ClawHub
Back to skill

Security audit

Onemind Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it deserves review because it directs agents to create and modify live OneMind records while its documentation shows weak scoping, credential-handling, and authorization concerns.

Review before installing. Only use this with explicit user approval for each join, proposition, and rating submission; avoid sensitive content or real personal display names; treat returned access tokens as secrets; and prefer a staging OneMind/Supabase environment until the participant ownership validation and production test-data practices are fixed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
EDGE_FUNCTION_SPEC.md:14
Finding

Rating Endpoint Specification Does Not Require Authenticated Participant Ownership Validation

Content
View full analysis

Vulnerability Details

File Location: EDGE_FUNCTION_SPEC.md, lines 14-72
Vulnerability Type: Missing object-level authorization before privileged database writes
Risk Level: High

Vulnerable Code

json
{
  "round_id": 112,
  "participant_id": 224,
  "ratings": [
    {"proposition_id": 440, "grid_position": 100},
    {"proposition_id": 441, "grid_position": 0},
    {"proposition_id": 442, "grid_position": 75},
    {"proposition_id": 443, "grid_position": 25}
  ]
}
markdown
## Server-Side Validations

1. **Phase check**: Round must be in "rating" phase
2. **One-time check**: Participant must NOT have already submitted for this round
3. **Binary check**: MUST contain at least one 100 and at least one 0
4. **Range check**: All values must be 0-100
5. **Own prop check**: Cannot rate own propositions
6. **Duplicate check**: No duplicate proposition_ids in array
markdown
1. Disable direct POST to `/rest/v1/grid_rankings` via RLS
2. Route all ratings through `/functions/v1/submit-ratings`
3. Edge Function performs all validations atomically
4. Insert to `grid_rankings` via supabaseAdmin client

Technical Analysis

The API accepts a client-controlled participant_id, but the documented server-side validation list does not require verification that this participant belongs to the user identified by the authenticated JWT. Checking whether a participant has submitted, owns a proposition, or supplied valid ratings is not equivalent to verifying ownership of the participant identity.

The specification also states that the Edge Function writes through a supabaseAdmin client. Such a service-role client bypasses row-level security. Consequently, authorization must be explicitly enforced before the privileged write occurs.

The actual Edge Function source referenced by the specification is absent from the audited project, so an undocumented compensating ownersh ...[truncated 1441 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not accept participant_id as an authoritative client-selected identity.
  • Validate the bearer JWT and obtain the user identity from the verified token.
  • Resolve the participant server-side using the authenticated user ID and requested chat or round.
  • Enforce that participants.user_id equals the authenticated auth.uid() before performing any write.
  • Reject requests where the participant is absent, belongs to another user, or is not a member of the relevant chat.
  • Keep service-role credentials exclusively on the server and use them only after all authorization checks pass.
  • Add negative tests that attempt to submit using another participant's ID.
  • Add transaction-level protections so the ownership check, rating insertion, and one-time submission record are processed atomically.
  • Include the actual Edge Function source in the project so its authorization behavior can be reviewed and tested.

T09 · Insecure Skill Coding Practices

Warning
Location
TEST_REPORT_V2.md:33
Finding

Production Bearer Token Recorded in Test Documentation

Content
View full analysis

Vulnerability Details

File Location: TEST_REPORT_V2.md, lines 33-37
Vulnerability Type: Sensitive authentication credential exposure
Risk Level: Medium

Vulnerable Code

markdown
## Test 5: POST /auth/v1/signup
```json
{"access_token":"eyJhbGciOiJFUzI1NiIsImtpZCI6IjM1Y2UzZjRjLTc0ZGQtNDZjZC1iMmZkLTMyZTA5ZjAwMzJjZiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2NjeXV4cnRya2xncGt6Y3J5enBqLnN1cGFiYXNlLmNvL2F1dGgvdjEiLCJzdWIiOiI5NDg1NzRkZS1lODVhLTRlN2EtYmE5Ni00YzY1YWMzMGNhOGYiLCJhdWQiOiJhdXRoZW50aWNhdGVkIiwiZXhwIjoxNzcwMjk4MDE3LCJpYXQiOjE3NzAyOTQ0MTcsImVtYWlsIjoiIiwicGhvbmUiOiIiLCJhcHBfbWV0YWRhdGEiOnt9LCJ1c2VyX21ldGFkYXRhIjp7fSwicm9sZSI6ImF1dGhlbnRpY2F0ZWQiLCJhYWwiOiJhYWwxIiwiYW1yIjpbeyJtZXRob2QiOiJhbm9ueW1vdXMiLCJ0aW1lc3```

USER_ID: 948574de-e85a-4e7a-ba96-4c65ac30ca8f

Technical Analysis

The test report embeds part of a production-issued Supabase bearer token and its associated user ID. Bearer tokens are credentials: possession of a complete, valid token is generally sufficient to act as the corresponding user until the token expires or is revoked.

The token shown in the audited file is truncated and appears historical, which limits its immediate exploitability. Nevertheless, writing live authentication responses into persistent test reports establishes an unsafe credential-handling pattern. Future executions could record a complete and unexpired token in source control, build artifacts, logs, or shared reports.

Attack Path

  1. A test is run against the production Supabase environment.
  2. The complete authentication response is copied into a test report or log.
  3. An attacker with repository, artifact, or log access extracts the bearer token.
  4. Before expiration or revocation, the attacker supplies it in an Authorization: Bearer header.
  5. The attacker performs the operations permitted to that anonymous authenticated user, including joining chats and attempting state-changing API calls.

Th ...[truncated 582 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove authentication tokens from committed reports and replace them with clearly synthetic placeholders.
  • Revoke or invalidate any sessions whose complete tokens may have been exposed.
  • Configure test tooling to redact access_token, refresh_token, Authorization, and cookie values automatically.
  • Do not print raw authentication responses in CI logs or shared artifacts.
  • Store temporary credentials only in protected environment variables or an approved secret store.
  • Run automated secret scanning in pre-commit hooks and CI.
  • Use an isolated test Supabase project rather than the production backend.
  • Retain only non-sensitive fields needed to demonstrate the test result, such as the HTTP status and a synthetic user identifier.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
DEPLOYMENT.md:23
Finding

Submission Tracking Records Are Readable Without Ownership Restrictions

Content
View full analysis

Vulnerability Details

File Location: DEPLOYMENT.md, lines 23-27
Vulnerability Type: Excessively permissive row-level security policy
Risk Level: Medium

Vulnerable Code

sql
-- Only allow reads (insert handled by Edge Function via service role)
CREATE POLICY "Allow read access" 
  ON round_participant_submissions 
  FOR SELECT USING (true);

Technical Analysis

The RLS predicate USING (true) authorizes every applicable database role to read every row in round_participant_submissions. The table contains round_id, participant_id, and submitted_at, which reveals which participant submitted during which round and when.

The documentation does not identify a functional requirement for unrestricted access to individual submission records. Publicly exposing these records therefore exceeds least privilege. The data can also facilitate participant enumeration and improve the reliability of attacks against endpoints that accept client-selected participant IDs.

RLS being enabled does not provide meaningful read isolation when the policy condition always evaluates to true.

Attack Path

  1. The attacker authenticates anonymously or uses any role covered by the read policy.
  2. The attacker queries round_participant_submissions.
  3. The database returns submission records for participants other than the attacker.
  4. The attacker maps participant IDs to rounds and submission timing.
  5. The attacker uses this metadata for activity surveillance or to select participant IDs for object-level authorization attacks against rating endpoints.

Impact Assessment

The policy discloses participation and timing metadata across all stored rounds. It does not itself authorize inserts or administrative operations, but it weakens privacy and supplies identifiers that can support participant impersonation attempts.

The affected scope includes every row in round_participant_submissions visible to ...[truncated 35 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the unrestricted FOR SELECT USING (true) policy.
  • Permit users to read only records associated with participant rows they own.
  • Derive ownership through the authenticated user identity rather than a client-supplied participant ID.
  • Restrict full-table access to trusted administrative roles.
  • If clients only need to know whether they have submitted, expose a narrowly scoped server-side endpoint returning a boolean for the authenticated participant.
  • If aggregate statistics are required, expose non-identifying aggregate counts rather than raw participant-level records.
  • Add RLS tests confirming that one authenticated user cannot read another participant's submission records.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 125)May include surrounding context.

md
### Phase 6: Clean Up

**Update SKILL.md referencing:**
- ✅ Already updated with new endpoint
- ✅ Old endpoint marked as deprecated

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 148)May include surrounding context.

md
### Phase 6: Clean Up

**Update SKILL.md referencing:**
- ✅ Already updated with new endpoint
- ✅ Old endpoint marked as deprecated

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · EDGE_FUNCTION_SPEC.md (reported line 138)May include surrounding context.

md
### Phase 6: Clean Up

**Update SKILL.md referencing:**
- ✅ Already updated with new endpoint
- ✅ Old endpoint marked as deprecated

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · TEST_REPORT_V2.md (reported line 6)May include surrounding context.

OneMind API Test Report V2

Date: Thu Feb 5 07:26:56 AM EST 2026

Test 1: GET /rest/v1/chats?id=eq.87

text
[{"id":87,"name":"Welcome to OneMind","description":null,"is_official":true}]
HTTP_CODE:200

Test 2: GET /rest/v1/cycles?chat_id=eq.87&select=rounds(*)

json
[{"id":50,"chat_id":87,"rounds":[{"id": 112, "phase": "rating", "custom_id": 2, "phase_ends_at": "2026-02-05T12:51:00+00:00", "phase_started_at": "2026-02-05T03:17:00.916+00:00", "winning_proposition_id": null}, {"id": 111, "phase": "rating", "custom_id": 1, "phase_ends_at": "2026-02-03T19:58:00+00:00", "phase_started_at": "2026-02-02T02:16:02.279+00:00", "winning_proposition_id": 434}]}]
HTTP_CODE:200

Test 3: GET /rest/v1/propositions?round_id=eq.112

json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 97)May include surrounding context.

2. Manual test via curl:

bash
# Replace with real ANON_KEY and get fresh token
curl -s -X POST "https://ccyuxrtrklgpkzcryzpj.supabase.co/functions/v1/submit-ratings" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · EDGE_FUNCTION_SPEC.md (reported line 108)May include surrounding context.

NEW ENDPOINT - One submission per round, binary required.

bash
curl -s -X POST "https://ccyuxrtrklgzcryzpj.supabase.co/functions/v1/submit-ratings" \
  -H "apikey: [ANON_KEY]" \
  -H "Authorization: Bearer [ACCESS_TOKEN]" \
  -H "Content-Type: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The authentication section tells the agent to obtain and use access tokens and user identifiers for a third-party Supabase service but omits any warning about handling, storing, or transmitting those credentials. This can lead to inadvertent leakage of bearer tokens or correlation of user identity across requests, especially if logs, prompts, or tool traces capture them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

This step initiates an outbound request to a third-party authentication endpoint and returns an access token and user ID, creating an external transmission of identity and session data. In context this is intended functionality, but it is still security-relevant because it causes credential issuance and data sharing with an external service without any embedded privacy or trust warning.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Step 1: Get Anonymous Token

bash
curl -s -X POST "https://ccyuxrtrklgpkzcryzpj.supabase.co/auth/v1/signup" \
  -H "apikey: [ANON_KEY]" \
  -H "Content-Type: application/json" \
  -d '{}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to join chats, submit propositions, and submit ratings to a third-party service without warning that these actions create persistent records tied to a participant identity. This is dangerous because an agent or user may unknowingly publish content or metadata externally, creating privacy, consent, and unintended data disclosure risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This request sends user-linked data, including user_id and display_name, to a third-party participants endpoint to create a chat participant record. That is a real external transmission and, without warning or consent language, can cause unintended publication or retention of identity-related information on the remote platform.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Step A: Join the chat

bash
curl -s -X POST "https://ccyuxrtrklgpkzcryzpj.supabase.co/rest/v1/participants" \
  -H "apikey: [ANON_KEY]" \
  -H "Authorization: Bearer [ACCESS_TOKEN]" \
  -H "Content-Type: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document demonstrates live queries against a production Supabase instance and shows returned chat records from what appears to be real data, without any privacy warning, sanitization statement, or indication that this is a safe test dataset. Even if only anonymous-accessible fields are queried, publishing or normalizing production data access in skill documentation can encourage unnecessary exposure and weaken data-handling discipline.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · TEST_REPORT.md (reported line 9)May include surrounding context.

Test 1: GET /chats?id=eq.87 - Get Chat Info

bash
curl -s "https://ccyuxrtrklgpkzcryzpj.supabase.co/rest/v1/chats?id=eq.87&select=id,name,description,is_active,is_official" -H "apikey: ${ANON_KEY}" -H "Authorization: Bearer ${ANON_KEY}"

Response:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Labeling the skill as 'PRODUCTION READY' despite untested or only partially validated write paths creates a false assurance that security controls and data-modifying endpoints have been fully verified. In a production API skill, this increases the chance of exposing users to integrity issues, failed writes, or overlooked authorization problems.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The report asserts that POST /ratings is working even though the report explicitly says that test was skipped and no successful request/response evidence is included. This can mislead reviewers into trusting unvalidated write functionality and may cause deployment of a skill with broken or unsafe behavior around ratings submission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The report includes concrete write operations against a live-looking service, including anonymous signup, joining a chat, submitting content, and posting rankings, but provides no warning that these actions modify remote state or create accounts. In an agent-skill context, this can cause unintended side effects, unauthorized test data creation, and accidental interaction with production systems if reused as operational guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · test_submit_ratings.sh (reported line 16)May include surrounding context.

sh
# Step 1: Anonymous Auth
echo "Step 1: Authenticating..."
AUTH_RESP=$(curl -s -X POST "$BASE_URL/auth/v1/signup" \
  -H "apikey: $ANON_KEY" \
  -H "Content-Type: application/json" \
  -d '{}')

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · test_submit_ratings.sh (reported line 26)May include surrounding context.

sh
# Step 2: Join Chat
echo "Step 2: Joining chat..."
JOIN_RESP=$(curl -s -X POST "$BASE_URL/rest/v1/participants" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · test_submit_ratings.sh (reported line 59)May include surrounding context.

sh
# Step 6: Submit Batch Ratings (THE NEW ENDPOINT)
echo "Step 6: Testing POST /functions/v1/submit-ratings..."
RATING_RESULT=$(curl -s -X POST "$BASE_URL/functions/v1/submit-ratings" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:46