ClawHub
Back to skill

Security audit

Help.Center Article Management

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Help.Center management integration, but it needs review because it can change live help-center content and its shell-based API examples are under-scoped for credential and input safety.

Install only if you trust the publisher and intend to let an agent manage your Help.Center content. Use the narrowest API key scopes possible, prefer draft-only workflows, require a preview or diff before updates, confirm publish/unpublish/delete/category changes explicitly, and avoid uploading arbitrary local file paths or pasting long-lived secrets into chat history.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:57
Finding

Unsafe Shell Command and API Request Construction

Content
View full analysis
Updated full HTML content with changes merged in" }' \ "https://api.help.center/v0/centers/$HC_CENTER_ID/articles/ARTICLE_ID/draft" ``` The same unsafe request-generation pattern is repeated in the create, category-management, image-upload, and metadata examples at lines 112–123, 192–215, 231–234, and 272–282. ### Technical Analysis The Skill instructs an agent to construct executable `curl` commands by replacing placeholders with search terms, article identifiers, titles, HTML content, and file paths. It does not require URL encoding, JSON serialization, strict identifier validation, or execution through an argument-safe API. The update request places generated article content inside a single-quoted shell argument. Article HTML or titles containing an apostrophe can terminate the shell string. If the agent performs direct textual substitution, additional shell syntax may then be interpreted as arguments, redirections, command substitutions, or separate commands. Normal content can also produce malformed JSON even when no malicious input is present. Likewise, inserting an unencoded search term directly into a URL can modify query semantics. If an agent generates shell source rather than p ...[truncated 2859 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md
## What it does

Create, update, search, publish, and organize help center articles directly from your AI agent. Just describe what you want — "write a help article about getting started" or "update the FAQ" — and the skill handles the API calls.

**Supported actions:**

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README uses very broad trigger language like 'write a help article' or 'update the FAQ' and says the skill 'handles the API calls' without clear guardrails about confirmation, scoping, or draft-vs-live behavior. In an agentic context, that can cause the skill to activate on ordinary documentation requests and perform unintended remote content modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README advertises creation, updates, publishing, and unpublishing of help-center content but does not warn that these are state-changing operations against potentially live production knowledge-base data. This omission increases the risk that users or agents treat the skill like a harmless writing helper and accidentally alter public-facing documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation description uses very broad phrases like 'write a help article' and 'update the docs', which can overlap with generic documentation or content-editing requests. This increases the chance the skill is invoked in contexts where the user did not specifically intend to grant access to Help.Center operations, potentially leading to unintended external actions against a live content system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the user to provide an API key and center ID and to store them as environment variables, but it provides no privacy, retention, masking, or least-privilege guidance. That creates a real risk of credential mishandling, accidental disclosure in logs or session history, and overbroad long-lived access to the Help.Center tenant.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

  1. Search for the article first to find its ID and current content:
    bash
    curl -s -X GET \
  -H "Authorization: Bearer $HC_API_KEY" \
  -H "Content-Type: application/json" \
  "https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

curl -s -X GET
-H "Authorization: Bearer $HC_API_KEY"
-H "Content-Type: application/json"
"https://api.help.center/v0/centers/$HC_CENTER_ID/articles?search=SEARCH_TERM&expand[]=content"

text

2. **Read the full article** using the article ID from search results:

External Transmission

Medium
Category
Data Exfiltration
Confidence
77% confidence
Finding

The category creation example sends arbitrary user-supplied fields, including raw SVG content, to an external system. Because SVG can contain active content depending on downstream rendering and the skill provides no sanitization or warning, this can enable stored content injection risks in the help center environment if the platform does not robustly sanitize icons.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

Creating a category:

bash
curl -s -X POST \
  -H "Authorization: Bearer $HC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.