ClawHub
Back to skill

Security audit

Buttondown

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Buttondown newsletter purpose, but it can send a Buttondown API key and newsletter content to any URL set in an environment variable.

Review before installing. Use only in a runtime where you control environment variables, do not set BUTTONDOWN_API_BASE unless it is a trusted Buttondown-compatible endpoint, use the narrowest Buttondown API key available, and verify email IDs, draft status, and recipients before running update or preview-send commands.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'req' from os.environ.get (line 144, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url, data=body, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            text = response.read().decode()
            if not text:
                return {}
Confidence
93% confidence
Finding
The request destination is influenced by BUTTONDOWN_API_BASE from the environment, and the code will send the Authorization token header to whatever URL that variable specifies. In an agent/runtime setting where environment configuration may be influenced by deployment or other tooling, this creates an SSRF-style credential exfiltration risk because a malicious base URL could capture the Buttondown API key and request contents.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill clearly uses sensitive capabilities—environment variables for API keys, local file reads for newsletter bodies, and network access to the Buttondown API—but does not declare permissions. That mismatch weakens platform-level review and containment because operators and automated systems cannot accurately assess what the skill can access or transmit.

Static analysis

No suspicious patterns detected.