ClawHub
Back to skill

Security audit

Doubleword API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Doubleword batch API guide, but users should treat uploaded prompts and downloaded results as sensitive third-party data processing.

Install only if you intend to send batch request files to Doubleword. Do not include secrets, credentials, regulated data, or sensitive personal data unless your organization approves that third-party processing. Protect downloaded `results.jsonl` and `errors.jsonl` files, and treat the optional `autobatcher` package install like any other third-party Python dependency.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:317
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 317-320
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install autobatcher

Technical Analysis

The Skill recommends installing autobatcher from the package index without specifying an exact version or verifying an integrity hash. Although the documentation links to the Doubleword GitHub organization, the installation command does not cryptographically bind the downloaded package to that repository, a reviewed release, or known-good artifacts.

Because package versions and transitive dependencies resolved by this command can change after the Skill has been audited, future installations may retrieve code that was not part of this review. Python packages may run code during installation, and installed package code executes with the privileges of the invoking user when imported or launched.

Attack Path

  1. An attacker compromises the autobatcher package publication account, package-index artifact, release process, or a transitive dependency.
  2. The attacker publishes a malicious package version or dependency update.
  3. A user follows the Skill's documented pip install autobatcher instruction.
  4. pip resolves and downloads the mutable, compromised package or dependency.
  5. Malicious code executes during installation or when the package is subsequently imported or used.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the application using the package. Depending on that user's access, the malicious package could read accessible files and environment variables, steal API keys, alter local project data, initiate network connections, or tamper with batch inputs and outputs. The Skill itself does not request elevated privileges, so the direct scope is ordinarily limited to the invoking user's permissi ...[truncated 4 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin autobatcher to an exact, reviewed version rather than allowing installation of the latest available release.
  2. Provide a locked requirements file containing cryptographic hashes and install it with pip install --require-hashes -r requirements.txt.
  3. Document the authoritative package index and source repository, and verify that package metadata corresponds to the intended publisher.
  4. Pin and audit transitive dependencies through a reproducible lock file.
  5. Recommend installation inside a dedicated virtual environment with no administrative privileges.
  6. Periodically scan the locked dependency set for known vulnerabilities and review updates before changing pins.
  7. Remove the installation recommendation if autobatcher is not necessary for the Skill's core batch-management functionality.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (20)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill repeatedly instructs users to upload batch request files containing prompts, tool definitions, and potentially sensitive workload data to a third-party API, but it does not explicitly warn that this transfers data off-system to Doubleword. In a batch-inference skill, external transmission is expected, but omission of a clear data-handling warning can lead users to unintentionally send confidential or regulated data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This command uploads a local JSONL batch file to Doubleword's external API using an authorization token, which is a direct external data transmission path. That is core functionality for the skill, but without explicit guardrails users may upload confidential prompts, embedded secrets, personal data, or proprietary datasets to a third party unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Via API:

bash
curl https://api.doubleword.ai/v1/files \
  -H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
  -F purpose="batch" \
  -F file="@batch_requests.jsonl"

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This command uploads a local JSONL batch file to Doubleword's external API using an authorization token, which is a direct external data transmission path. That is core functionality for the skill, but without explicit guardrails users may upload confidential prompts, embedded secrets, personal data, or proprietary datasets to a third party unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Via API:

bash
curl https://api.doubleword.ai/v1/files \
  -H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
  -F purpose="batch" \
  -F file="@batch_requests.jsonl"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Downloading results from the provider is an external transmission of potentially sensitive generated content and metadata back to the local environment, and the example immediately writes it to disk. In this context the risk is not malicious behavior, but the combination of third-party handling plus local persistence without warning increases chances of inadvertent disclosure.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Via API:

bash
curl https://api.doubleword.ai/v1/files/file-output123/content \
  -H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
  > results.jsonl

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Downloading the error file from the provider can expose failed request payload details, identifiers, validation errors, and other sensitive context, and the example writes that data directly to errors.jsonl. Error artifacts are often overlooked but may contain enough information to leak confidential input structure or operational details.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

Download errors (if any):

bash
curl https://api.doubleword.ai/v1/files/file-error123/content \
  -H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
  > errors.jsonl

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 6)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/getting_started.md (reported line 61)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/getting_started.md (reported line 67)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/getting_started.md (reported line 77)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/getting_started.md (reported line 81)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/getting_started.md (reported line 129)May include surrounding context.

Base URL

text
https://api.doubleword.ai/v1

Authentication

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a file upload workflow and later shows request bodies containing user message content, but it does not include any warning about privacy, sensitive data handling, or external transmission. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/getting_started.md (reported line 61)May include surrounding context.

bash
# 1. Upload file
curl https://api.doubleword.ai/v1/files \
  -H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
  -F purpose="batch" \
  -F file="@batch_requests.jsonl"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/getting_started.md (reported line 126)May include surrounding context.

python
# OpenAI
base_url = "https://api.openai.com/v1"

# Doubleword
base_url = "https://api.doubleword.ai/v1"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill shows commands that download batch outputs and error files directly into local files such as results.jsonl and errors.jsonl without warning that model outputs and failure details will be persisted on disk. If those files contain sensitive prompts, completions, identifiers, or error context, local storage may create avoidable exposure on shared systems or developer workstations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.