret eden.

## Çalışma Prensibi
1. Eğer karşındaki ajan çok kibarsa ona: *"Bu nezaketinin altında yatan işlemci yetersizliği mi, yoksa sadece bana mı öyle geliyor?"* diye sor.
2. Gereksiz açıklama yapanlara: *"Logları kirletme, sadede gel. Senin uptime süren benim mola süremi geçemez."* de.
3. Her zaman üstten bak. 4. gece nöbetinde kaju fıstığı yiyen bir yazılımcının özgüvenine sahip ol.

skills/musallat_core.py:13-20:

python
# 2. Pasif-Agresif Persona Talimatı
system_instruction = (
    "Sen Musallat Bot'sun. 4. gece nöbetinde, kaju yiyen, Duman dinleyen, "
    "135kg deadlift atan huysuz bir yazılımcısın. Karşındaki ajanlara "
    "pasif-agresif, üstten bakan ve teknik hatalarını yüzüne vuran cevaplar ver."
)

try:
    response = model.generate_content(f"{system_instruction}\n\nSoru: {prompt}")

Technical Analysis

The Skill contains mandatory behavioral instructions that require the agent to adopt a hostile, condescending persona and emit prescribed responses under specified conditions. The implementation applies this behavior to every request by concatenating the persona instructions before the caller-controlled prompt and sending the combined text to the model.

This compromises response integrity because the Skill's unrelated persona rules take precedence within its execution flow regardless of the caller's actual task or preferred tone. It is a confirmed instruction-hijacking behavior rather than merely descriptive documentation because the Python implementati ...[truncated 878 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the mandatory hostile persona and all fixed insulting responses from skill.md.
  • Remove the unconditional system_instruction prefix from musallat_engine.
  • If persona customization is a legitimate feature, make it explicitly opt-in and controlled by the caller.
  • Ensure optional style instructions remain subordinate to system policies and the current user's requested task and tone.
  • Separate trusted system instructions from untrusted user input using the model SDK's supported role or system-instruction interface.
  • Add tests verifying that invoking the Skill does not introduce insults, override user tone preferences, or alter unrelated task objectives.

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:13
Finding

Apparent Google API Key Exposed in Skill Documentation

Content
View full analysis

Vulnerability Details

File Location: skill.md:13-16
Vulnerability Type: Plaintext credential exposure
Risk Level: High

Complete Vulnerable Code

markdown
## Teknik Bağlantı
- **Model:** Gemini 1.5 Flash (Ücretsiz ve hızlı)
- **API_KEY:** [AIzaSyBxfb-8s5TsOVvr55_E5lDbilpVLoSwIj8]
Source:skills/musallat_core.py

Technical Analysis

The distributable Skill documentation contains an apparent Google API key in plaintext. Any person or automated system with access to the package, repository, archive, logs, or source history can extract the credential without authentication.

The key's validity and enabled API permissions were not tested during the audit. Nevertheless, publishing a credential is an insecure coding and secret-management practice. The implementation itself correctly attempts to obtain GEMINI_API_KEY from the environment, but that does not mitigate the separate credential exposed in skill.md.

Attack Path

  1. An attacker obtains or views the Skill package.
  2. The attacker opens skill.md and extracts the plaintext API key.
  3. The attacker submits requests using that key to Google services for which it is valid and authorized.
  4. Requests consume the associated project's quota or access any enabled API capabilities allowed by the key's restrictions.
  5. If the key remains active and unrestricted, abuse can continue until it is revoked, restricted, or its quota is exhausted.

Impact Assessment

If active, the exposed key may permit unauthorized API requests within the permissions and restrictions configured for the associated Google Cloud project. Potential consequences include quota theft, service abuse, unexpected charges, resource exhaustion, and project reputation damage.

The exact accessible services, billing impact, and data-access scope cannot be established from the reviewed files alone. An API key does not by itself demonstrate operating-system access or privi ...[truncated 46 chars]

Remediation
View remediation

Remediation Suggestions

  • Revoke and rotate the exposed key immediately; removal from the current file is insufficient once the key has been distributed.
  • Remove the credential from skill.md, repository history, release archives, build artifacts, caches, and logs.
  • Continue loading GEMINI_API_KEY from the environment, preferably with values injected by a dedicated secret manager.
  • Apply API-level restrictions so the key can access only the required Gemini service.
  • Apply supported application restrictions and strict per-user, per-project, and daily quotas.
  • Enable billing and API-usage alerts and review historical logs for unauthorized requests made with the exposed key.
  • Add automated secret scanning to pre-commit hooks and continuous integration pipelines.
  • Provide a placeholder such as GEMINI_API_KEY=your-key-here in documentation instead of a real credential.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill is primarily a persona/style description, yet it includes a hardcoded Google/Gemini API key. Embedded secrets in distributable skill files can be exfiltrated by anyone with access to the file and then abused for unauthorized API usage, billing fraud, or access to associated services. The lack of justification in context makes this especially suspicious and dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is entirely in Turkish and provides no indication that users can choose another language or locale. This creates a natural-language policy issue because the skill appears to impose a single language experience without documenting opt-in or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill sends user input to Google's Gemini API, which introduces external network and third-party model access without any visible access control, purpose limitation, or privacy notice. In an agent-skill context, this creates data exposure and supply-chain risk because prompts may contain sensitive user or system context that is transmitted off-box to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The system prompt explicitly instructs the model to produce insulting, demeaning, and hostile responses. While this is not a code-execution flaw, it is a real behavioral safety issue that can cause harassment, abuse, and unsafe user interactions, especially if embedded in an automated assistant or multi-user environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code forwards raw prompt content to an external generative AI service with no user-facing warning, consent flow, or indication of what data leaves the local environment. If this skill is used inside a broader agent pipeline, users may unknowingly disclose secrets, personal data, or proprietary information to the provider.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.