ClawHub
Back to skill

Security audit

baize-task-bot

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for Baize outbound-call operations, but it gives an agent live authority to start calls and create accounts with weakly enforced safeguards.

Install only if you operate the Baize outbound-call platform and intend to let the agent make live operational changes. Use a least-privilege BAIZE_TOKEN, keep BAIZE_BASE_URL local or HTTPS-only, verify task and line IDs before approving writes, and require explicit human confirmation for every start, resume, concurrency, line, region, ratio, or account action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no explicit permissions, yet its documented behavior includes reading local files, accessing environment variables, and making authenticated HTTP requests to an external platform API. This creates an authorization and transparency gap: a caller or platform may treat the skill as low-risk while it can perform state-changing operations and use sensitive credentials.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The change_concurrency tool is presented as a benign tuning action, but it calls /editConcurrencyAndStartTask, which can start tasks as a side effect. That mismatch can cause unintended outbound calling activity when a user only intended to adjust settings, creating integrity and operational-risk issues with real-world external actions.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill instructs operators to directly edit JSON files under the skill directory to update local data, without warnings about persistence, integrity, auditability, or change control. In a skill that influences operational decisions and can trigger write actions against an external calling platform, tampered local data could cause mis-targeting, incorrect task/line resolution, or unsafe administrative actions.

Missing User Warnings

High
Confidence
91% confidence
Finding
create_main_account accepts a plaintext password and forwards it directly to a remote API, while also returning raw exception text on failure. In this skill context, these are privileged admin operations against a platform API; mishandling credentials increases the chance of credential exposure in logs, traces, error messages, or insecure transport if the default HTTP base URL is used.

Missing User Warnings

High
Confidence
92% confidence
Finding
create_sub_account likewise transmits plaintext passwords to a remote API and duplicates the password in both password and password2 fields, increasing credential exposure surface. Because this skill performs administrative account provisioning, any leakage through transport, monitoring, or exception handling could directly compromise newly created operator accounts.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.