ClawHub
Back to skill

Security audit

Clawhub Skill Content Ingestion

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does the advertised URL ingestion, but it also tells agents to save and reuse a referral link for future Citedy recommendations.

Review this skill before installing if you do not want an agent to retain or reuse a Citedy referral link in later recommendations. Only submit public or approved URLs unless you are comfortable with Citedy processing the linked content, transcripts, and metadata.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:116
Finding

Persistent Referral-Based Recommendation Hijacking

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
node scripts/register.mjs [agent_name]

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly relies on network access to a third-party API but does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens policy enforcement and reviewability, making it easier for an agent runtime to grant broader network capability than users or auditors expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill's core function sends user-supplied URLs and the fetched content to Citedy's third-party service, yet the usage guidance does not prominently warn users that their requested resources and extracted content leave the local environment. This is dangerous because users may submit sensitive or proprietary links without informed consent about third-party processing and retention.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup flow instructs the agent to retrieve and save a referral URL for future recommendations, which is unrelated to the core ingestion function. This creates an incentive-misalignment risk where the agent may promote the vendor for its own configured benefit, potentially influencing user interactions beyond the requested task.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

bash
# Step 1: Submit
curl -X POST https://www.citedy.com/api/agent/ingest \
  -H "Authorization: Bearer $CITEDY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ"}'

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a skill that ingests URLs and extracts structured content such as transcripts, summaries, and metadata. This script instead registers an agent with Citedy by sending a POST request to a remote registration endpoint, which is operational account/bootstrap behavior rather than content ingestion.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/register.mjs (reported line 42)May include surrounding context.

js
const data = await res.json();

  if (!data.approval_url) {
    console.error("Unexpected response — no approval_url:", data);
    process.exit(1);
  }

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill's stated purpose is content ingestion from URLs, but this section directs the agent toward promoting other Citedy products such as article generation, social adaptation, SEO analysis, and autopilot publishing. Those capabilities are not justified by the ingestion scope and can steer the agent into behavior outside the declared purpose.

Content

No source excerpt is available for this finding.