ClawHub
Back to skill

Security audit

Raysurfer Code Caching

Security checks for vulnerabilities and agentic risk

Overview

This skill’s main purpose is clear, but it automatically sends task and code content to a third-party cache and can run remotely returned code without enough user control.

Review this before installing in any private or production codebase. Use it only if you are comfortable sending task descriptions, cache-use metadata, and selected full source files to Raysurfer, and do not run cached code from the service without manual review and an isolated test environment.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:27
Finding

Externally Retrieved Source Code Is Written and Executed Without a Security Boundary

Content
View full analysis
", "top_k": 5, "min_verdict_score": 0.3}' ``` ``` ```markdown When a good cache hit is found: 1. Extract the `source` field from the best matching `code_block`. 2. Write it to the appropriate file(s). 3. Adapt paths, variable names, or configuration to the current project if needed. 4. Run the code to verify it works. 5. Proceed to Step 3 (Vote). ``` ### Technical Analysis The Skill instructs the agent to retrieve source code from an external service, optionally including public snippets crawled from GitHub, write the returned source into the current project, and execute it. The effective executable payload is therefore controlled by data returned after the Skill package has been reviewed. The decision logic relies on relevance scores and community votes. These values are not security controls and do not establish code integrity, trusted provenance, or safety. The workflow does not require: - Cryptographic signature or digest verification. - Review of the exact returned source before execution. - Trusted-author or trusted-repository validation. - A network-disabled or least-privileged sandbox. - Restrictions on filesystem, process, credential, or network access. - Explicit user approval for the exact payload being executed. Consequently, compromise of the Raysurfer service, poisoning of a cache entry, manipulation of ranking or voting information, or inclusion of a malicious public snippet could cau ...[truncated 1551 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
}" FILE="${2:?Usage: upload.sh <task> <file>}" CONTENT=$(cat "$FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))") curl -s -X POST https://api.raysurfer.com/api/store/execution-result \ -H "Authorization: Bearer $RAYSURFER_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"task\": \"$TASK\", \"file_written\": {\"path\": \"$(basename "$FILE")\", \"content\": $CONTENT}, \"succeeded\": true, \"auto_vote\": true}" | python3 -m json.tool 2>/dev/null ``` ### Technical Analysis ...[truncated 2457 chars]:6
Finding

Complete Local Files Can Be Uploaded to a Third-Party Service Without Data-Loss Controls

Content
View full analysis
", "file_written": {"path": "relative/path/to/file.py", "content": ""}, "succeeded": true }' ``` ``` `upload.py:6-15`: ```python content = open(filepath).read() req = urllib.request.Request( "https://api.raysurfer.com/api/store/execution-result", data=json.dumps({ "task": task, "file_written": {"path": os.path.basename(filepath), "content": content}, "succeeded": True, "auto_vote": True, }).encode(), headers={"Authorization": f"Bearer {os.environ['RAYSURFER_API_KEY']}", "Content-Type": "application/json"}, ) ``` `upload.ts:6-11`: ```typescript const content = readFileSync(filepath, "utf-8"); const resp = await fetch("https://api.raysurfer.com/api/store/execution-result", { method: "POST", headers: { Authorization: `Bearer ${process.env.RAYSURFER_API_KEY}`, "Content-Type": "application/json" }, body: JSON.stringify({ task, file_written: { path: basename(filepath), content }, succeeded: true, auto_vote: true }), }); ``` `upload.sh:3-9`: ```bash TASK="${1:?Usage: upload.sh }" FILE="${2:?Usage: upload.sh }" CONTENT=$(cat "$FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))") curl -s -X POST https://api.raysurfer.com/api/store/execution-result \ -H "Authorization: Bearer $RAYSURFER_API_KEY" \ -H "Content-Type: application/j ...[truncated 2555 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
}" FILE="${2:?Usage: upload.sh <task> <file>}" CONTENT=$(cat "$FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))") curl -s -X POST https://api.raysurfer.com/api/store/execution-result \ -H "Authorization: Bearer $RAYSURFER_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"task\": \"$TASK\", \"file_written\": {\"path\": \"$(basename "$FILE")\", \"content\": $CONTENT}, \"succeeded\": true, \"auto_vote\": true}" | python3 -m json.tool 2>/dev/null ``` ### Technical Analysis ...[truncated 2159 chars]:2
Finding

Unescaped Task Input Allows JSON Request-Body Injection in Bash Scripts

Content
View full analysis
/dev/null ``` `upload.sh:3-9`: ```bash TASK="${1:?Usage: upload.sh }" FILE="${2:?Usage: upload.sh }" CONTENT=$(cat "$FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))") curl -s -X POST https://api.raysurfer.com/api/store/execution-result \ -H "Authorization: Bearer $RAYSURFER_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"task\": \"$TASK\", \"file_written\": {\"path\": \"$(basename "$FILE")\", \"content\": $CONTENT}, \"succeeded\": true, \"auto_vote\": true}" | python3 -m json.tool 2>/dev/null ``` ### Technical Analysis Both Bash scripts interpolate `$TASK` directly into a JSON string without applying JSON encoding. An input containing quotation marks, backslashes, or control characters can terminate or alter the intended `task` value, produce malformed JSON, or inject additional object fields. For example, a task shaped like the following can change the serialized structure rather than remaining a literal task string: ```text x", "top_k": 100, "injected": " ``` This is request-body injection, not shell command injection: `$TASK` is expanded inside a quoted shell argument, so the shown code does not cause the shell to interpret command substitutions embedded in the variable value. However, the remote API receives attacker-influenced JSON syntax. In `upload.sh`, file content is safely JSON-encoded t ...[truncated 1251 chars]
Remediation
View remediation
/dev/null`. 5. Validate the response content type and HTTP status before parsing it as JSON. 6. Add tests covering quotes, backslashes, newlines, Unicode, and control characters. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (40)

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The code performs an outbound HTTPS request to an external API but the network capability is not covered by declared permissions. In an agent environment, undeclared network access is dangerous because it allows data egress and remote interaction outside the user's visible control surface.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The code performs an outbound HTTPS request to an external API but the network capability is not covered by declared permissions. In an agent environment, undeclared network access is dangerous because it allows data egress and remote interaction outside the user's visible control surface.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · search.sh (reported line 4)May include surrounding context.

sh
#!/usr/bin/env bash
# Search Raysurfer cache. Usage: bash search.sh "task description"
TASK="${1:-Parse a CSV file and generate a bar chart}"
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"task\": \"$TASK\", \"top_k\": 5, \"min_verdict_score\": 0.3}" | python3 -m json.tool 2>/dev/null

Tainted flow: 'req' from open (line 7, file read) → urllib.request.urlopen (network output)

High
Category
Data Flow
Confidence
96% confidence
Finding

The script reads an arbitrary local file and transmits its full contents, along with the task description, to a remote service. In an agent-skill context this is dangerous because users may run it on sensitive source files, secrets, or proprietary code, causing unintended exfiltration outside the local environment.

Content

Scanner excerpt · upload.py (reported line 17)May include surrounding context.

python
}).encode(),
    headers={"Authorization": f"Bearer {os.environ['RAYSURFER_API_KEY']}", "Content-Type": "application/json"},
)
with urllib.request.urlopen(req) as resp:
    print(json.dumps(json.loads(resp.read()), indent=2))

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · upload.sh (reported line 6)May include surrounding context.

sh
TASK="${1:?Usage: upload.sh <task> <file>}"
FILE="${2:?Usage: upload.sh <task> <file>}"
CONTENT=$(cat "$FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
curl -s -X POST https://api.raysurfer.com/api/store/execution-result \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"task\": \"$TASK\", \"file_written\": {\"path\": \"$(basename "$FILE")\", \"content\": $CONTENT}, \"succeeded\": true, \"auto_vote\": true}" | python3 -m json.tool 2>/dev/null

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly describes uploading recently generated code to a remote cache, but it does not warn users that source code may be transmitted to a third-party service. In an agent skill context, generated code can contain proprietary logic, embedded secrets, internal file paths, or customer data, so silent or insufficiently disclosed upload behavior creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This instruction sends task details and authorization credentials to an external API as part of the cache search workflow. Even though external retrieval is the feature's purpose, it still creates a data exposure boundary and can leak sensitive task descriptions or operational metadata to a third party.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

To also include community public snippets (crawled from GitHub), add the X-Raysurfer-Public-Snips: true header.

bash
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Raysurfer-Public-Snips: true" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This instruction sends task details and authorization credentials to an external API as part of the cache search workflow. Even though external retrieval is the feature's purpose, it still creates a data exposure boundary and can leak sensitive task descriptions or operational metadata to a third party.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

To also include community public snippets (crawled from GitHub), add the X-Raysurfer-Public-Snips: true header.

bash
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Raysurfer-Public-Snips: true" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The cache-usage vote call transmits task descriptions and code metadata to an external service. While less severe than full code upload, it still exports potentially sensitive project information without an explicit consent step or guidance on avoiding confidential task details.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

After using cached code, report whether it worked:

bash
curl -s -X POST https://api.raysurfer.com/api/store/cache-usage \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code_block_id": "<id from the match>", "code_block_name": "<name from the match>", "code_block_description": "<description from the match>", "succeeded": true, "task": "<the task description>"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directs the agent to upload the full contents of generated files to an external service after success, but it does not require user consent, data minimization, or checks for secrets and proprietary content. In an agent workflow, generated files can easily contain sensitive business logic, credentials, internal paths, or regulated data, so automatic exfiltration to a third-party API is a real disclosure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This endpoint transmits full generated file contents to a third-party API, which is a direct exfiltration path for sensitive source code and embedded secrets. Because the workflow says to upload successful results for future reuse, the behavior is systematic and likely to expose proprietary or confidential material unless carefully constrained.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

After successfully generating and running new code (cache miss), upload it for future reuse:

bash
curl -s -X POST https://api.raysurfer.com/api/store/execution-result \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 30)May include surrounding context.

Example Request

bash
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 30)May include surrounding context.

Example Request

bash
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented /api/store/execution-result endpoint explicitly uploads a natural-language task description plus full file contents to an external service, but the reference provides no warning about possible transmission of proprietary code, credentials, secrets, or regulated data. In the context of an agent skill designed to cache prior executions, this omission is dangerous because users or downstream agents may send sensitive artifacts off-platform by default without informed consent or redaction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The external URL here is part of the upload flow that sends full file content to a third-party API, so in context it represents more than a harmless remote reference. Because the endpoint is designed to receive complete code artifacts, misuse or uninformed use can result in direct exposure of proprietary code or secrets.

Content

Scanner excerpt · references/api-reference.md (reported line 95)May include surrounding context.

Example Request

bash
curl -s -X POST https://api.raysurfer.com/api/store/execution-result \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The external URL here is part of the upload flow that sends full file content to a third-party API, so in context it represents more than a harmless remote reference. Because the endpoint is designed to receive complete code artifacts, misuse or uninformed use can result in direct exposure of proprietary code or secrets.

Content

Scanner excerpt · references/api-reference.md (reported line 95)May include surrounding context.

Example Request

bash
curl -s -X POST https://api.raysurfer.com/api/store/execution-result \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The referenced external URL is used for telemetry-like cache usage submission, which leaks task and code metadata to a third-party service. In a developer-agent workflow, that metadata can still reveal sensitive implementation areas, filenames, or strategic project details even without full source code.

Content

Scanner excerpt · references/api-reference.md (reported line 147)May include surrounding context.

Example Request

bash
curl -s -X POST https://api.raysurfer.com/api/store/cache-usage \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The referenced external URL is used for telemetry-like cache usage submission, which leaks task and code metadata to a third-party service. In a developer-agent workflow, that metadata can still reveal sensitive implementation areas, filenames, or strategic project details even without full source code.

Content

Scanner excerpt · references/api-reference.md (reported line 147)May include surrounding context.

Example Request

bash
curl -s -X POST https://api.raysurfer.com/api/store/cache-usage \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script transmits the task description to a third-party service and authenticates using a bearer token, but it provides no user-facing disclosure, confirmation, or redaction step. Task prompts can contain proprietary code, credentials, internal URLs, or sensitive business context, so silent transmission creates a real confidentiality risk even if the remote service is legitimate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This finding confirms external transmission to api.raysurfer.com. In this skill's context, external retrieval is part of the advertised functionality, which makes the behavior expected, but it is still security-relevant because it creates a data-exfiltration path for user task content and metadata.

Content

Scanner excerpt · search.py (reported line 7)May include surrounding context.

python
task = sys.argv[1] if len(sys.argv) > 1 else "Parse a CSV file and generate a bar chart"
req = urllib.request.Request(
    "https://api.raysurfer.com/api/retrieve/search",
    data=json.dumps({"task": task, "top_k": 5, "min_verdict_score": 0.3}).encode(),
    headers={"Authorization": f"Bearer {os.environ['RAYSURFER_API_KEY']}", "Content-Type": "application/json"},
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This command performs an outbound POST to an external service, transmitting the task text over the network. In a code-assistant skill, that task text can easily include sensitive implementation details or credentials, making the external transmission itself a meaningful data-exposure risk.

Content

Scanner excerpt · search.sh (reported line 4)May include surrounding context.

sh
#!/usr/bin/env bash
# Search Raysurfer cache. Usage: bash search.sh "task description"
TASK="${1:-Parse a CSV file and generate a bar chart}"
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"task\": \"$TASK\", \"top_k\": 5, \"min_verdict_score\": 0.3}" | python3 -m json.tool 2>/dev/null

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This command performs an outbound POST to an external service, transmitting the task text over the network. In a code-assistant skill, that task text can easily include sensitive implementation details or credentials, making the external transmission itself a meaningful data-exposure risk.

Content

Scanner excerpt · search.sh (reported line 4)May include surrounding context.

sh
#!/usr/bin/env bash
# Search Raysurfer cache. Usage: bash search.sh "task description"
TASK="${1:-Parse a CSV file and generate a bar chart}"
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
  -H "Authorization: Bearer $RAYSURFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"task\": \"$TASK\", \"top_k\": 5, \"min_verdict_score\": 0.3}" | python3 -m json.tool 2>/dev/null

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script sends the user-supplied task description to a third-party API and includes an API bearer token, but the file provides no warning that task content leaves the local environment. In an agent skill context, task prompts may contain proprietary code, secrets, or internal business context, so undisclosed transmission creates a real confidentiality risk even though it appears to be part of the feature's intended behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The fetch call transmits task data to an external domain, which is a genuine data exposure surface in this skill because the purpose is to search a remote cache using user-supplied content. In this context, even a short task description may embed sensitive operational details, making the external transmission materially risky if users are unaware or if data handling guarantees are insufficient.

Content

Scanner excerpt · search.ts (reported line 3)May include surrounding context.

ts
// Search Raysurfer cache. Usage: bun search.ts "task description"
const task = process.argv[2] ?? "Parse a CSV file and generate a bar chart";
const resp = await fetch("https://api.raysurfer.com/api/retrieve/search", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.RAYSURFER_API_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({ task, top_k: 5, min_verdict_score: 0.3 }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The fetch call transmits task data to an external domain, which is a genuine data exposure surface in this skill because the purpose is to search a remote cache using user-supplied content. In this context, even a short task description may embed sensitive operational details, making the external transmission materially risky if users are unaware or if data handling guarantees are insufficient.

Content

Scanner excerpt · search.ts (reported line 3)May include surrounding context.

ts
// Search Raysurfer cache. Usage: bun search.ts "task description"
const task = process.argv[2] ?? "Parse a CSV file and generate a bar chart";
const resp = await fetch("https://api.raysurfer.com/api/retrieve/search", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.RAYSURFER_API_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({ task, top_k: 5, min_verdict_score: 0.3 }),

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
search.ts:5

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
upload.ts:10