ClawHub
Back to skill

Security audit

Deploy an app on AgentsPodium

Security checks for vulnerabilities and agentic risk

Overview

The skill is a transparent AgentsPodium deployment guide, but it deserves review because private repository tokens are stored for rebuilds and exposed inside the running pod.

Install or use this only if you are comfortable sending deployment configuration to AgentsPodium. For private repositories, use a short-lived, read-only token scoped to one repository, rotate it after deployment if possible, and do not deploy code or dependencies you do not trust while that token is available in the pod environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:190
Finding

Private repository credential remains accessible to deployed application code

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:77
Finding

Unpinned package execution through npx during deployment

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says to use the skill when asked to 'ship an app somewhere' or 'move a site off Netlify or Vercel,' which is broad natural language that overlaps with many generic deployment requests. It does not clearly constrain invocation to AgentsPodium-specific deployments or provide exclusion conditions, increasing the risk of unintended activation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This skill instructs sending sensitive deployment data to an external service, including repository URLs, environment variables, and potentially repoToken for private repositories. External transmission is expected for a deployment skill, but it is still security-relevant because the deployed code runs in the same pod and the document explicitly states the repo token lives in the pod environment, meaning untrusted application code could read and misuse it.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

a self-hosted Forgejo:

bash
curl -s -X POST https://agentspodium.com/api/agents \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{
    "engine": "app",
    "tier": "small",

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Listing agents with an API key transmits and returns potentially sensitive metadata to an external service, including agent IDs, names, endpoint URLs, and repository information visible to that key. In context this is normal platform usage, but it remains a real security-sensitive operation because compromise or overuse of the key exposes infrastructure inventory and app details that aid follow-on attacks.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

If you do not have the id, list what the key can see:

bash
curl -s https://agentspodium.com/api/agents -H "Authorization: Bearer $TOKEN"
# {"agents":[{"id":"agt_…","name":"hq-app","engine":"app","status":"running",
#             "endpointUrl":"https://…","app":{"repo":"…","branch":"main",…}}]}

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest frames this skill as deploying a project from a git repository onto AgentsPodium. In the documentation, however, it expands into general instance administration and billing-related operations by pointing users to status, liveness, usage, term, pause/resume/delete/export, and payment endpoints, which exceed the narrow semantic scope of 'deploy an app.'

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest describes a deployment skill focused on shipping apps from git repositories. Mentioning an alternate mailbox-based auth flow introduces account authentication behavior that is not necessary to understand or perform the core deployment task and broadens the apparent scope of the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.