ClawHub
Back to skill

Security audit

Crewai Workflows

Security checks for vulnerabilities and agentic risk

Overview

This skill is a remote AI workflow client, but it ships a hardcoded API key and stores full responses in a predictable temporary file, so users should review it before installing.

Install only if you are comfortable sending workflow inputs and API credentials to crew.iclautomation.me and its model providers. The publisher should rotate the exposed key, replace it with a placeholder, narrow the skill trigger text, add an explicit data-handling warning, and stop saving full responses to predictable /tmp files by default.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:15
Finding

Hardcoded API Credential Exposed in Skill Documentation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/call_crew.sh:75
Finding

Predictable and Insecure Temporary Response File

Content
View full analysis
"$TEMP_FILE" echo "💾 Full response saved to: $TEMP_FILE" ``` ### Technical Analysis The script constructs a file in the shared `/tmp` directory using only the current Unix timestamp in seconds. This name is predictable and is not created atomically. Shell redirection opens the selected path without verifying that it is a newly created regular file owned by the current user. A local attacker may predict the timestamp and pre-create the path as a symbolic link. When the script performs `> "$TEMP_FILE"`, it follows the link and truncates or replaces the linked target, subject to the victim process's file permissions and operating-system symbolic-link protections. The response file may also be created with permissions derived from the user's current `umask`. With a common `022` umask, a newly created file is typically readable by other local users. The full remote response may contain customer-support text, business data, generated content, trace identifiers, or other sensitive information. Files are retained without automatic cleanup. Runs occurring during the same second also select the same filename, allowing accidental overwrites or cross-run data confusion. ### Attack Path 1. A local attacker observes or predicts when another user will invoke the Skill. 2. The attacker calculates the expected path, such as `/tmp/crewai_response_.json`. 3. Before the response is saved, the attacker creates that path as a symbolic link to a file writable by the victim process. 4. The victim runs the script and receives a successful API response. 5. Shell redirection follows the pre-created ...[truncated 1238 chars]
Remediation
View remediation
"$TEMP_FILE" ``` 3. Prefer a user-private runtime or data directory rather than a shared temporary directory. 4. Register a cleanup trap when the file is temporary: ```bash trap 'rm -f -- "$TEMP_FILE"' EXIT ``` 5. If retention is required, accept an explicit destination path, document that it may contain sensitive information, and enforce owner-only permissions with `chmod 600`. 6. Avoid timestamp-only names; secure random names generated through `mktemp` prevent collisions and pre-creation attacks. 7. Define and enforce a retention policy for stored responses. 8. Consider saving only necessary output fields rather than the complete remote response. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description does not warn that user inputs are transmitted to crew.iclautomation.me and processed by external models including DeepSeek, Perplexity, and Gemini. Without upfront disclosure, users or calling agents may pass confidential business, customer support, or analytics data to third parties without informed consent or policy review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file exposes a hardcoded API key directly in the documentation and encourages users to export and use it. This is a direct credential disclosure: anyone who can read the skill can reuse the key to access the external CrewAI service, incur charges, abuse workflows, or pivot into any data reachable through that account.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents shell-based execution (scripts/call_crew.sh, curl) but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the platform or a calling agent to invoke shell/network-capable behavior without clear governance, increasing the risk of unintended command execution or data exfiltration through external requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description is broad enough to match generic content generation, analysis, and support tasks, which can cause the skill to be selected for many unrelated prompts. In this skill's context, overbroad routing is risky because invocation sends user input to an external server and third-party models, so accidental activation can leak sensitive data or trigger unnecessary external actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The cURL example explicitly posts data to an external domain, confirming outbound transmission of arbitrary skill inputs. External transmission is expected for this workflow, but it remains security-relevant because the skill handles marketing, support, and business-analysis content that may contain sensitive or proprietary information, and the destination is a non-platform server.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

scripts/call_crew.sh marketing '{"topic": "mindfulness apps"}' "YOUR_API_KEY"

text

### Option 2: Direct cURL

```bash
curl -X POST "https://crew.iclautomation.me/crews/<crew_name>/run" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/call_crew.sh (reported line 51)May include surrounding context.

sh
echo "🚀 Calling $CREW_NAME crew..."
echo ""

RESPONSE=$(curl -s --max-time "$TIMEOUT" \
  -X POST "https://crew.iclautomation.me/crews/$CREW_NAME/run" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $API_KEY" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script transmits both user-supplied JSON and an API key to a third-party remote service, but the help text does not clearly disclose that data leaves the local environment. This can cause users to send sensitive customer, support, marketing, or business analysis data without informed consent, which is especially risky given the skill's stated use cases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script writes the full API response to a predictable file in /tmp, which may contain sensitive model outputs, trace identifiers, or customer/business data supplied to the workflow. On multi-user systems or in shared environments, temporary files can be discovered or retained longer than expected, increasing the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.