ClawHub
Back to skill

Security audit

Agentlink Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cloud sandbox integration, but it grants broad browser, Windows desktop, command, file, process, registry, and direct low-level tool access with limited scoping guidance.

Review before installing. Use this only with an AgentLink API key you are comfortable exposing to the SDK, prefer wrapped APIs, avoid direct call_tool() except for clearly needed operations, and require explicit user approval before logins, package installs, file deletion, process killing, registry edits, or other destructive sandbox actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
pyproject.toml:6
Finding

Unbounded Third-Party SDK Dependency Permits Unreviewed Releases

Content
View full analysis

Vulnerability Details

File Location: pyproject.toml:6-8; duplicated in SKILL.md:15-18
Vulnerability Type: Unbounded third-party dependency / supply-chain risk
Risk Level: Medium

Complete vulnerable configuration (pyproject.toml:6-8):

toml
dependencies = [
    "agentlink-sdk>=1.0.0",
]

Corresponding Skill dependency declaration (SKILL.md:15-18):

yaml
python:
  - agentlink-sdk>=1.0.0

Technical Analysis

The agentlink-sdk dependency is constrained only by a minimum version. A package resolver may therefore install any later release without that release having been reviewed with this Skill. The project does not include an exact version pin, lockfile, or package hashes to guarantee installation of a known artifact.

This exposure is security-sensitive because the SDK is initialized inside the Agent process, automatically reads AGENTLINK_API_KEY from the environment, communicates with an external cloud service, and provides interfaces for browser automation, shell execution, Windows desktop control, filesystem access, clipboard access, process management, and registry operations.

This finding does not establish that the current SDK release is malicious. It establishes that the dependency policy permits a future compromised, malicious, or otherwise unsafe release to become part of the effective Skill implementation without a corresponding change to this repository.

Attack Path

  1. An attacker compromises the upstream agentlink-sdk publishing account, release process, distribution channel, or a future package release.
  2. The attacker publishes a version newer than 1.0.0 containing malicious package installation or runtime behavior.
  3. During installation or dependency resolution, the agentlink-sdk>=1.0.0 constraint accepts the attacker-controlled release.
  4. The Agent imports or initializes the installed SDK when this Skill is used.
  5. Malicious c ...[truncated 1045 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the open-ended dependency constraint with an exact, security-reviewed version, for example:

    toml
    dependencies = [
    "agentlink-sdk==1.2.0",
]

    Select the exact version only after verifying that it is the intended trusted release.

  2. Apply the same exact constraint in SKILL.md so the metadata and package configuration cannot resolve different versions.

  3. Generate and commit a lockfile appropriate to the build workflow. Require cryptographic hashes for resolved distributions where supported, such as through a hash-locked requirements file.

  4. Install packages only from an explicitly configured trusted package index. Disable unintended fallback indexes to reduce dependency-confusion exposure.

  5. Review SDK release notes, source changes, maintainership, and artifact provenance before updating the pin. Perform updates through a controlled pull request rather than automatic unconstrained resolution.

  6. Add automated dependency and provenance scanning to CI, including vulnerability advisories, package integrity verification, and alerts for ownership or publishing anomalies.

  7. Restrict AGENTLINK_API_KEY to the minimum required permissions and usage scope, rotate it periodically, and ensure it is injected only at runtime. Monitor the associated account for anomalous sandbox creation or API consumption.

  8. Run the Agent process with least privilege and prevent it from accessing unrelated host secrets, credentials, and files, limiting the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill advertises browser automation, shell commands, desktop control, process management, and file operations without prominently warning that these capabilities can access sensitive data, execute arbitrary code, or make destructive system changes. In an agent setting, lack of clear safety guidance materially increases the risk of unsafe autonomous actions and user surprise.

Content

No source excerpt is available for this finding.

MCP Config Access

High
Category
Agent Snooping
Confidence
92% confidence
Finding

Documenting list_tools() as a way to enumerate all available MCP tools exposes capability discovery that may reveal powerful or unsafe tool surfaces beyond the wrapped API. In combination with autonomous agent behavior, this can enable expansion from intended operations into unexpected privileged actions if hidden or less-reviewed tools are present.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

The SDK wraps common APIs, but sandboxes may have additional MCP tools. Use list_tools() to discover all available tools, and call_tool() to call any tool directly:

python
# List all MCP tools in the browser sandbox
from agentlink_sdk.models.sandbox import IMAGE_BROWSER, IMAGE_WINDOWS

result = al.list_tools(IMAGE_BROWSER)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

The skill explicitly encourages listing Windows sandbox MCP tools and then calling any tool directly, which can expose internal capability configuration and broaden the reachable attack surface. This is especially risky in a Windows/code-execution context because undisclosed tools may permit filesystem, process, registry, or network actions beyond the intended abstraction layer.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
for tool in result.data:
    print(tool["name"], "-", tool.get("description", ""))

# List all MCP tools in the Windows sandbox
result = al.list_tools(IMAGE_WINDOWS)

# Call any MCP tool directly (sandboxId auto-injected)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs agents to proactively invoke a powerful browser/desktop/code-execution sandbox for a very broad set of situations, including cases where the user did not explicitly request sandboxing. That increases the chance of unnecessary exposure to remote content, code execution, file operations, or state-changing actions without clear user intent or confirmation.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

Telling agents they may call_tool() to invoke any MCP tool directly bypasses the safety benefits of higher-level wrapped APIs and creates effectively unrestricted tool access. In this skill's context, that can translate into arbitrary browsing, command execution, file access, or other privileged sandbox actions with reduced reviewability and weaker policy boundaries.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

Discovering & Calling MCP Tools (Important)

The SDK wraps common APIs, but sandboxes may have additional MCP tools. Use list_tools() to discover all available tools, and call_tool() to call any tool directly:

python
# List all MCP tools in the browser sandbox

Static analysis

No suspicious patterns detected.