ClawHub
Back to skill

Security audit

predictalot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed client for a self-hosted forecasting service, with expected network data transfer and setup guidance rather than hidden or unrelated behavior.

Install only if you intend to send forecasting inputs to a predictalot instance you run or explicitly trust. Keep PREDICTALOT_URL pointed at localhost or a TLS-protected trusted endpoint, use a strong bearer token, avoid open-auth exposure, and confirm before deleting stored models.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" | jq

# Zero-shot univariate forecast: 5 steps ahead of one series, chronos-2.
curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The skill sends user-provided time-series data and bearer-authenticated requests to `PREDICTALOT_URL`, which is configurable and therefore can point to an untrusted or misconfigured remote service. Even though the documentation warns about external transmission, the skill still facilitates off-host exfiltration of potentially sensitive datasets and metadata if users set the URL unsafely or use plain HTTP.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" | jq -r '.models[].slug'

# 2. Forecast with chronos-2 (default all-rounder), 12 steps, three bands.
curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"chronos-2","context":[[100,102,101,105,110,108,112,115,120,118,125,130]],
Confidence
95% confidence
Finding
This example again demonstrates transmission of potentially sensitive forecasting input over the network to a configurable endpoint. The surrounding context makes clear the service is intentionally networked, but that does not remove the confidentiality risk if the endpoint is remote, compromised, or accessed over unsecured HTTP.

External Transmission

Medium
Category
Data Exfiltration
Content
"config":{"mode":"direction","horizon":3,"nEstimators":400}}' | jq

# 2. Forecast — LAST feature row is the anchor.
curl -s $PREDICTALOT_URL/v1/tabular/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"modelId":"trend-3","features":[{"rsi":[72],"mom":[0.8]}]}' | jq
Confidence
94% confidence
Finding
The tabular forecast example transmits model identifiers and engineered feature values to `PREDICTALOT_URL`, creating the same external data exposure risk as the time-series endpoints. Because tabular features can encode proprietary business logic or sensitive derived signals, sending them to an attacker-controlled or plain-HTTP endpoint could leak confidential information.

Static analysis

No suspicious patterns detected.