ClawHub
Back to skill

Security audit

predictalot

Security checks for vulnerabilities and agentic risk

Overview

This is a documented client for a self-hosted forecasting service, but it will send forecasting and training data to the server the user configures.

Install only if you control and trust the predictalot endpoint. Keep it bound to localhost unless you add TLS, a strong bearer token, and network access controls; avoid sending proprietary datasets to an untrusted URL. Pin the Docker image to a reviewed version or digest before production use, and confirm carefully before deleting stored models.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
For installation, configuration, and container setup, see [references/setup.md](references/setup.md).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
For installation, configuration, and container setup, see [references/setup.md](references/setup.md).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
- **Network-exposed** — predictalot is a plain HTTP + MCP service; anyone who can reach the port can call it. Set `PREDICTALOT_AUTH_TOKENS` to a strong generated secret (`$(openssl rand -hex 32)`) and bind to loopback (`-p 127.0.0.1:8080:8080`) by default. Only expose beyond loopback behind a reverse proxy / VPN, and never with the default/example token.
- **External transmission** — every forecast/train call sends your time series, engineered feature values, and/or `modelId`s to whatever `PREDICTALOT_URL` points at — that data leaves your host. Point it only at a service you run or explicitly trust; prefer HTTPS.
- **Consumer-only** — this skill talks to an instance you already run and trusts. It never provisions, starts, or hardens the server; that's the operator's job (see setup.md).
- **Destructive delete requires confirmation** — `DELETE /v1/tabular/models/{modelId}` permanently removes a trained model and cannot be undone. Only call it against a `modelId` you obtained from a prior `GET /v1/tabular/models` (or a train response) in this session, and get explicit user confirmation before issuing the delete.

## When To Use

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.

md
- **Network-exposed** — predictalot is a plain HTTP + MCP service; anyone who can reach the port can call it. Set `PREDICTALOT_AUTH_TOKENS` to a strong generated secret (`$(openssl rand -hex 32)`) and bind to loopback (`-p 127.0.0.1:8080:8080`) by default. Only expose beyond loopback behind a reverse proxy / VPN, and never with the default/example token.
- **External transmission** — every forecast/train call sends your time series, engineered feature values, and/or `modelId`s to whatever `PREDICTALOT_URL` points at — that data leaves your host. Point it only at a service you run or explicitly trust; prefer HTTPS.
- **Consumer-only** — this skill talks to an instance you already run and trusts. It never provisions, starts, or hardens the server; that's the operator's job (see setup.md).
- **Destructive delete requires confirmation** — `DELETE /v1/tabular/models/{modelId}` permanently removes a trained model and cannot be undone. Only call it against a `modelId` you obtained from a prior `GET /v1/tabular/models` (or a train response) in this session, and get explicit user confirmation before issuing the delete.

## When To Use

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 593)May include surrounding context.

md
For a driver that runs a univariate forecast and pretty-prints the interval, see [`scripts/predictalot.sh`](scripts/predictalot.sh):

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 598)May include surrounding context.

md
For a driver that runs a univariate forecast and pretty-prints the interval, see [`scripts/predictalot.sh`](scripts/predictalot.sh):

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This skill is explicitly designed to send user-supplied time series, engineered features, and model identifiers over HTTP(S) to a configured remote service. Even though the documentation warns about this behavior, it still creates a real data exfiltration channel if PREDICTALOT_URL is misconfigured, points to an untrusted host, or uses plaintext HTTP where traffic can be intercepted.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
-H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" | jq

# Zero-shot univariate forecast: 5 steps ahead of one series, chronos-2.
curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The MCP examples show authenticated JSON-RPC requests being sent to the remote /mcp endpoint, which can transmit model inputs and operational metadata off-host. Because the MCP surface mirrors forecasting functionality, it provides another path for sensitive data transmission and expands exposure if the endpoint is reachable by or redirected to an untrusted service.

Content

Scanner excerpt · SKILL.md (reported line 476)May include surrounding context.

bash
# tools/list — enumerate every (type, model) tool + ensembles + listings.
curl -s $PREDICTALOT_URL/mcp/ \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This forecast example transmits raw time-series context to the configured remote service. In the context of an agent skill, that means user-provided proprietary or sensitive data may leave the host environment, so this is a genuine external-transmission risk even if it is core functionality.

Content

Scanner excerpt · SKILL.md (reported line 524)May include surrounding context.

md
-H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" | jq -r '.models[].slug'

# 2. Forecast with chronos-2 (default all-rounder), 12 steps, three bands.
curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"chronos-2","context":[[100,102,101,105,110,108,112,115,120,118,125,130]],

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The ensemble forecast example sends the same potentially sensitive context data to a network service, with additional configuration and model-selection metadata. This broadens the amount of information disclosed and remains dangerous if the endpoint is not strictly controlled.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

Ensemble, zero-weighting the weak model

bash
curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast/ensemble \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"context":[[100,102,101,105,110,108,112,115,120,118,125,130]],

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This endpoint transmits both target series and future covariates, which may include sensitive planned business actions such as promotions or pricing schedules. Leakage of such data to an unintended service or over plaintext HTTP could expose confidential operational plans.

Content

Scanner excerpt · SKILL.md (reported line 550)May include surrounding context.

bash
# Target has 8 steps of history; horizon 4 → futureCovariates arrays length 4.
curl -s $PREDICTALOT_URL/v1/timeseries/covariates/future/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"chronos-2",

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The samples forecast example sends historical series to a remote model endpoint and retrieves probabilistic sample paths. While expected for the feature, it still constitutes off-host transmission of potentially proprietary data and can expose sensitive patterns if the service or network path is untrusted.

Content

Scanner excerpt · SKILL.md (reported line 562)May include surrounding context.

Raw sample paths for custom risk metrics

bash
curl -s $PREDICTALOT_URL/v1/timeseries/samples/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"toto-1",

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

The training example sends engineered features, targets, and a caller-chosen model identifier to the remote service for persistence. This is a real privacy and confidentiality risk because training data is often richer and more sensitive than inference inputs, and it is stored server-side after transmission.

Content

Scanner excerpt · SKILL.md (reported line 575)May include surrounding context.

bash
# 1. Train on engineered features (you supply them).
curl -s $PREDICTALOT_URL/v1/tabular/train \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"modelId":"trend-3","backend":"lightgbm",

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This forecast call sends current engineered features and a model identifier to the remote service. Although less sensitive than full training uploads, it still exposes potentially proprietary signals and can reveal model usage patterns if transmitted to an untrusted or intercepted endpoint.

Content

Scanner excerpt · SKILL.md (reported line 585)May include surrounding context.

md
"config":{"mode":"direction","horizon":3,"nEstimators":400}}' | jq

# 2. Forecast — LAST feature row is the anchor.
curl -s $PREDICTALOT_URL/v1/tabular/forecast \
  -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"modelId":"trend-3","features":[{"rsi":[72],"mom":[0.8]}]}' | jq

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using docker pull psyb0t/predictalot:latest relies on a mutable tag, so the content retrieved can change over time without notice. That weakens reproducibility and creates supply-chain risk: if the upstream image is replaced, compromised, or unexpectedly updated, users may deploy unreviewed code.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/predictalot.sh (reported line 47)May include surrounding context.

sh
auth=(-H "Authorization: Bearer ${PREDICTALOT_AUTH_TOKEN}")
fi

resp="$(curl -sS -w $'\n%{http_code}' \
  "${PREDICTALOT_URL}/v1/timeseries/univariate/forecast" \
  "${auth[@]}" \
  -H "Content-Type: application/json" \