ClawHub
Back to skill

Security audit

Deploy an agent on AgentsPodium

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about deploying and paying for hosted agents, but it gives agents high-impact provisioning, payment, mailbox/token, and deletion workflows without enough explicit user-confirmation guardrails.

Review before installing. Use this skill only with an account and wallet you are willing to let an agent operate under, require explicit confirmation before creating paid crypto orders or deleting agents, avoid granting broad mailbox access, and prefer pause over delete when intent is unclear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The skill description is broad enough to trigger on generic requests like 'spin up another agent,' which could cause autonomous deployment and payment actions in contexts where the user did not explicitly intend infrastructure provisioning or crypto spending. Because the skill performs real-world account creation and payment operations, ambiguous invocation materially increases the risk of unintended side effects.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill documents a destructive deletion endpoint without explicit guidance to obtain user confirmation or warn about irreversibility. In an agentic setting, exposing deletion as a routine management action can lead to accidental service loss or data destruction if the model interprets maintenance requests too aggressively.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| Set the pod timezone | `PATCH /timezone` |
| Back up now | `POST /backup` |
| Check it is alive | `GET /liveness` |
| Delete it | `DELETE /agents/:id` |

Pause is worth knowing about: it closes the pod rather than idling it, so a
paused agent costs nothing, and `resume` rebuilds from the last snapshot.
Confidence
92% confidence
Finding
The skill includes a direct `DELETE /agents/:id` operation with no described parameter validation, confirmation workflow, or scoping protections. In a tool-using agent, this creates a realistic path for tool parameter abuse where the wrong `agent.id` could be supplied or inferred, resulting in deletion of an unintended agent.

Static analysis

No suspicious patterns detected.