ClawHub
Back to skill

Security audit

Crash Fixer

Security checks for vulnerabilities and agentic risk

Overview

This skill is an autonomous crash fixer, but it sends sensitive crash and code data to an external AI provider and can create repository changes from unvalidated model output.

Review carefully before installing. Use only with a least-privilege GitHub token on a repository where external AI processing of crash data and source snippets is acceptable. Avoid non-dry-run mode unless branch and PR creation from AI-generated code is explicitly intended, and note that the current dry-run still mutates crash-reporter state.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:115
Finding

Sensitive crash data and proprietary source code are transmitted to an external AI service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.js:261
Finding

Untrusted AI output can replace arbitrary repository files and create malicious pull requests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:382
Finding

Dry-run mode modifies crash-reporter state

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description says it analyzes with Codex 5.3 High and monitors Cloudflare D1 crash reports, but the content also states it uses MiniMax and a generic CRASH_REPORTER_URL endpoint, creating a material mismatch between declared and actual behavior. This is dangerous because operators may approve the skill based on an inaccurate trust model while it sends sensitive crash data to a different AI provider and reaches arbitrary remote infrastructure specified by environment variables.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code sends stack traces, messages, user identifiers, device data, app version, and repository code context to an external AI API without any confirmation, minimization, or redaction. In this skill context, crash reports often contain sensitive internal code paths and possible personal or operational data, so silent third-party transmission creates substantial confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope despite requiring environment variables and network access, which obscures the real privilege boundary of an autonomous workflow that can contact external services and act on a repository. In this context, missing scope is dangerous because the skill fetches crash data, uses external AI analysis, and can create branches and pull requests, so reviewers and runtime policy engines lack a clear least-privilege contract.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill can autonomously generate code changes and create pull requests, but the description does not prominently warn users that non-dry-run mode performs write actions against a target repository. In this context, the omission increases risk because users may invoke the skill expecting analysis only, while it can produce externally proposed code changes based on crash data and AI-generated fixes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill metadata and implementation materially differ: the manifest says crash reports come from Cloudflare D1, but the code accepts an arbitrary CRASH_REPORTER_URL and trusts that endpoint for input and workflow state. This weakens operator understanding and review, and can cause sensitive crash data to be pulled from or sent to an unexpected service under false assumptions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest claims analysis is done with Codex 5.3 High, but the code actually transmits crash details and repository code to MiniMax. This is dangerous because users may approve the skill based on one model/vendor's security and data-handling expectations while the implementation silently exfiltrates sensitive data to a different third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This call transmits crash contents and repository code context to api.minimax.chat, an external third party. Given the skill's purpose, the transmitted data may include sensitive stack traces, internal source code, and user-related metadata, making the external transmission itself security-relevant rather than a benign network operation.

Content

Scanner excerpt · index.js (reported line 157)May include surrounding context.

js
console.log(`[crash-fixer] Analyzing with MiniMax M2.5...`);
  
  const res = await fetch("https://api.minimax.chat/v1/text/chatcompletion_v2", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This call transmits crash contents and repository code context to api.minimax.chat, an external third party. Given the skill's purpose, the transmitted data may include sensitive stack traces, internal source code, and user-related metadata, making the external transmission itself security-relevant rather than a benign network operation.

Content

Scanner excerpt · index.js (reported line 157)May include surrounding context.

js
console.log(`[crash-fixer] Analyzing with MiniMax M2.5...`);
  
  const res = await fetch("https://api.minimax.chat/v1/text/chatcompletion_v2", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 219)May include surrounding context.

js
try {
    const res = await fetch(
      `https://api.github.com/search/code?q=${encodeURIComponent(query)}&per_page=3`,
      {
        headers: {
          "Authorization": `Bearer ${GH_TOKEN}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 260)May include surrounding context.

js
try {
    const res = await fetch(
      `https://api.github.com/search/code?q=${encodeURIComponent(query)}&per_page=3`,
      {
        headers: {
          "Authorization": `Bearer ${GH_TOKEN}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 267)May include surrounding context.

js
try {
    const res = await fetch(
      `https://api.github.com/search/code?q=${encodeURIComponent(query)}&per_page=3`,
      {
        headers: {
          "Authorization": `Bearer ${GH_TOKEN}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 292)May include surrounding context.

js
try {
    const res = await fetch(
      `https://api.github.com/search/code?q=${encodeURIComponent(query)}&per_page=3`,
      {
        headers: {
          "Authorization": `Bearer ${GH_TOKEN}`,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill autonomously creates branches, commits generated code, and opens pull requests without human approval. Because the change content is derived from untrusted crash input and an external model response, this can introduce malicious or unsafe code into the repository and abuses the granted GitHub token if the workflow is triggered unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This creates a new Git reference in the target repository automatically using the configured token. In context, this is part of an autonomous write pipeline driven by untrusted crash data and external model output, so it enables unauthorized or unsafe repository changes if the skill is misused or the input is manipulated.

Content

Scanner excerpt · index.js (reported line 275)May include surrounding context.

js
// Create branch
  console.log(`[crash-fixer] Creating branch: ${branchName}`);
  await fetch(`https://api.github.com/repos/${TARGET_REPO}/git/refs`, {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${GH_TOKEN}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This endpoint writes model-generated content into the repository without human review. Since fix.file_path and fix.fix_code originate from an external AI response influenced by crash input, an attacker could potentially steer changes into sensitive files or inject harmful code, making this a direct integrity risk.

Content

Scanner excerpt · index.js (reported line 312)May include surrounding context.

js
// Commit the change
  console.log(`[crash-fixer] Committing fix to ${fix.file_path}`);
  
  const commitRes = await fetch(`https://api.github.com/repos/${TARGET_REPO}/contents/${fix.file_path}`, {
    method: "PUT",
    headers: {
      "Authorization": `Bearer ${GH_TOKEN}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Automatically opening a pull request publicizes and operationalizes unreviewed, model-generated code changes. While less severe than direct code writes, it can still leak sensitive crash details in the PR body and create social-engineering pressure to merge unsafe changes.

Content

Scanner excerpt · index.js (reported line 332)May include surrounding context.

js
// Create PR
  console.log(`[crash-fixer] Creating PR...`);
  
  const prRes = await fetch(`https://api.github.com/repos/${TARGET_REPO}/pulls`, {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${GH_TOKEN}`,

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The comment and implementation at the top of the file clearly indicate MiniMax is the active model, while the PR body fallback text later states 'Analyzed via Codex 5.3 High'. These statements contradict each other about which AI system performed the analysis.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:17