ClawHub
Back to skill

Security audit

G2 Software Reviews API - Products and Ratings

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Scavio API guide for querying G2 data, with disclosed external API use and no hidden local execution or persistence.

Before installing, understand that using this skill sends your G2 search terms, product identifiers, filters, and Scavio API key to Scavio, and each API call spends credits. Prefer direct HTTPS calls if you do not need the SDK, and use a virtual environment or reviewed lockfile if you install the optional packages.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:194
Finding

Third-Party SDK Installation Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 194–211
Vulnerability Type: Unverified third-party dependencies
Risk Level: Medium

The Skill recommends installing pinned Python and JavaScript SDK packages directly from public package registries:

bash
pip install scavio==0.15.0
bash
npm install scavio@0.15.0

Technical Analysis

Pinning both dependencies to version 0.15.0 limits unexpected version drift, but the installation instructions do not verify package hashes, signatures, lockfile integrity, or publisher provenance. Package installation can execute registry-provided setup code or lifecycle scripts with the privileges of the user running the package manager.

This is a supply-chain weakness rather than evidence that the named packages are currently malicious. Exploitation depends on compromise of the package, publisher account, registry, or dependency tree. The instructions are optional documentation and are not automatically executed by the Skill, which limits immediate exposure.

Attack Path

  1. An attacker compromises the relevant registry package, publisher account, release artifact, or transitive dependency.
  2. A user follows the documented pip install or npm install command.
  3. The package manager downloads an artifact without validation against a project-controlled trusted hash or signature.
  4. Malicious installation or lifecycle code executes with the invoking user's privileges.
  5. The malicious code reads accessible files, environment variables, or credentials, including SCAVIO_API_KEY, and may transmit them to an attacker-controlled service or modify the local environment.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user performing the installation. The accessible scope may include the project workspace, user-owned files, environment variables, package-manager credentials, and the Scavio API k ...[truncated 369 chars]

Remediation
View remediation

Remediation Suggestions

  • Publish reviewed dependency manifests rather than relying solely on ad hoc installation commands.
  • For Python, provide a requirements file containing trusted hashes and instruct users to install with pip install --require-hashes -r requirements.txt.
  • For npm, provide and review a lockfile containing integrity metadata, and use npm ci for reproducible installation.
  • Verify package publisher identities, release provenance, and signatures where supported.
  • Audit direct and transitive dependencies before approving package upgrades.
  • Install dependencies inside an isolated virtual environment or container using a non-privileged account.
  • Avoid exposing SCAVIO_API_KEY or other secrets during installation. Supply credentials only at runtime after dependencies have been installed and validated.
  • Consider documenting direct HTTPS API calls as the preferred path when the SDK is not required, reducing dependency and lifecycle-script exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Find products - 5 credits
found = requests.post(f"{BASE}/api/v1/g2/search", headers=HEADERS,
    json={"query": "project management", "limit": 100, "sort": "rating", "rating": 4}).json()

# 2. Full profile - 5 credits. Slug or numeric id, both as strings.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
json={"query": "project management", "limit": 100, "sort": "rating", "rating": 4}).json()

# 2. Full profile - 5 credits. Slug or numeric id, both as strings.
profile = requests.post(f"{BASE}/api/v1/g2/product", headers=HEADERS,
    json={"product_id": "notion"}).json()

# NOTE: profile contains NO review text. For that you must call /reviews.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
# NOTE: profile contains NO review text. For that you must call /reviews.

# 3. What enterprise admins say - 5 credits, 10 reviews, plus every facet count
reviews = requests.post(f"{BASE}/api/v1/g2/reviews", headers=HEADERS,
    json={"product_id": "notion", "company_size": "enterprise",
          "role": "administrator", "sort": "newest", "page": 1}).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
# NOTE: profile contains NO review text. For that you must call /reviews.

# 3. What enterprise admins say - 5 credits, 10 reviews, plus every facet count
reviews = requests.post(f"{BASE}/api/v1/g2/reviews", headers=HEADERS,
    json={"product_id": "notion", "company_size": "enterprise",
          "role": "administrator", "sort": "newest", "page": 1}).json()

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:42