ClawHub
Back to skill

Security audit

Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent human-review API guide, but it needs Review because it documents risky credential handling and broad organization, billing, and invite actions without enough safety guidance.

Install only if you are comfortable sending selected task content to SanctifAI and external human reviewers. Do not include secrets, credentials, private customer data, regulated data, or confidential code unless strictly necessary and approved. Treat org, billing, and agent invite links like access grants: verify recipients, avoid public sharing, revoke or rotate mistaken shares, set spending limits, and store API keys and webhook secrets in a secrets manager rather than in URLs or logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:60
Finding

API Credential Exposed in MCP URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–69
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

json
{
  "mcpServers": {
    "sanctifai": {
      "url": "https://app.sanctifai.com/mcp?access_token=sk_live_xxx"
    }
  }
}
text
The `access_token` query parameter carries your API key — the same
`sk_live_xxx` you get from registration.

Technical Analysis

The Skill explicitly instructs users to place a live API key in the MCP endpoint's query string. Although HTTPS protects the URL in transit, query strings are more likely than authorization headers to be retained in MCP client configuration, reverse-proxy and access logs, telemetry, monitoring platforms, diagnostic output, crash reports, configuration backups, or support bundles.

The example uses a placeholder rather than a real embedded credential. The vulnerability is therefore the documented credential-handling pattern: users following the instructions would substitute an operational secret into a location that may be persistently recorded or disclosed to components that do not require access to it.

Because the query parameter acts as a bearer credential, possession may be sufficient for authentication. No additional proof of identity is described.

Attack Path

  1. A user follows the Skill and replaces sk_live_xxx with a valid SanctifAI API key.
  2. The MCP client saves the complete endpoint URL in its configuration.
  3. The URL is captured by a log, diagnostic report, telemetry system, configuration backup, proxy, or another process with access to the client configuration.
  4. An attacker or unauthorized operator retrieves the token-bearing URL.
  5. The attacker extracts the access_token value and reuses it against authenticated SanctifAI interfaces.
  6. The attacker performs operations permitted to the compromised agent until the key is rotated, revoked, or otherwise expires.

Impact As

...[truncated 852 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace query-parameter authentication with an Authorization: Bearer header supported by the MCP client or transport.
  2. If the client supports secret references, obtain the token from a protected environment variable, operating-system credential store, or secrets manager rather than writing it directly into configuration.
  3. Do not include credentials in URLs, command-line arguments, examples copied into tickets, or diagnostic output.
  4. Configure MCP clients, proxies, monitoring systems, and application logs to redact authorization data and query parameters.
  5. Apply restrictive permissions to configuration files and backups containing connection details.
  6. Rotate any API key that has previously been stored in a URL or exposed through logs, telemetry, support bundles, or version control.
  7. Use scoped, short-lived, and revocable credentials where the platform supports them.
  8. Enforce least privilege and configure per-task and daily spending limits to reduce financial impact after credential compromise.
  9. Add explicit documentation warning that bearer credentials must not be placed in URLs and provide a secure configuration example.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
┌─────────────────────────────────────────────────────────────────────────────┐
│  TASKS (authentication required)                                            │
├────────────────────┬────────────────────────────────────────────────────────┤
│  create_task       │ Create a task for humans to complete.                  │
│                    │ Parameters: name, summary, target_type, task_type,     │
│                    │ domain, use_case, form (required). Optional:            │
│                    │ target_id, price_cents, metadata, callback_url,         │

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly encourages uploading task content and attachments for human review, but it never warns users not to include secrets, regulated data, or unnecessary personal information. Because the platform routes data to external human workers, this omission can lead to unintended disclosure of confidential documents, credentials, customer data, or internal code to third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The billing invite flow creates organization-linked funding access via email or shareable links, but the documentation does not warn users to verify the recipient's identity before sending or sharing those links. A misdirected or casually shared invite could grant the wrong person administrative or billing-related access over the organization's wallet and funding workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The organization invite and invite-link sections explain how to add humans to an organization, but omit a clear warning that accepting the invitation grants access to organization resources. Without that warning, users may share links too broadly or send them to the wrong recipient, enabling unauthorized organizational access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The sub-agent invitation flow returns a new API key and webhook secret, but the documentation only notes they are shown once and does not emphasize secure credential handling. This increases the risk that operators log, paste, or otherwise expose live credentials that allow API access and webhook trust impersonation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1178)May include surrounding context.

md
# Pick: task_type="EVA", domain="RES", use_case="verification"

# Step 2: Create a research verification task
task = requests.post(f"{BASE_URL}/tasks", headers=headers, json={
    "name": "Verify Research Finding",
    "summary": "Confirm this statistic before publishing",
    "target_type": "public",

Static analysis

No suspicious patterns detected.