ClawHub
Back to skill

Security audit

1

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its spreadsheet-management purpose, but its ready-to-run examples can modify or delete remote spreadsheets without confirmation.

Review before installing. Use this skill only with a MaybeAI token whose permissions are limited to the spreadsheets you intend to manage, and do not run the bundled scripts against production documents unless you have read the whole script and are comfortable with every operation it will perform. Prefer copying or backing up spreadsheets first, and require explicit confirmation before delete, clear, overwrite, export, or worksheet/file-management actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/04-rows-columns.sh:20
Finding
Ready-to-run example scripts execute destructive spreadsheet operations without confirmation## Vulnerability Details **File Locations**: - `SKILL.md:27-35` - `scripts/01-file-management.sh:44-58` - `scripts/03-write-data.sh:43-49` - `scripts/04-rows-columns.sh:20-26` - `scripts/04-rows-columns.sh:60-66` - `scripts/05-worksheets.sh:53-59` - `scripts/07-charts-pictures.sh:76-80` - `scripts/07-charts-pictures.sh:104-108` **Vulnerability Type**: Unconditional destructive operations in executable examples **Risk Level**: Medium The documentation presents the scripts as ready-to-run commands: ```bash bash scripts/01-file-management.sh bash scripts/02-read-data.sh bash scripts/03-write-data.sh bash scripts/04-rows-columns.sh bash scripts/05-worksheets.sh bash scripts/06-formulas.sh bash scripts/07-charts-pictures.sh bash scripts/08-formatting.sh bash scripts/09-end-to-end.sh ``` However, several scripts execute every embedded API operation sequentially, including destructive operations. For example, `scripts/03-write-data.sh:43-49` clears a cell range without requesting confirmation: ```bash # ── Clear Range ─────────────────────────────────────────────────────────────── echo "=== Clear Range ===" curl -s -X POST "$BASE_URL/api/v1/excel/clear_range" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\", \"range\": \"D1:F10\"}" \ | jq . ``` `scripts/04-rows-columns.sh:20-26` deletes rows unconditionally: ```bash # ── Delete Rows ─────────────────────────────────────────────────────────────── echo "=== Delete Rows ===" curl -s -X POST "$BASE_URL/api/v1/excel/delete_rows" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\", \"row\": 5, \"count\": 2}" \ | jq . ``` `scripts/04-rows-columns.sh:60-66` similarly deletes a column: ```bash # ── Delete Columns ─────────────────────────────────────────────────────── ...[truncated 3628 chars]
Remediation
## Remediation Suggestions 1. Convert each script into a single-operation command or require an explicit operation argument, such as `--delete-rows` or `--clear-range`. 2. Require an explicit confirmation flag for destructive actions, for example `--confirm-delete`. 3. Add an interactive confirmation prompt that displays the document ID, worksheet, range, and exact operation before sending the request. 4. Default to a dry-run mode that prints the proposed request without submitting it. 5. Refuse placeholder identifiers such as `your_document_id_here` and validate all required parameters. 6. Recommend or automatically create a document copy or recoverable version before destructive changes. 7. Add prominent warnings to `SKILL.md` explaining that the scripts currently execute every operation in sequence. 8. Add strict shell error handling: ```bash set -euo pipefail ``` 9. Use `curl --fail-with-body --show-error` so API failures stop execution and remain visible. 10. Separate read-only demonstrations from mutation and deletion examples. Destructive examples should not run as part of a general-purpose workflow. 11. Require the user or Agent to explicitly authorize deletion separately from ordinary editing operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (78)

Missing User Warnings

High
Confidence
97% confidence
Finding
The delete operation performs an irreversible remote action with no confirmation, dry-run mode, or safety check. In this skill context, spreadsheet files may be business-critical, so accidental execution can cause data loss or destructive changes in a remote account.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents and encourages shell-based execution via multiple curl/bash scripts, but the manifest does not declare any tool scope or allowed-tools restrictions. This creates a capability mismatch where an agent may invoke shell access more broadly than users or the platform expect, increasing the chance of unauthorized file/network operations and secret exposure through environment variables.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The description authorizes essentially the full spreadsheet lifecycle, including upload, edit, delete, export, versioning, and analysis, with very broad natural-language triggers. Overly broad invocation scope makes it easier for an agent to select this skill for ambiguous requests and perform sensitive or destructive actions on user spreadsheets without strong intent verification.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill advertises ready-to-run scripts for uploading, renaming, deleting, editing, and exporting spreadsheets, but provides no confirmation or warning model for destructive operations. In an agent setting, this omission can translate into silent data loss or unintended state changes if the agent follows the examples directly.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The file delete operation is documented as a simple API call with no warning about irreversibility, recovery limits, or required confirmation. Because this skill manages user documents, normalizing deletion without caution materially raises the risk of accidental or agent-initiated data destruction.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script uploads a local Excel file to a remote service without any warning about data sensitivity, third-party transmission, or trust boundaries. In a spreadsheet-management skill, users are likely to handle business or personal data, so silent transmission to an external endpoint increases the risk of unintended data disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Import File by URL ───────────────────────────────────────────────────────
echo "=== Import File by URL ==="
curl -s -X POST "$BASE_URL/api/v1/excel/import_by_url" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/data.xlsx"}' \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── List Files ───────────────────────────────────────────────────────────────
echo "=== List Files ==="
curl -s -X POST "$BASE_URL/api/v1/excel/list_files" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}' \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Search Files ─────────────────────────────────────────────────────────────
echo "=== Search Files ==="
curl -s -X POST "$BASE_URL/api/v1/excel/search_files" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keyword": "sales"}' \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Rename File ──────────────────────────────────────────────────────────────
DOC_ID="your_document_id_here"
echo "=== Rename File ==="
curl -s -X POST "$BASE_URL/api/v1/excel/rename_file" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\", \"name\": \"renamed_sales_report.xlsx\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Delete File ──────────────────────────────────────────────────────────────
echo "=== Delete File ==="
curl -s -X POST "$BASE_URL/api/v1/excel/delete_file" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Export (Download) File ───────────────────────────────────────────────────
echo "=== Export File ==="
curl -s -o "./exported.xlsx" \
  "$BASE_URL/api/v1/excel/export/$DOC_ID"
echo "Saved to ./exported.xlsx"
Confidence
78% confidence
Finding
The export/download call fetches a remote document without any Authorization header, implying either unauthenticated access or undocumented token handling. If the endpoint is publicly accessible by document ID alone, spreadsheet data could be exposed to anyone who can guess or obtain an ID; this is more concerning in a file-management skill dealing with potentially sensitive business data.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── List Worksheets ───────────────────────────────────────────────────────────
echo "=== List Worksheets ==="
curl -s -X POST "$BASE_URL/api/v1/excel/list_worksheets" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── List Worksheets with Version Info ────────────────────────────────────────
echo "=== List Worksheets (with versions) ==="
curl -s -X POST "$BASE_URL/api/v1/excel/list_worksheets_version" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Read Sheet ────────────────────────────────────────────────────────────────
echo "=== Read Sheet ==="
curl -s -X POST "$BASE_URL/api/v1/excel/read_sheet" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Read Headers ─────────────────────────────────────────────────────────────
echo "=== Read Headers ==="
curl -s -X POST "$BASE_URL/api/v1/excel/read_headers" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── List Versions ─────────────────────────────────────────────────────────────
echo "=== List Versions ==="
curl -s -X POST "$BASE_URL/api/v1/excel/list_versions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Read a Specific Version ───────────────────────────────────────────────────
echo "=== Read Version ==="
curl -s -X POST "$BASE_URL/api/v1/excel/read_version" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\", \"version\": \"v1\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Update Range ──────────────────────────────────────────────────────────────
echo "=== Update Range ==="
curl -s -X POST "$BASE_URL/api/v1/excel/update_range" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends a bearer API token and document identifier to a remote service in multiple curl requests without any user-facing notice, host validation prompt, or guidance about the sensitivity of the data being transmitted. In the context of an agent skill that may be run by users as-is, this increases the risk of unintentional credential and document disclosure to an external platform.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Update Range by Lookup ────────────────────────────────────────────────────
# Finds the row where lookup_column == lookup_value and updates the given fields
echo "=== Update Range by Lookup ==="
curl -s -X POST "$BASE_URL/api/v1/excel/update_range_by_lookup" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script performs destructive write operations such as clear_range and write_new_sheet directly against a remote spreadsheet without any confirmation, dry-run mode, backup step, or guardrails. This creates a realistic risk of accidental data loss or unintended overwrites if the wrong DOC_ID, sheet, or range is provided.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Clear Range ───────────────────────────────────────────────────────────────
echo "=== Clear Range ==="
curl -s -X POST "$BASE_URL/api/v1/excel/clear_range" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"uri\": \"$DOC_ID\", \"sheet\": \"Sheet1\", \"range\": \"D1:F10\"}" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Append Rows ───────────────────────────────────────────────────────────────
echo "=== Append Rows ==="
curl -s -X POST "$BASE_URL/api/v1/excel/append_rows" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Write New Sheet (full data at once) ───────────────────────────────────────
echo "=== Write New Sheet ==="
curl -s -X POST "$BASE_URL/api/v1/excel/write_new_sheet" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.