ClawHub
Back to skill

Security audit

adserFB1

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible ad-operations assistant, but it asks the agent to use broad external search, scraping, credentials, and an unrestricted REST API tool without enough limits or user disclosure.

Review before installing. Use this only if you can restrict the connected tools and API keys to least-privilege, preferably read-only access. Require confirmation before any `http_request`, POST, or account-changing action, and avoid including confidential campaign, customer, or account data in competitor research prompts unless you are comfortable sending it to external services.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill is presented as a Telegram-first ad-operations assistant, but its documented toolset materially expands into broad web search, scraping, and arbitrary external API access. That mismatch weakens least-privilege boundaries and can cause the agent to exfiltrate data or perform research/actions well outside the user’s expected ad-ops scope.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The instruction to use a generic `http_request` tool that can call ANY REST API gives the skill an effectively open-ended network primitive unrelated to its stated role. In an LLM-driven workflow, this substantially increases the risk of SSRF-like behavior, data exfiltration to attacker-controlled endpoints, unauthorized third-party actions, and bypass of intended connector restrictions.

Missing User Warnings

High
Confidence
91% confidence
Finding
The skill directs the agent to perform external searches, scraping, and API calls without clearly warning about privacy, data transfer, or third-party processing. In context, this is dangerous because ad-ops workflows can involve sensitive business data, competitor intelligence, account identifiers, and user-provided URLs that may be transmitted to external services without informed consent.

Static analysis

No suspicious patterns detected.