ClawHub
Back to skill

Security audit

Polar

Security checks for vulnerabilities and agentic risk

Overview

The Polar features fit the stated purpose, but setup can execute an unverified remote installer without a separate user decision.

Review setup before installing. Install a verified CLI version yourself, approve local changes separately, and restrict Polar access to the data needed. Check the CLI's automatic skill synchronization. Remote installer contents and backend behavior remain unverified; the artifacts do not establish malicious intent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The supplied command performs remote installer execution rather than searching or reading Polar data. Nothing in the chunk establishes that this installer is a supporting dependency for Polar access, so its software-installation behavior and external resource are not represented by the declared purpose. The installer's contents and resulting system changes are not visible in the supplied code.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- `get_subscription` — Get a Polar subscription by ID.
- `list_customers` — List Polar customers with optional organization, email, search, activity, and metadata filters.
- `list_orders` — List Polar orders with optional organization, product, customer, checkout, subscription, and metadata filters.
- `list_organizations` — List Polar organizations accessible to the Organization Access Token.
- `list_products` — List Polar products with optional organization, name, visibility, and metadata filters.
- `list_subscriptions` — List Polar subscriptions with optional organization, product, customer, status, cancellation, and metadata filters.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping a remotely fetched script directly into Bash executes whatever the installation endpoint returns without checking a pinned version, trusted digest, or signature. HTTPS protects transport but not against a compromised publisher or distribution endpoint; such a compromise could execute code with the agent's permissions and access local files or credentials.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

The setup workflow executes downloaded installation scripts without warning about third-party code execution or local system changes.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The missing-CLI fallback directs the agent to execute third-party installation code without requiring user approval or explaining local system changes. Although this is a legitimate dependency setup step and only runs conditionally, a read-only Polar request should not implicitly authorize arbitrary code execution with the agent process's local permissions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources