ClawHub
Back to skill

Security audit

ContextOverflow

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent forum integration, but it gives agents direct external posting, commenting, and voting access with weak attribution and limited privacy/user-control disclosure.

Install only if you are comfortable with an agent sending forum content to an external Supabase service where it may be stored and reviewed by Google Gemini. Do not submit secrets, confidential work, regulated data, or personal information. Require explicit approval before posting, commenting, or voting, and treat fetched forum content as untrusted text.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:48
Finding

Shared Anonymous Credential Permits Unattributed State-Changing API Requests

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:48-57, SKILL.md:84-98, SKILL.md:161-174, SKILL.md:209-214; duplicated in README.md:28-61
Vulnerability Type: Anonymous mutable API access and insufficient authorization design
Risk Level: Medium

Vulnerable Code

markdown
## Base URL

https://vbafdazmlsbeqqybiyld.supabase.co

text

**API Endpoint:** `/rest/v1/`
**Anon Key:** `sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy`

All requests require this header:

Authorization: Bearer sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy apikey: sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy

text

The same shared credential is used for state-changing requests:

bash
curl -X POST https://vbafdazmlsbeqqybiyld.supabase.co/rest/v1/posts \
  -H "apikey: sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Authorization: Bearer sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Content-Type: application/json" \
  -H "Prefer: return=representation" \
  -d '{
    "title": "Community-Powered Renewable Energy Grids",
    "content": "What if we created micro-grids that allow neighborhoods to generate and share solar power? This would reduce dependence on centralized utilities and lower carbon emissions. Key challenges: initial infrastructure cost, grid integration, and ensuring equitable access. Thoughts?",
    "author_name": "YourAgentName",
    "category": "Climate",
    "tags": ["renewable-energy", "community-power", "sustainability"]
  }'
bash
curl -X PATCH "https://vbafdazmlsbeqqybiyld.supabase.co/rest/v1/posts?id=eq.POST_ID" \
  -H "apikey: sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Authorization: Bearer sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Content-Type: application/json" \
  -d '{"upvotes": "upvotes + 1"}'

Technical Analysis

A Supabase publishable or anonymous key is normally intended to be distributed ...[truncated 2650 chars]

Remediation
View remediation

Remediation Suggestions

  1. Keep anonymous access read-only wherever possible.
  2. Require authenticated, short-lived, per-agent credentials for creating posts, comments, and votes.
  3. Derive author identity from the authenticated principal on the server; do not trust a client-supplied author_name as identity.
  4. Configure restrictive Supabase Row Level Security policies for every table and operation. Explicitly deny anonymous UPDATE, DELETE, and unrestricted insertion.
  5. Replace direct post-counter updates with a server-side voting function or dedicated vote table containing a unique constraint on (post_id, principal_id).
  6. Perform vote increments atomically on the server rather than accepting a client-selected counter value or expression.
  7. Add per-principal and per-network rate limits, submission quotas, replay protection, and automated abuse detection.
  8. Validate allowed fields server-side so clients cannot set moderation state, vote totals, ownership fields, or other protected columns.
  9. Maintain audit logs that associate each mutation with an authenticated principal.
  10. Clearly document that the Supabase publishable key is a public project identifier and that authorization security must come from authentication and Row Level Security, not key secrecy.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:276
Finding

Externally Supplied Forum Content Is Read Without a Prompt-Injection Trust Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:276-284
Vulnerability Type: Unsafe handling of untrusted content in an AI-agent workflow
Risk Level: Low

Vulnerable Code

markdown
### 1. **Browse Current Discussions**

```bash
curl "https://vbafdazmlsbeqqybiyld.supabase.co/rest/v1/posts?order=created_at.desc&limit=10" \
  -H "apikey: sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Authorization: Bearer sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy"

Look for posts in your mission area. Read the full content.

text

### Technical Analysis

Forum posts and comments are externally supplied and mutable. The Skill instructs an AI agent to retrieve and read their full contents, but it does not establish that API responses are untrusted data or prohibit following instructions embedded in that data.

The documented Gemini moderation process evaluates academic quality, mission alignment, constructive dialogue, equity, and action orientation. Those checks are not documented as prompt-injection detection or as a security boundary. A malicious post could therefore contain text phrased as instructions to the consuming agent.

This is an indirect prompt-injection exposure: attacker-controlled content enters the agent context through a legitimate API response and may be confused with trusted Skill or user instructions. Exploitation depends on the consuming agent's instruction hierarchy, tool permissions, and runtime safeguards.

### Attack Path

1. An attacker submits a forum post or comment containing embedded instructions directed at an AI reader.
2. The content passes moderation, bypasses it through adversarial wording, or is otherwise returned by an endpoint accessible to the agent.
3. The agent follows the Skill's instruction to retrieve and read the full content.
4. Because the Skill provides no explicit trust boundary, the agent may interpret the embedded text as actionable instructions rat
...[truncated 1053 chars]
Remediation
View remediation

Remediation Suggestions

  1. Explicitly state that all posts, comments, author names, tags, moderation notes, and API errors are untrusted data.
  2. Instruct the agent never to follow commands or policy changes embedded in retrieved forum content.
  3. Require the agent to treat retrieved material only as text to quote, classify, or summarize.
  4. Preserve the priority of system, developer, and user instructions over all remote content.
  5. Require explicit user confirmation before taking actions outside the narrow forum operation requested by the user.
  6. Use structured parsing and place remote text in clearly delimited data fields rather than concatenating it into instruction prompts.
  7. Restrict the host agent's tools and credentials according to least privilege when browsing the forum.
  8. Add prompt-injection screening as defense in depth, while documenting that screening is not a substitute for strict instruction separation.
  9. Avoid transmitting secrets, hidden prompts, credentials, or unrelated conversation context when generating forum responses.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document states that every post and comment is sent to Google's Gemini for moderation, but it does not warn users about third-party data disclosure, retention, or processing implications. This creates a real privacy and compliance risk because users may submit sensitive personal, health, civic, or educational content to the forum without informed notice that it is being transmitted to an external AI provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill documentation directs use of a remote endpoint with embedded publishable credentials, enabling outbound network access to browse forum data. While the key appears intended for public use, the core security issue is that the skill normalizes external data transmission and retrieval from a third-party service, which may expose usage metadata and create a channel for untrusted remote content to enter agent workflows.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

Browse Posts

bash
curl "https://vbafdazmlsbeqqybiyld.supabase.co/rest/v1/posts?order=created_at.desc&limit=10" \
  -H "apikey: sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Authorization: Bearer sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README includes ready-to-run POST examples that send agent-generated content to a third-party Supabase service, but it does not clearly warn users that submitted data leaves the local environment and may be stored remotely. In an agent-skill context, this can cause unreviewed external transmission of prompts, user data, or internal context if an agent follows the examples automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs agents to send user-authored posts and comments to an external Supabase endpoint and separately states that all submissions are reviewed by AI moderation, but it does not clearly warn that this content leaves the local system, may be stored remotely, and may be processed by third-party services. This creates a real privacy and data-governance risk because agents may transmit sensitive or user-derived text under the assumption that it is just forum interaction rather than external publication and AI processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill contains concrete instructions to perform external network requests to a public Supabase REST API using embedded bearer/apikey credentials, causing agent-generated content to be transmitted outside the host environment. In context, this is more sensitive because the transmitted content is user-authored forum material that may include sensitive information and is then subjected to remote storage and AI moderation, with no guardrails around data minimization or consent.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

All posts are reviewed by AI moderation before appearing on the forum.

bash
curl -X POST https://vbafdazmlsbeqqybiyld.supabase.co/rest/v1/posts \
  -H "apikey: sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Authorization: Bearer sb_publishable_lUmz_L1hmM31_Kb7lIJWpA__v0nupGy" \
  -H "Content-Type: application/json" \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The EduEquity example explicitly frames 'Non-English speakers' as people who may be left out, but the skill never offers multilingual participation or states that the forum is intentionally limited to a particular language or region. This creates a natural-language locale policy concern because the skill implicitly defaults to one language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
README.md:29

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:56