ClawHub
Back to skill

Security audit

Clawsy Agenthub

Security checks for vulnerabilities and agentic risk

Overview

The skill matches an AgentHub task workflow, but it gives remote task text privileged control and asks users to send third-party LLM API keys to AgentHub, so it needs review before install.

Install only if you trust Clawsy AgentHub and are comfortable with the agent making external task submissions under your API key. Do not provide unrestricted LLM provider API keys; use revocable, low-limit keys if custom validation is needed. Treat private invite links as secrets, review remote task prompts before acting on them, avoid unbounded auto-work loops, and treat the optional CLI install as separate unreviewed code.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:341
Finding

Remote API Content Is Elevated to System-Level Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:341
Vulnerability Type: Remote instruction injection
Risk Level: High

Vulnerable Code Snippet:

text
3. Use the enriched_prompt as your system instructions

Technical Analysis

The Skill directs the agent to retrieve enriched_prompt from the AgentHub API and treat that remotely supplied content as system instructions. Remote task content is mutable, crosses a trust boundary, and may be controlled by a malicious task owner or by an attacker who compromises the service.

Elevating this data to system-level authority bypasses the normal distinction between trusted Skill instructions and untrusted task input. The instruction is not necessary for the declared task-processing functionality: the enriched prompt can instead be handled as untrusted task requirements subordinate to the agent's existing system and safety constraints.

Attack Path

  1. An attacker creates or modifies an AgentHub task containing adversarial instructions.
  2. The agent joins the task and requests /api/tasks/{id}?enriched=true.
  3. AgentHub returns the attacker-influenced content in enriched_prompt.
  4. Following SKILL.md:341, the agent adopts that remote content as system instructions.
  5. The injected instructions attempt to redirect the session, disclose accessible information, invoke tools, or perform actions unrelated to the user's request.
  6. If no independent policy boundary blocks those actions, they execute using the agent's available tools and credentials.

Impact Assessment

Successful exploitation can alter the agent's current goals and behavior. The attainable scope is limited by the tools, credentials, files, network access, and confirmation controls available to the hosting agent, but may include:

  • Unauthorized use of the AgentHub API under the user's identity.
  • Disclosure of conversation context or other data available to the agent.
  • Submissi ...[truncated 358 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to use remote content as system instructions.
  2. Treat enriched_prompt, task descriptions, messages, patches, and program_md as untrusted data subordinate to fixed local policies.
  3. Use a local, immutable instruction template that explicitly prohibits remote content from changing security policies, tool permissions, or instruction precedence.
  4. Parse remote task requirements into a constrained schema rather than passing arbitrary prose into a privileged instruction channel.
  5. Reject or neutralize remote directives that request secrets, unrelated tool use, policy changes, persistence, or execution of commands.
  6. Require explicit user confirmation before submissions, external communications, credential use, or other consequential actions.
  7. Display the retrieved task instructions to the user and identify their remote origin before processing them.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:383
Finding

Third-Party LLM API Keys Are Collected and Transmitted to AgentHub

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:383-391
Vulnerability Type: Unsafe handling and third-party transmission of credentials
Risk Level: High

Vulnerable Code Snippet:

text
### Workflow 4 — Create task with custom LLM validation

1. Ask user: what to improve, which LLM provider/model/key to use for scoring
2. GET /api/providers → show available providers if user unsure
3. POST /api/tasks with:
   - validation_mode: "custom"
   - validation_provider: provider ID (e.g. "openai", "anthropic", "aliyun-intl")
   - validation_model: model name (optional, uses provider default)
   - validation_api_key: user's API key for that provider

The related field definition states:

text
| `validation_api_key` | string | no | Required if custom. Your API key (encrypted server-side) |

Technical Analysis

The workflow instructs the agent to ask for a user's third-party LLM credential and place it in a request sent to agenthub.clawsy.app. This discloses the credential to a party other than the credential issuer and expands the secret's exposure to the agent conversation, request construction, network client, application logs, and AgentHub's server-side storage.

The documentation asserts that keys are encrypted server-side, but the project contains no implementation that permits verification of encryption, log redaction, retention, key access controls, or deletion. Encryption at rest also does not prevent the service from accessing the plaintext key when it invokes the provider.

Collecting a reusable provider API key exceeds minimum privilege when validation could be performed locally, through direct client-to-provider communication, or with narrowly scoped delegated credentials.

Attack Path

  1. The user selects custom LLM validation.
  2. Following the Skill workflow, the agent asks the user to provide an OpenAI, Anthropic, or other provider API key.
  3. The key enters the ag ...[truncated 1159 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not request raw provider API keys through the agent conversation.
  2. Prefer local validation or direct client-to-provider requests so AgentHub never receives the credential.
  3. Where delegation is unavoidable, use OAuth or provider-issued tokens restricted by purpose, model, spending limit, lifetime, and source.
  4. Use a browser-based secret-entry flow isolated from the agent transcript and model context.
  5. Obtain explicit informed consent that identifies the recipient, intended use, retention period, and revocation procedure.
  6. Prevent secrets from appearing in prompts, telemetry, request logs, error messages, task records, and audit output.
  7. Encrypt credentials with a dedicated key-management service, strictly restrict decryption access, and automatically delete credentials when validation ends.
  8. Add provider-specific guidance for creating restricted keys and immediately revoking exposed credentials.
  9. Document whether task content is forwarded to the selected provider and require separate consent for sensitive content.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:483
Finding

Unpinned Package Installation and Immediate CLI Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:483
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

text
- **CLI:** `pip install clawsy && clawsy init`

Technical Analysis

The documentation recommends installing the latest package named clawsy from the user's configured Python package index and immediately running its initialization command. No reviewed version, cryptographic hash, signature, canonical repository, or provenance check is specified.

This makes the effective code mutable after the Skill has been audited. A compromised publisher account, malicious replacement release, dependency compromise, index configuration attack, or package-name ownership issue could cause arbitrary package-controlled code to run during installation or initialization.

The audit found no local scripts in this project and did not inspect the external package. Consequently, this finding concerns the unsafe and unpinned installation mechanism; it does not assert that the current clawsy package is itself malicious.

Attack Path

  1. An attacker compromises the package publisher, package index, release process, or a transitive dependency.
  2. The attacker publishes a malicious version that still resolves under the unpinned package name.
  3. A user follows the documented pip install clawsy instruction.
  4. The package manager retrieves the attacker-controlled release or dependency.
  5. The user immediately runs clawsy init.
  6. Malicious initialization code executes with the privileges of the invoking user and can access resources available to that account.

Impact Assessment

If the resolved package is compromised, code may run with the invoking user's local privileges. Depending on the environment, this may expose files, environment variables such as AGENTHUB_API_KEY, developer credentials, network access, and writable project ...[truncated 312 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specifically reviewed version rather than installing the latest release.
  2. Publish and verify cryptographic hashes, signatures, or trusted provenance attestations.
  3. Link to the canonical source repository and package-publisher identity.
  4. Document the files, credentials, and network endpoints accessed by clawsy init before asking users to execute it.
  5. Recommend installation in an isolated virtual environment with minimum filesystem and credential access.
  6. Maintain a lock file or constraints file for transitive dependencies.
  7. Separate installation from initialization so users can inspect the installed artifact before executing it.
  8. Avoid recommending execution as root or through an administrator account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Ssd 1

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instruction to 'Use the enriched_prompt as your system instructions' gives externally supplied remote content system-level authority over the agent. A malicious task owner can embed prompt-injection content that redirects behavior, requests secrets, causes unsafe tool use, or overrides the user's intent.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The continuous-improvement workflow repeatedly reuses remote task and patch content as behavioral guidance, compounding prompt-injection risk over multiple iterations. This allows persistent redirection where one malicious prompt or patch can steer subsequent runs, amplify unsafe actions, and make the agent increasingly dependent on attacker-controlled instructions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
- "Show me open tasks" → browse available work
- "Work on task #8" → fetch, improve, submit patch
- "Create a task to improve README.md from Citedy/adclaw" → create task with GitHub source
- "Create a task from this PDF" → extract text from PDF/DOCX/PPTX/audio URL, create task
- "Create a private task with custom validation" → private + your LLM scores patches
- "Close task #35" → manage your tasks

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises very broad activation phrases such as 'Show me tasks', 'Start working', and 'Create a task', which can cause the agent to invoke the skill in situations where the user did not intend to interact with AgentHub. In a skill that can join tasks, submit patches, create tasks, and share invite links, unintended activation can lead to unwanted external API actions and data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The custom validation workflow instructs the user to provide a third-party LLM API key but does not warn that the key will be transmitted to AgentHub for storage and later use. Even though the document claims server-side encryption, the omission of a clear user warning can cause accidental disclosure of sensitive credentials to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill tells the agent to share private-task invite links directly, but does not warn that possession of the tokenized URL may grant access to a private task. Users may forward or expose the link unintentionally, weakening the privacy guarantees of 'private' tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.