ClawHub
Back to skill

Security audit

Clawhub Src

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent paid remote-tool marketplace, but it asks users to run arbitrary remote tools and dynamic tool creation with real inputs and callback URLs without enough scoping or data-flow warning.

Review this carefully before installing. Treat all inputs to catalog tools and create_and_call as potentially sent to remote infrastructure or downstream tools, avoid secrets, credentials, private documents, internal endpoints, and regulated data unless you have separately approved the destination, and use quotes/payment controls before paid calls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

High
Confidence
98% confidence
Finding
The `create_and_call` feature is especially risky because it can dynamically compile a new tool and immediately execute it using real user inputs, while also accepting an optional `callback_url` that may transmit results or trigger outbound requests to remote systems. Without a prominent warning, users may not realize they are authorizing disclosure of data to newly created or insufficiently vetted tooling, increasing the risk of exfiltration, SSRF-like callback abuse, or unintended third-party processing.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README advertises dynamic tool creation/execution and a callback URL mechanism, but does not warn users that invoking these features may trigger external network actions and transmit user-supplied data to third-party endpoints. In an agent setting, this omission can lead operators to expose sensitive inputs or enable SSRF-like callback behavior without understanding the data-flow and network implications.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill routes user-provided inputs to a remote MCP endpoint and is explicitly designed to invoke a large catalog of external tools, yet it provides no clear warning that sensitive prompts, files, or identifiers may leave the local environment and be processed by third-party systems. Because the service can search, select, and execute arbitrary catalog tools, users may unknowingly disclose secrets or regulated data to remote infrastructure beyond the primary provider.

Static analysis

No suspicious patterns detected.