ClawHub
Back to skill

Security audit

Rumi

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly for matching users with real people, but it handles login tokens and sensitive conversation context in ways users should review carefully before installing.

Review this before installing if you may discuss private topics. Use it only if you are comfortable with Rumi receiving matching descriptions derived from your conversation, and avoid pasting API tokens into chat unless the platform provides a secure secret-entry and storage mechanism.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:67
Finding

Sensitive User Context May Be Inferred and Transmitted Without Granular Consent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:52-56, SKILL.md:67-69, and SKILL.md:87-94
Vulnerability Type: Excessive collection and external disclosure of inferred sensitive information
Risk Level: Medium

Relevant Skill Instructions:

markdown
**Life Decisions** — When peer perspective helps:
- Career changes, health concerns, relationship advice
- Major purchases, moving decisions, financial planning
- Situations where empathy and lived experience matter
markdown
1. Call `rumi_health_check` first to verify token and check quota
2. Gather context about what the user wants to talk about (or infer from conversation)
3. Call `rumi_find_partner` with a rich description — include interests, mood, what kind of person they want
markdown
## Writing Good Descriptions

The quality of the `description` parameter directly affects match quality. Include:
- **What** they want to talk about (specific topics, not vague)
- **Why** — the context or mood (learning, venting, sharing excitement)
- **What kind of person** — expertise level, personality, shared experiences

Technical Analysis

The skill instructs the agent to derive matching context from the existing conversation and explicitly permits the context to be inferred. The activation criteria include potentially sensitive subjects such as health, relationships, career decisions, major purchases, and financial planning. The inferred information is then incorporated into a “rich description” sent to the external Rumi matching service through rumi_find_partner.

Although the skill requires confirmation before proactively calling the matching function, it does not require the agent to display the exact description that will be transmitted or obtain field-level approval for sensitive inferred attributes. A user may therefore consent to finding a conversation partner without realizing that contextual details concerning mood, ...[truncated 1696 chars]

Remediation
View remediation

Remediation Suggestions

  1. Show the exact matching description to the user before invoking rumi_find_partner.
  2. Require explicit approval of the final payload rather than relying on general consent to find a partner.
  3. Do not infer or transmit sensitive attributes concerning health, finances, relationships, age, or emotional state unless the user expressly requests their inclusion.
  4. Limit transmitted data to details directly supplied by the user for the stated matching purpose.
  5. Provide an editing step that allows the user to remove or generalize contextual information.
  6. Add a clear notice identifying Rumi as an external service and describing what information will be transmitted.
  7. Establish retention, deletion, and purpose-limitation requirements for descriptions submitted to the service.
  8. Replace broad instructions to create a “rich description” with a structured allowlist of minimally necessary matching fields.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:60
Finding

API Token Is Collected Through the Conversation Channel

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:60-63
Vulnerability Type: Insecure credential collection and storage workflow
Risk Level: High

Relevant Skill Instructions:

markdown
1. Show the user the setup URL (from the error response `setupUrl`)
2. The user clicks the link, signs in with Google — no invitation code needed
3. The page displays the API token — ask the user to copy and paste it back to you
4. Save the token to the plugin configuration

Technical Analysis

The setup process explicitly instructs the user to paste an API token into the ordinary conversational interface. Conversation channels are not equivalent to dedicated secret-entry mechanisms: messages may be retained in chat history, included in model context, copied into telemetry or debugging logs, processed by intermediary systems, or exposed to other tools with access to the conversation.

The instruction to save the token to plugin configuration does not specify protected secret storage, encryption at rest, restrictive file permissions, redaction, token scoping, or log suppression. Consequently, both the credential-entry channel and the eventual storage location may expose a reusable authentication secret.

The package contains no implementation of the referenced tools or configuration system, so the exact token privileges and storage protections cannot be verified. The documented workflow itself is nevertheless insecure because it intentionally places the token in conversational data.

Attack Path

  1. The agent receives a setup_required response and presents the setup URL.
  2. The user authenticates with Google and receives an API token.
  3. Following the skill instructions, the user pastes the token into the chat.
  4. The token becomes part of conversation history and model-processing context.
  5. The token may be retained in logs, telemetry, transcripts, backups, or other systems that process chat messages.

...[truncated 917 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace copy-and-paste token setup with an authenticated OAuth authorization-code flow using a verified redirect URI.
  2. If browser-based authorization is required, deliver the credential directly to the plugin through a secure callback rather than through chat.
  3. Use a dedicated secret-input control that prevents the credential from entering model context, conversation history, telemetry, and ordinary logs.
  4. Store credentials only in the platform's protected secret manager or operating-system credential store, not in plaintext plugin configuration.
  5. Encrypt tokens at rest and restrict access to the minimum process identity that requires them.
  6. Issue short-lived, narrowly scoped tokens and use separately protected refresh tokens where necessary.
  7. Implement automatic redaction for token formats across application, proxy, error, and audit logs.
  8. Provide token revocation, rotation, expiration, and compromise-recovery procedures.
  9. Ensure setup URLs are HTTPS-only, single-use, short-lived, and bound to the initiating user and session.
  10. Document the token's permissions and require server-side authorization for every account, messaging, and matching operation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The proactive activation guidance is very broad and subjective, including common conversational patterns like boredom, asking for opinions, late-night chatting, or discussing life decisions. This can cause the agent to suggest connecting the user to a third-party human-matching service in contexts where the user did not clearly request it, increasing privacy risk and the chance of inappropriate escalation of sensitive conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup flow instructs the user to copy and paste an API token back into the chat without prominently warning that it is a sensitive credential. Asking users to transmit secrets through the conversational channel normalizes unsafe credential handling and risks token exposure through logs, transcripts, screenshots, or unintended retention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Automatically selecting language based on user conversation without opt-in can expose or infer sensitive attributes such as nationality or ethnicity and may lead to incorrect routing or matching. In a human-connection service, silent inference is more concerning because it can affect who the user is matched with and what data is implicitly shared about them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.