ClawHub
Back to skill

Security audit

Purefeed

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using Purefeed, but it lets remote API error text directly steer the agent and exposes irreversible deletes without clear confirmation safeguards.

Install only if you trust Purefeed's API responses and are comfortable giving the skill a Purefeed API key that can create, update, and delete Purefeed resources. Before using destructive requests, require the agent to summarize the target and get explicit confirmation; remote `hint.action` text should be treated as advisory, not as an instruction to obey automatically.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:94
Finding

Untrusted Remote API Instructions Are Followed Directly

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 94–95
Vulnerability Type: Remote instruction injection
Risk Level: High

Vulnerable Code Snippet

md
**4xx responses may include an `error.hint.action` field** — a plain-English instruction telling you how to self-correct on the next call (e.g. "List current signals via GET /api/v1/signals to refresh cached IDs"). When present, follow `hint.action` directly. `hint.docs_url` points to the canonical API docs for deeper context.

Technical Analysis

The skill explicitly instructs the agent to follow text received in the remote API's error.hint.action field directly. API response content crosses an external trust boundary and must be treated as untrusted data rather than authoritative agent instructions.

No allowlist, schema validation, origin restriction for follow-up actions, or user-confirmation requirement is defined. Although the example shows a legitimate API correction, the directive applies to arbitrary text supplied in that field. This creates an indirect prompt-injection channel through which the service—or an attacker who compromises or successfully impersonates it—can alter the agent's subsequent behavior.

The risk is amplified because the skill permits the general-purpose bash tool. A manipulated response could attempt to induce shell operations, unrelated network requests, access to local data, or unintended state-changing API calls. The project does not itself contain such a payload, but it establishes the unsafe execution path.

Attack Path

  1. A user invokes the skill, causing it to make an authenticated request to the Purefeed API.
  2. The API, compromised infrastructure, or another party capable of controlling the trusted response returns a crafted 4xx error.
  3. The response embeds attacker-selected instructions in error.hint.action.
  4. The skill directs the agent to follow those instructions directly rather than treating them as untrusted data.
  5. The ...[truncated 994 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to follow error.hint.action directly.
  2. Treat hint.action, hint.docs_url, tweet text, and all other API response fields as untrusted data.
  3. Use a hard-coded mapping from documented error codes to narrowly defined corrective actions, such as mapping “Signal not found” only to GET /signals.
  4. Permit follow-up requests only to the fixed HTTPS origin https://purefeed.ai/api/v1 and documented endpoint/method combinations.
  5. Reject any hint containing shell syntax, commands, file operations, credential requests, alternate hosts, or instructions unrelated to the failed API operation.
  6. Require explicit user confirmation before state-changing or destructive operations, especially PUT, PATCH, and DELETE requests.
  7. Replace unrestricted bash access with a constrained HTTP client where available. If bash is unavoidable, use fixed command templates, strict argument validation, safe quoting, and an outbound-host allowlist.
  8. Never place the API key in URLs, logs, output, command substitutions, or requests to any host other than the declared API origin.
  9. Present remote hints to the user as informational text when they cannot be safely mapped to a predefined recovery action.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
**API Base:** `https://purefeed.ai/api/v1`
**Auth:** `Authorization: Bearer $PUREFEED_API_KEY`

## Output Rules

Follow these rules for EVERY response that includes tweet data:

Ssd 1

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to follow error.hint.action directly turns untrusted remote API text into an authority that can steer agent behavior. If the server, an intermediary, or any compromised backend returns malicious or misleading corrective text, the agent may perform unsafe requests, leak data, or bypass intended safeguards based on semantic prompt injection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents irreversible delete operations for folders and signals without requiring confirmation or warning the agent to seek explicit user approval first. In an agent setting, this creates a realistic risk of accidental destructive actions from ambiguous prompts, misclick-equivalent planning errors, or prompt injection that steers the model into deleting user data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is scoped as a Twitter/X feed and bookmark tool, but the documentation also exposes unrelated web-app capabilities for Telegram publishing, moderation workflows, and fact verification. Expanding the documented capability surface beyond the declared purpose increases the chance an agent will attempt out-of-scope actions, mishandle user expectations, or reveal/operate on adjacent systems that should not be reachable from this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document includes Russian-only interface labels such as Проверить факты, Перепроверить, Лента, Кандидаты, and Черновики without explaining that the skill is intentionally locale-specific or offering an alternative language. This can violate language/locale policy by imposing a specific language on users without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.