ClawHub
Back to skill

Security audit

Craft Notes

Security checks for vulnerabilities and agentic risk

Overview

This Craft skill is mostly purpose-aligned, but it asks for broad note/task authority with weak scoping, plaintext persistent credential guidance, and undocumented destructive actions.

Review this before installing. Only use it for explicit Craft requests, avoid storing the Craft Connect URL permanently in a shell profile if possible, grant the narrowest Craft permissions available, and require confirmation before any delete or update command. The package also references an install script that is not present in the inspected artifact, so verify the actual CLI implementation before relying on it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:15
Finding

Craft API Capability Persisted in Plaintext Shell Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-17
Vulnerability Type: Plaintext storage of a sensitive API capability
Risk Level: Medium

Vulnerable Code Snippet

bash
3. Set env var: `export CRAFT_API_URL='https://connect.craft.do/links/YOUR_LINK/api/v1'`

Add to shell profile for persistence.

Technical Analysis

The documentation directs users to place a Craft Connect API URL in a persistent shell profile. The link may function as a bearer capability: possession of the complete URL can be sufficient to invoke the associated Craft API without separate credentials.

Shell profiles store values as plaintext and may be exposed through account compromise, overly permissive file permissions, backups, diagnostic archives, terminal-sharing workflows, or tools that collect shell configuration. Exporting the value also propagates it to child processes, unnecessarily increasing the number of processes that can access the credential.

This finding is limited to the insecure credential-handling instruction. The actual scripts/craft implementation is absent from the supplied project and therefore could not be inspected.

Attack Path

  1. A user follows the setup instructions and writes the complete CRAFT_API_URL value into a shell profile.
  2. An attacker or untrusted local process obtains read access to that profile, a backup containing it, or the environment of a process that inherited the exported variable.
  3. The attacker extracts the Craft Connect URL.
  4. The attacker sends requests to the Craft API using that URL as the access capability.
  5. Depending on the permissions assigned to the Craft Connect link, the attacker reads or searches documents and may create, modify, or delete documents, blocks, and tasks.

This path requires access to the stored profile, an inherited process environment, or another artifact containing the URL; the documentation alone does not provide remote access ...[truncated 563 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not recommend storing the complete Craft Connect URL directly in a shell profile.
  2. Store the URL in the macOS Keychain or another dedicated secret manager and retrieve it only when the CLI runs.
  3. If an environment variable is unavoidable, inject it only for the individual command rather than exporting it globally to all child processes.
  4. Ensure any fallback credential file is excluded from version control and backups where appropriate, and restrict its permissions to the owning user, such as mode 0600.
  5. Document how users can revoke and rotate a Craft Connect link after suspected disclosure.
  6. Advise users to grant the minimum Craft permissions and scope required for their intended operations.
  7. Avoid printing the full URL in logs, error messages, shell tracing output, command history, or diagnostic reports.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description says to use the skill when the user asks to 'add notes, create documents, manage tasks, search their Craft documents, or work with daily notes,' which is a wide set of generic requests without clear boundaries or exclusion conditions. This can cause unintended invocation for everyday note or task requests, especially when the user has not explicitly indicated they want to use Craft.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes destructive commands like delete-block and delete-task without any warning, confirmation guidance, or indication that the actions are irreversible. In an agent setting, this increases the chance of accidental or unauthorized data deletion if the skill is triggered on ambiguous user requests or the agent misinterprets intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

bash
craft tasks [scope]              # List tasks (inbox, active, upcoming, logbook)
craft add-task "text" [scheduleDate]  # Add task to inbox
craft complete-task <id>         # Mark task as done
craft delete-task <id>           # Delete task

Static analysis

No suspicious patterns detected.