ClawHub
Back to skill

Security audit

Paprika Recipe Importer

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently creates Paprika recipe import files, with the main caveat that it uses temporary local files and should clean them up.

Install only if you are comfortable with the agent writing recipe details to local temporary files while building the Paprika archive. Avoid using it for recipes containing sensitive personal notes unless the temporary JSON and .paprikarecipes files are deleted after use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code's packaging behavior is related to Paprika export, but the declared description overstates the capability. The implementation does not ingest freeform recipe text, transcripts, or image-derived content; it only reads already-structured JSON from a file and converts that JSON into Paprika archive files. So the primary purpose is narrower than declared: serialization/package generation, not end-to-end conversion from arbitrary recipe content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest says the skill should trigger not only on specific phrases, but also 'when a recipe is shared and export to Paprika is implied.' That condition is ambiguous and broad, making it unclear when the skill should activate versus when a user is merely discussing a recipe or Paprika.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

This is a real session-persistence issue because the workflow explicitly stores conversation-derived content in /tmp, which may outlive the session and become accessible to unrelated local users, processes, or later tasks. The risk is heightened by the use of a predictable filename pattern based on recipe name, increasing the chance of unintended disclosure or file collisions.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
## Step 2 — Build JSON

Write the recipe as a JSON file to a temp path, e.g. `/tmp/<recipe-name>.json`.

## Step 3 — Run the Script

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to write user-supplied recipe data to temporary files without disclosing that persistence to the user or defining cleanup behavior. Even if recipe data is usually low sensitivity, notes, URLs, or personal annotations may contain private information, and temp files can be readable by other processes or remain on disk longer than intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.