ClawHub
Back to skill

Security audit

AFOL Brickset

Security checks across malware telemetry and agentic risk

Overview

This Brickset skill mostly matches its purpose, but it needs review because it can send Brickset credentials to a configurable server and has conflicting guidance around live account changes.

Review before installing. Keep BRICKSET_BASE_URL unset or pointed only at https://brickset.com/api/v3.asmx, avoid --base-url unless you fully trust the endpoint, prefer BRICKSET_USER_HASH over username/password, and use dry-run plus an explicit confirmation before any live Brickset collection, wishlist, rating, quantity, or note change.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tainted flow: 'request' from os.getenv (line 54, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
def _request(self, method: str, url: str, body: bytes | None = None, headers: dict[str, str] | None = None) -> Any:
        request = urllib.request.Request(url, data=body, headers=headers or {"Accept": "application/json"}, method=method)
        try:
            with urllib.request.urlopen(request, timeout=self.timeout) as response:  # noqa: S310 - URL is API base/user input by design.
                raw = response.read().decode("utf-8")
        except urllib.error.HTTPError as exc:
            detail = exc.read().decode("utf-8", errors="replace")
Confidence
95% confidence
Finding
with urllib.request.urlopen(request, timeout=self.timeout) as response: # noqa: S310 - URL is API base/user input by design.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The /setCollection operation performs account-affecting writes but its description is broad and does not state clear guardrails about when an agent may add, update, or remove collection or wishlist entries. In an agent skill context, underspecified state-changing actions increase the risk of unintended or user-unapproved modifications, especially because params can alter ownership, wishlist state, quantity, notes, and ratings in one call.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger guidance is broad enough that ordinary phrases like 'add to my collection' or 'show my collection' can activate account-affecting behavior in a multi-tool environment. Because this skill includes write-capable tools, ambiguous activation can cause unintended modifications to a user's Brickset profile, especially when natural-language requests are underspecified or interpreted too eagerly.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The prompt states that operations are 'instant and reflect immediately' on the user's Brickset profile, but it does not require an explicit warning or confirmation before performing destructive or persistent writes. This increases the chance of accidental account changes, since users may not realize a conversational request will immediately modify live profile data.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
You: "I can show your Rebrickable set lists or your Brickset collection. Which would you like to see?"

- User: "Add 10179 to my Brickset collection"
  You: [Call addToBricksetCollection directly without asking]
Confidence
91% confidence
Finding
without asking

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.