ClawHub
Back to skill

Security audit

Deep Research

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its research purpose, but it can make paid external requests and may send its API key to any configured gateway without strong origin safeguards.

Review before installing. Use it only for topics and URLs you are comfortable sending to an external research gateway and upstream providers. Keep RESEARCH_GATEWAY_URL unset unless you fully trust the custom gateway, and consider requiring explicit approval before the agent makes paid calls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/research.sh:11
Finding

API Credential Disclosure Through a User-Configurable Gateway

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi URL="${GATEWAY}${ENDPOINT}" if [[ -n "${RESEARCH_API_KEY:-}" ]]; then CURL_ARGS+=(-H "Authorization: Bearer ${RESEARCH_API_KEY}") fi ``` For deployments that genuinely require multiple gateways, replace the exact comparison with robust URL parsing and an administrator-controlled HTTPS origin allowlist. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/research.sh (reported line 2)May include surrounding context.

sh
#!/usr/bin/env bash
# deep-research gateway caller — handles x402 payment flow via curl
# Usage:
#   research.sh GET  /api/v1/research/papers/search '{"query":"restaking"}'
#   research.sh POST /api/v1/search/web '{"query":"ethereum restaking 2026"}'

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill exposes shell and network capabilities via a helper script that can send arbitrary requests, but it does not declare any explicit tool scope such as allowed tools, permitted hosts, or operation limits. This weakens sandboxing and policy enforcement, making it easier for the agent to invoke external services or shell functionality without clear user-visible boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages web search, web extraction, and gateway queries using user-supplied topics and URLs, but it does not clearly disclose that those inputs will be transmitted to third-party services. This creates privacy and data-handling risk, especially if users provide confidential research topics, internal URLs, or regulated data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation rule is overly broad because 'when the user asks you to research a topic' can match many ordinary prompts, causing the skill to engage automatically and potentially trigger paid network actions without clear consent. In this skill's context, broad activation is more dangerous because each call causes real external requests and micropayment charges.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.