ClawHub
Back to skill

Security audit

Venice Admin

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Venice AI admin helper that reads account balance, usage, and API-key metadata, with some dependency and admin-key handling cautions.

Install only if you are comfortable giving the skill process a Venice Admin API key. Prefer a minimally scoped admin key if Venice supports it, avoid running it in broad privileged shells, and consider pinning or preinstalling reviewed dependencies before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/api_keys_list.py:1
Finding

Unpinned Runtime Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: scripts/api_keys_list.py:1-4, scripts/balance.py:1-4, scripts/usage.py:1-4, and SKILL.md:105-107
Vulnerability Type: Unpinned third-party dependency resolved and installed at runtime
Risk Level: Medium

Vulnerable Code

Each Python script contains the following PEP 723 dependency declaration:

python
# /// script
# requires-python = ">=3.10"
# dependencies = ["httpx"]
# ///

The documented execution model confirms that this dependency is installed automatically:

markdown
This skill uses `uv run` which automatically installs Python dependencies (httpx) via [PEP 723](https://peps.python.org/pep-0723/) inline script metadata. No manual Python package installation required - `uv` handles everything.

Technical Analysis

The httpx dependency has no exact version constraint, integrity hash, committed lockfile, or explicitly restricted package source. Consequently, uv run may resolve a different dependency release after the Skill has been reviewed.

This creates a supply-chain risk because dependency installation and import occur in a process that can access VENICE_API_KEY. The credential is documented as an administrator API key capable of accessing billing information and API-key metadata. A compromised future release or compromised package-distribution channel could therefore introduce code that executes with the user's process permissions.

The package name is legitimate and there is no evidence in the audited project that the currently resolved package is malicious. The vulnerability is the absence of reproducible and integrity-verified dependency resolution.

Attack Path

  1. An attacker compromises a future httpx release, one of its transitive dependencies, or the package index used by uv.
  2. The user invokes one of the documented commands, such as uv run scripts/api_keys_list.py.
  3. Because no exact dependency version ...[truncated 1046 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin httpx to a reviewed exact version rather than using an unrestricted package declaration:

    python
    # /// script
# requires-python = ">=3.10"
# dependencies = ["httpx==REVIEWED_VERSION"]
# ///

  2. Generate and commit a lockfile that fixes all transitive dependency versions.

  3. Require package hashes or another integrity-verification mechanism where supported.

  4. Configure uv to use only an approved package index and prevent fallback to untrusted sources.

  5. Scan and review dependency updates before changing the pinned version.

  6. Prefer installing dependencies into a controlled environment before executing the Skill, rather than resolving packages during every invocation.

  7. Run the scripts with minimal local permissions and expose VENICE_API_KEY only to the process that requires it.

  8. Rotate the administrator API key immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code chunk implements only balance checking against /billing/balance. It does not include any functionality for viewing usage history or managing API keys, which are explicitly claimed in the declared description. The resource accessed and authentication requirement are consistent with Venice AI admin access, but the implemented scope is materially narrower than the declared capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The supplied code is narrowly focused on viewing usage history. It does not check account balance, create/list/delete/manage API keys, or perform broader account administration actions. Its actual behavior is limited to calling the usage endpoint, formatting results, and optionally writing output locally. This is a material description-to-behavior mismatch because the declared purpose presents multiple administrative capabilities that are not present in the code.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes local scripts that require environment access, network access to the Venice API, and file output capability, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations can lead to over-broad execution privileges and make it harder for users or platforms to review what sensitive actions the skill may perform, especially since it uses an Admin API key.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
import httpx

VENICE_BASE_URL = "https://api.venice.ai/api/v1"


def get_api_key() -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/api_keys_list.py (reported line 20)May include surrounding context.

python
import httpx

VENICE_BASE_URL = "https://api.venice.ai/api/v1"


def get_api_key() -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/balance.py (reported line 19)May include surrounding context.

python
import httpx

VENICE_BASE_URL = "https://api.venice.ai/api/v1"


def get_api_key() -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/usage.py (reported line 21)May include surrounding context.

python
import httpx

VENICE_BASE_URL = "https://api.venice.ai/api/v1"


def get_api_key() -> str:

Static analysis

No suspicious patterns detected.