ClawHub
Back to skill

Security audit

SolidPod-Data

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a legitimate SOLID Pod tool, but it can use your authenticated Pod credentials against arbitrary URLs and has write behavior that could unintentionally replace data.

Review this skill before installing if your SOLID Pod contains sensitive data. Only use it with Pod and IDP URLs you trust, verify every target URL before reads or writes, and be especially careful with delete, write, acl grant, and acl revoke because they can remove data or change sharing permissions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/pod.js:129
Finding

Unrestricted User-Supplied URLs Reach Authenticated Network Operations

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/pod.js:188
Finding

Dataset Write Converts Every Read Failure into a Destructive Create-or-Replace Operation

Content
View full analysis
<${predicate}> "${object}"`); } ``` ### Technical Analysis The function assumes that every exception from `getSolidDataset()` means the resource does not exist. In reality, the read can fail because of authentication errors, authorization failures, timeouts, DNS errors, server failures, malformed RDF, content negotiation problems, or other transient conditions. After any such failure, the function creates an empty local dataset, adds only the requested Thing, and saves that dataset to the original URL. If a dataset already exists and the server permits replacement, this operation can overwrite or truncate its previous contents. This violates safe create-versus-update semantics. A new resource should only be created after a verified `404 Not Found`, and creation should be conditional to prevent races. ### Attack Path 1. A ...[truncated 1195 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The skill description overstates or misstates security-relevant behavior, including claiming access-control management and pod provisioning capabilities that are not actually implemented, while omitting custom area/topic index management from the top-level description. This can mislead users and policy engines about what the skill really does, causing unsafe trust assumptions, inappropriate approvals, or misuse of the skill in higher-privilege contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file lists commands that create, write, delete, change access controls, and provision pods, but it does not clearly warn users about risks to data integrity, privacy, or irreversible changes. Although the Security section mentions credential handling and ACL confirmation, it does not disclose the impact of deletion, writes, access grants/revokes, or pod creation on user data and system state.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares powerful capabilities via metadata and documented behavior that require environment access and arbitrary network access, but it does not explicitly scope or constrain those permissions. In an agent environment, missing tool-scope declarations weaken policy enforcement and user awareness, increasing the chance of overbroad network use or unintended access to sensitive environment-backed credentials.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description states the skill can 'manage access control' and 'provision new SOLID Pods'. In this file, there is no code for ACL/WAC/ACP management, and the createPod function explicitly documents and performs only instruction output rather than actual pod creation, creating a mismatch between advertised capability and implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The CLI routes the delete command directly to deleteResource(sub) after only checking that a URL was provided. Although the usage text names the command delete, there is no confirmation prompt or explicit warning here that the operation is destructive and may permanently remove pod data.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency uses a caret version range, which allows newer minor and patch releases to be installed over time. This creates a supply-chain risk because a compromised or breaking upstream release could be pulled into future installs without explicit review; in a skill that handles SOLID Pod data and authentication libraries, that risk is somewhat more sensitive than in a purely local utility.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"start": "node scripts/solidpod-data.js"
  },
  "dependencies": {
    "@inrupt/solid-client": "^2.1.0",
    "@inrupt/solid-client-authn-node": "^2.5.0",
    "@inrupt/vocab-common-rdf": "^1.0.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

This authentication-related dependency is not pinned to an exact version, so future installs may resolve to different code than originally tested. Because this package is used for SOLID authentication, an upstream compromise or unsafe regression could affect credential handling or session security, making the supply-chain exposure more concerning in context.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
},
  "dependencies": {
    "@inrupt/solid-client": "^2.1.0",
    "@inrupt/solid-client-authn-node": "^2.5.0",
    "@inrupt/vocab-common-rdf": "^1.0.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

Using a non-exact version for this RDF vocabulary package allows dependency drift across installations. While this package is likely lower risk than the auth component, any unpinned third-party package still expands supply-chain attack surface and can introduce unexpected behavior or malicious code if the upstream distribution is compromised.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
"dependencies": {
    "@inrupt/solid-client": "^2.1.0",
    "@inrupt/solid-client-authn-node": "^2.5.0",
    "@inrupt/vocab-common-rdf": "^1.0.0"
  },
  "engines": {
    "node": ">=18.0.0"