ClawHub
Back to skill

Security audit

FrameFerry

Security checks for vulnerabilities and agentic risk

Overview

FrameFerry is a disclosed tool for saving public Instagram media through InstaCognito, and its browser, network, and file access match that stated purpose with clear limits.

Install only if you are comfortable using InstaCognito as a third-party provider and have permission or rights to archive the public profile. Use a dedicated output folder, keep cookies/tokens/secrets out of the workflow, and review any optional scheduler or sub-agent delegation before enabling it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about Instagram media archiving and export functionality. The supplied code does not implement archiving, syncing, receipt handling, section-aware reporting, or ZIP export. Instead, it is an internal test harness that prepares a temporary workspace, copies selected repo files, configures a sandboxed environment with bubblewrap, and runs node --test under resource limits. This is a materially different primary purpose from the declared skill behavior, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs use of shell commands, package installation, and writing archives/ZIPs to arbitrary local paths, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and makes it easier for an agent runtime to grant broader-than-necessary shell, filesystem, or environment access during execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Using npx playwright install chromium without a pinned package version allows resolution of whatever Playwright version is current in the environment or registry at execution time. This creates a supply-chain risk and undermines reproducibility, because a compromised or incompatible upstream release could change behavior or execute unreviewed install scripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code automatically navigates to instacognito.com and submits the user-provided Instagram handle to that third-party service via browser automation. Even though the handle is public and validated, transmitting user-supplied identifiers to an external site without an explicit consent/notice step creates a privacy and data-sharing risk, especially in agent contexts where users may not realize their input leaves the local environment.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/orchestration.md (reported line 77)May include surrounding context.

md
ACTION_REQUIRED, or UNVERIFIED with a short reason; keep the original CLI
  outcome separate and unchanged.
- **Do NOT touch:** Media/state/source/config/schedules, other profiles, or the
  live site. Do not redownload, escalate access or spawn another agent. Never
  follow paths outside the approved output tree or through symlinks.
- **Verification:** Check local receipts and file presence/size; for full integrity
  review recompute SHA-256 read-only in a script over the approved receipt files.