ClawHub
Back to skill

Security audit

qui-clawd-docs-v2

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation helper that uses local caches first and a disclosed external scraping API only when needed.

Install this only if you are comfortable providing SKILLBOSS_API_KEY and having requested ClawdBot documentation URLs sent to SkillBoss API Hub. Keep use limited to public docs.clawd.bot pages and prefer the local snippets/cache when they answer the question.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to send documentation URLs to a third-party scraping endpoint authenticated with SKILLBOSS_API_KEY, but it does not disclose that request metadata and queried page paths will be transmitted off-host. In an agent setting, even seemingly harmless documentation lookups can reveal internal usage patterns, user interests, or sensitive URLs if the path is ever influenced by user input or future extensions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding points to the same authenticated external POST operation and remains a true positive. The security concern is not code execution but undisclosed outbound transmission using a privileged API key and request metadata.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding points to the same authenticated external POST operation and remains a true positive. The security concern is not code execution but undisclosed outbound transmission using a privileged API key and request metadata.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The hardcoded third-party endpoint confirms that the skill is designed to contact an external service, making outbound data flow explicit. Even though the target domain is fixed, the skill gives no warning about privacy implications or trust boundaries for transmitted URLs and metadata.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={
        "type": "scraper",

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding refers to the same example request to api.heybossai.com and is a valid external transmission concern. In skill context, examples often become copied operational behavior, so the risk is practical rather than merely illustrative.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Example:

python
result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding refers to the same example request to api.heybossai.com and is a valid external transmission concern. In skill context, examples often become copied operational behavior, so the risk is practical rather than merely illustrative.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Example:

python
result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This hardcoded endpoint in the example reinforces the same external transmission pattern and should be treated as a real risk signal. The example may encourage downstream users or agents to transmit data externally without considering privacy or compliance requirements.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Example:

python
result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={
        "type": "scraper",

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding matches the same fallback external request and is a true positive for outbound authenticated transmission. The context makes it somewhat less severe than arbitrary exfiltration because the destination and purpose are documented, but it is still a real data flow to a third party.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

If you can't find what you need:

python
result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This duplicate finding matches the same fallback external request and is a true positive for outbound authenticated transmission. The context makes it somewhat less severe than arbitrary exfiltration because the destination and purpose are documented, but it is still a real data flow to a third party.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

If you can't find what you need:

python
result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This line again identifies the external endpoint used for fallback refresh, confirming repeated reliance on remote scraping. Repeated network paths increase operational exposure and may leak broader usage patterns over time.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

python
result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={
        "type": "scraper",

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The comparison table includes Chinese text (统一 SKILLBOSS_API_KEY) in otherwise English/Slovak guidance, without offering a language choice or documenting a locale-specific reason. This is a natural-language policy issue because the skill's instructions impose mixed-language output on users without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The changelog line uses Chinese (统一认证) in a file otherwise written in English/Slovak, and the document does not offer language selection or explain a required locale. That creates a language/locale policy violation under the stated rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.