ClawHub
Back to skill

Security audit

PostLake media

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its PostLake media-upload purpose, but its URL workflow can make an agent fetch and re-upload unintended internal or sensitive content.

Review before installing. Use this only with a PostLake account you trust and a scoped POSTLAKE_API_KEY, and have the agent upload only media you explicitly selected. Avoid letting it fetch arbitrary or untrusted URLs; prefer local files or trusted HTTPS media sources with size/type checks and a private temporary file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:28
Finding

Unrestricted Remote Media Retrieval Can Expose Internal Resources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–35
Vulnerability Type: Server-Side Request Forgery and unintended data disclosure
Risk Level: High

Vulnerable Code

bash
From a URL (download it first, then upload the bytes):

```bash
curl -sL "https://example.com/photo.jpg" -o /tmp/m.jpg
curl -X POST https://api.postlake.dev/v1/media \
 -H "Authorization: Bearer $POSTLAKE_API_KEY" \
 -H "Content-Type: image/jpeg" \
 --data-binary @/tmp/m.jpg

Technical Analysis

The documented workflow instructs the agent to retrieve a URL with curl -sL. The -L option follows redirects automatically, but the workflow does not validate the original destination or subsequent redirect targets. It also provides no restriction on schemes, hostnames, resolved IP addresses, response sizes, or actual response content.

If the media URL can be influenced by an untrusted user, it may reference a service available only from the agent's execution environment, including loopback interfaces, private-network services, or cloud metadata endpoints. An apparently legitimate public URL could also redirect to such a destination.

The response is subsequently uploaded to PostLake. This turns the workflow into a potential data-exfiltration channel because content retrieved from an internal destination is transmitted to an external service.

Attack Path

  1. An attacker supplies a media URL to the agent or controls a URL used by the workflow.
  2. The supplied URL targets an internal resource directly or redirects to localhost, a private network address, a link-local address, or a cloud metadata endpoint.
  3. The agent runs the documented curl -sL command and retrieves the resource from its privileged network position.
  4. The retrieved bytes are stored in /tmp/m.jpg.
  5. The workflow uploads those bytes to https://api.postlake.dev/v1/media.
  6. If the attacker can access the resulting media object, associat ...[truncated 635 chars]
Remediation
View remediation

Remediation Suggestions

  • Accept remote media only from explicitly trusted HTTPS hosts.
  • Resolve the destination before connecting and reject loopback, link-local, private, multicast, unspecified, and reserved IP ranges for both IPv4 and IPv6.
  • Disable automatic redirects or validate the hostname and resolved address at every redirect hop.
  • Protect against DNS rebinding by ensuring that the validated address is the address used for the connection.
  • Enforce strict download size and timeout limits.
  • Verify the actual file signature and MIME type rather than relying on the URL suffix or declared content type.
  • Require explicit user confirmation before fetching and externally uploading content from a user-provided URL.
  • Where practical, perform remote retrieval through a dedicated, network-isolated media proxy that cannot access internal services or cloud metadata endpoints.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Predictable Shared Temporary File Permits File Substitution and Symlink Attacks

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–35
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

bash
curl -sL "https://example.com/photo.jpg" -o /tmp/m.jpg
curl -X POST https://api.postlake.dev/v1/media \
 -H "Authorization: Bearer $POSTLAKE_API_KEY" \
 -H "Content-Type: image/jpeg" \
 --data-binary @/tmp/m.jpg

Technical Analysis

The workflow uses the fixed path /tmp/m.jpg in a directory that is commonly shared among local users and processes. It does not create the file atomically, verify ownership, reject symbolic links, set restrictive permissions, or remove the file after use.

A local attacker may pre-create /tmp/m.jpg as a symbolic link, potentially causing curl to overwrite another file writable by the agent. An attacker able to modify the shared temporary directory may also replace the file after the download and before the upload, causing arbitrary attacker-selected or sensitive local content to be transmitted to PostLake.

Concurrent skill executions can overwrite each other's downloads because every execution uses the same pathname. The downloaded media is also left on disk after the workflow completes.

Attack Path

  1. A local attacker predicts that the workflow will use /tmp/m.jpg.
  2. Before the download, the attacker creates that path as a symbolic link to another file writable by the agent; alternatively, the attacker waits for the download and replaces the temporary file before upload.
  3. The agent executes the documented commands without checking the file's ownership, type, or identity.
  4. In the symlink scenario, the download may overwrite the linked target.
  5. In the substitution scenario, curl --data-binary @/tmp/m.jpg uploads attacker-controlled or unintended local content to PostLake.

Impact Assessment

A successful attack may alter a local file within the agent process's existing write permis ...[truncated 406 chars]

Remediation
View remediation

Remediation Suggestions

  • Create a private temporary directory or file atomically with mktemp.
  • Set a restrictive umask, such as 077, before creating temporary content.
  • Use a cleanup trap so temporary files are removed on success, failure, or interruption.
  • Do not follow symbolic links when opening temporary output files.
  • Verify that the temporary file is a regular file owned by the current user before uploading it.
  • Avoid closing and reopening a path between download and upload where possible; retain and use the securely opened file descriptor.
  • Use a distinct temporary location for each invocation to prevent collisions between concurrent runs.

A safer shell pattern is:

bash
umask 077
tmpdir="$(mktemp -d)" || exit 1
trap 'rm -rf "$tmpdir"' EXIT
media_file="$tmpdir/media"
curl --fail --silent --show-error \
  --max-filesize 20971520 \
  "https://trusted.example/photo.jpg" \
  --output "$media_file"
curl -X POST https://api.postlake.dev/v1/media \
  -H "Authorization: Bearer $POSTLAKE_API_KEY" \
  -H "Content-Type: image/jpeg" \
  --data-binary "@$media_file"

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

From a local file:

bash
curl -X POST https://api.postlake.dev/v1/media \
 -H "Authorization: Bearer $POSTLAKE_API_KEY" \
 -H "Content-Type: image/jpeg" \
 --data-binary @photo.jpg

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

From a local file:

bash
curl -X POST https://api.postlake.dev/v1/media \
 -H "Authorization: Bearer $POSTLAKE_API_KEY" \
 -H "Content-Type: image/jpeg" \
 --data-binary @photo.jpg

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

From a local file:

bash
curl -X POST https://api.postlake.dev/v1/media \
 -H "Authorization: Bearer $POSTLAKE_API_KEY" \
 -H "Content-Type: image/jpeg" \
 --data-binary @photo.jpg

External Transmission

Medium
Category
Data Exfiltration
Confidence
72% confidence
Finding

The workflow instructs downloading media from an arbitrary URL and then uploading it onward, which can enable server-side request forgery–like behavior, retrieval of untrusted content, or relaying sensitive/internal resources if the URL source is not constrained. In an agent context, this is more dangerous because a user could cause the agent to fetch attacker-controlled or internal URLs and then transmit the resulting data to an external service.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
curl -sL "https://example.com/photo.jpg" -o /tmp/m.jpg
curl -X POST https://api.postlake.dev/v1/media \
 -H "Authorization: Bearer $POSTLAKE_API_KEY" \
 -H "Content-Type: image/jpeg" \
 --data-binary @/tmp/m.jpg

Static analysis

No suspicious patterns detected.