ClawHub
Back to skill

Security audit

Buttondown

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Buttondown newsletter helper, but its unvalidated API-base override can send the user's Buttondown token and newsletter data to an arbitrary endpoint if the runtime environment is influenced.

Review before installing. Use this only with a least-privilege Buttondown API key, avoid setting BUTTONDOWN_API_BASE unless you are testing with non-production credentials, and treat preview sending as requiring explicit user approval. The package would be safer if it removed the API-base override or enforced HTTPS and an allowlist for api.buttondown.com before attaching Authorization headers.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/buttondown.py:117
Finding

Configurable API Base Can Exfiltrate Buttondown Credentials and Sensitive Newsletter Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tainted flow: 'req' from os.environ.get (line 144, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The request destination is influenced by BUTTONDOWN_API_BASE from the environment and then used in urllib.request.urlopen(), which means whoever controls the runtime environment can redirect authenticated requests to an arbitrary host. Because the Authorization header carries the Buttondown API token, this can enable credential exfiltration or unintended transmission of draft newsletter content to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/buttondown.py (reported line 146)May include surrounding context.

python
req = urllib.request.Request(url, data=body, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            text = response.read().decode()
            if not text:
                return {}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill exposes capabilities involving environment access, file reads, and network communication but does not declare an explicit tool scope such as permissions or allowed-tools. Even though the documented behavior is newsletter management, the lack of an explicit scope weakens least-privilege controls and can allow broader-than-necessary runtime access if the hosting platform relies on declared restrictions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- Draft-first: when creating an email, set `status: draft` unless the user explicitly approves a different status in the current conversation.
- Do not send, schedule, publish, delete, or send draft previews without explicit user approval in the current conversation.
- Do not put API keys in chat, command history, repo files, draft bodies, logs, or screenshots.
- Read the Buttondown API key from `BUTTONDOWN_API_KEY`. Store it in your shell, launcher, runtime secret store, or OpenClaw SecretRef; never ask the user to paste the token into chat.
- If using a platform account for multiple newsletters, pass the Buttondown newsletter username through `--context` or `BUTTONDOWN_CONTEXT`.

## Configuration

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 50)May include surrounding context.

bash
jq -n --arg subject "$SUBJECT" --rawfile body issue.md '{subject:$subject, body:$body, status:"draft"}' \
  | curl -fsS -X POST "https://api.buttondown.com/v1/emails" \
      -H "Authorization: Token $BUTTONDOWN_API_KEY" \
      -H "Content-Type: application/json" \
      --data-binary @-

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
import urllib.request


DEFAULT_API_BASE = "https://api.buttondown.com/v1"


def die(message, code=2):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 7)May include surrounding context.

md
import urllib.request


DEFAULT_API_BASE = "https://api.buttondown.com/v1"


def die(message, code=2):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 50)May include surrounding context.

md
import urllib.request


DEFAULT_API_BASE = "https://api.buttondown.com/v1"


def die(message, code=2):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/buttondown.py (reported line 11)May include surrounding context.

python
import urllib.request


DEFAULT_API_BASE = "https://api.buttondown.com/v1"


def die(message, code=2):

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/buttondown.py (reported line 98)May include surrounding context.

python
("commenting_mode", "commenting_mode"),
        ("secondary_id", "secondary_id"),
    ]:
        value = getattr(args, attr, None)
        if value is not None:
            payload[key] = value
    if getattr(args, "body_file", None):

Static analysis

No suspicious patterns detected.