ClawHub
Back to skill

Security audit

Review Sentinel

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Google review monitoring helper that fetches review data, stores local state, and drafts reports or responses without hidden posting or destructive behavior.

Before installing, be comfortable giving it a Google Places API key and storing business review data on disk. Use the environment variable instead of a credentials file when possible, keep state/report folders private, and only set up cron monitoring if you want recurring checks. Review any drafted public responses yourself before posting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a broader reputation-management skill that can monitor, analyze, and respond to Google reviews over time. The supplied code chunk does not implement those capabilities. It performs a single fetch of a Google Maps search results page, extracts basic rating/review-count metadata and some possible review snippets, and outputs them to stdout or a file. While this supports part of 'check reviews,' it does not analyze trends, generate reports, draft responses, or maintain local state for change tracking as described. Therefore the description materially overstates the code’s actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a broader reputation-management skill that can monitor, analyze, and respond to Google reviews and track changes over time. The supplied code chunk is much narrower: it generates a Google Maps URL and parses raw saved HTML for ratings and reviews. It does not analyze trends, draft responses, generate reports, or compare historical state to track changes over time. Writing one parsed result to a file is not sufficient to substantiate the declared change-tracking/monitoring behavior. So the description overstates the implemented functionality, creating a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description promises a broader reputation-management capability set than this code actually implements. The supplied script only fetches business details and recent Google reviews from the Places API and optionally writes the fetched data to a JSON file. It does not perform review analysis, trend detection, automated response generation, monitoring workflows, or historical state tracking. While fetching reviews is consistent with part of the description, the overall declared purpose materially overstates the implemented behavior, especially the monitoring, analysis, response, reporting, and change-tracking claims.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_reviews_places.py (reported line 27)May include surrounding context.

python
def get_api_key() -> str:
    """Get API key from env var or local credentials file.
    
    Lookup order:
      1. GOOGLE_PLACES_API_KEY environment variable

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises access to environment variables, local file reads/writes, and network activity but does not declare any explicit tool scope restrictions. That creates an overprivileged execution surface where a reviewer or runtime cannot easily verify what operations are intended, increasing the chance of unintended data access, secret exposure, or file modification if the implementation expands or is abused.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/daily_check.py (reported line 44)May include surrounding context.

python
def save_state(state_path: Path, state: dict):
    """Save state to file."""
    state_path.parent.mkdir(parents=True, exist_ok=True)
    with open(state_path, 'w') as f:
        json.dump(state, f, indent=2, ensure_ascii=False)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request header hard-codes Accept-Language to en-US,en;q=0.9, which imposes a specific language/locale on responses regardless of user preference. This is a natural-language policy concern because the script does not offer opt-in, configuration, or a documented region-specific reason for forcing English.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill instructs storage of business identifiers, locations, and review-tracking state in local files without clearly warning users that this data persists on disk. Persistent local storage can create privacy and operational risks, especially on shared systems or for sensitive businesses such as medical practices, where stored review metadata may reveal business relationships or monitoring history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This code creates directories and writes the fetched business and review data to a user-specified output file, but the only disclosure is a post-write status message. There is no prior warning in code comments, help text, or prompts that using --output will persist review text and related metadata to disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.