ClawHub
Back to skill

Security audit

the-librarian

Security checks for vulnerabilities and agentic risk

Overview

The published document-search skill is mostly coherent, but the package also includes local-private instructions for privileged Supabase and WhatsApp data access that do not fit the public scope.

Review this package before installing because it appears to include a private/local instruction file with Supabase service-role and WhatsApp workflow details that do not match the public document-search description. For normal use, only run the TurboVec document indexing scripts on directories you choose, keep the embedding API local or fully trusted, and do not use or follow the Supabase service-role instructions unless you intentionally control that backend and understand the credential risk.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation describes capabilities that read local documents, write index files, and make HTTP requests, but the skill metadata shown here does not declare any permissions. That creates a transparency and governance gap: users and platforms may not realize sensitive local files are processed and transmitted to an embedding endpoint, which can lead to unintended data exposure.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill metadata and description present this as a lightweight local document-indexing/search tool, but the content also documents a broader Supabase-backed system for conversation ingestion, knowledge management, and messaging workflows. This mismatch can cause the agent or user to invoke a much more privileged capability set than expected, increasing the risk of unintended access to conversations, contacts, and backend services.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The documented WhatsApp ingestion, contact population, and weekly review/summary workflow expands the skill from document indexing into surveillance-like collection and messaging operations. In the context of a skill advertised for document search, these capabilities are dangerous because they may ingest sensitive personal communications and trigger downstream actions without clear user intent or consent boundaries.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The file discloses the location of a Supabase service-role key and demonstrates use of that highly privileged credential for direct API access. Service-role keys typically bypass row-level restrictions and grant broad read/write access, so exposing where to retrieve it materially increases the risk of credential theft, privilege misuse, and full compromise of the backing datastore.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The function sends raw document chunks to the configured embedding API, which can disclose potentially sensitive document contents outside the local indexing process. Although the default appears intended for a local Ollama endpoint, the skill explicitly allows alternate endpoints and therefore enables external transmission inconsistent with a purely local-document-indexing expectation.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The search path sends the user's raw query text to an embedding API via HTTP requests, and the endpoint is user-configurable. Although the code warns on non-local hosts, it does not enforce locality or transport security, so sensitive queries can be disclosed to remote services contrary to expectations of a lightweight/local document search workflow.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases such as 'what do we know about' and 'remember this' are broad and likely to match ordinary conversation, which can cause accidental invocation of a skill with access to knowledge stores, conversations, and contacts. In this context, overbroad activation is more dangerous because the skill also documents privileged backend access and ingestion behavior.

Missing User Warnings

High
Confidence
98% confidence
Finding
The documentation normalizes use of a highly privileged service-role key without an explicit warning about its sensitivity or the blast radius of compromise. This encourages unsafe handling of administrator-level credentials and can lead to unauthorized database access, data exfiltration, modification, or deletion if the key is exposed or reused improperly.

External Transmission

Medium
Category
Data Exfiltration
Content
def get_embedding(text: str, model: str, api_url: str) -> list[float]:
    """Get embedding from Ollama API."""
    response = requests.post(
        f"{api_url}/api/embeddings",
        json={"model": model, "prompt": text},
        timeout=120
Confidence
96% confidence
Finding
The HTTP POST transmits the full text chunk to the embedding service in the request body. If users point the API to an untrusted or internet-accessible host, confidential documents can be exposed to third parties, and the skill context increases the risk because it is designed to process arbitrary user document collections.

External Transmission

Medium
Category
Data Exfiltration
Content
def get_embedding(text: str, model: str, api_url: str) -> list[float]:
    """Get embedding from Ollama API."""
    response = requests.post(
        f"{api_url}/api/embeddings",
        json={"model": model, "prompt": text},
        timeout=60
Confidence
95% confidence
Finding
This request transmits the query text to an external API endpoint for embedding generation. If the API URL is remote or intercepted, user queries—and potentially sensitive terms about the indexed corpus—can be exposed to third parties; the current warning is advisory only and does not prevent leakage.

Static analysis

No suspicious patterns detected.