ClawHub
Back to skill

Security audit

fellow-aiden

Security checks for vulnerabilities and agentic risk

Overview

The skill uses your Fellow account to create coffee recipes through a disclosed, user-controlled workflow, with no evidence of hidden data collection.

Supply your Fellow login through a secret manager, confirm the intended brewer, and review the proposed recipe before creation. The helper receives account credentials and uses an undocumented cloud API that may change; its dry run validates recipes without connecting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'req' from os.environ.get (line 52, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/aiden.py (reported line 59)May include surrounding context.

python
method=method,
    )
    try:
        with urlopen(req, timeout=20) as response:
            body = response.read()
            return json.loads(body) if body else None
    except HTTPError as exc:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/aiden.py (reported line 105)May include surrounding context.

python
},
    )
    if not isinstance(result, dict) or not isinstance(result.get("accessToken"), str):
        raise AidenError("Fellow login returned no access token")
    return result["accessToken"]

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.