ClawHub
Back to skill

Security audit

Gradient Knowledge Base

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real DigitalOcean Knowledge Base helper, but it deserves review because it can mutate/delete cloud resources and one configurable storage endpoint can send documents and signed request metadata outside the stated DigitalOcean boundary.

Install only if you trust this community package and DigitalOcean with the indexed documents. Use narrowly scoped DigitalOcean and Spaces credentials, verify DO_SPACES_ENDPOINT is an HTTPS DigitalOcean Spaces hostname before uploads, avoid giving the skill account-root tokens, and manually confirm any delete command before running it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gradient_spaces.py:30
Finding

Unvalidated S3 Endpoint Can Redirect Documents and Signed Credential Material

Content
View full analysis
Remediation
View remediation
str: parsed = urlparse(endpoint) hostname = (parsed.hostname or "").lower() if parsed.scheme != "https": raise ValueError("The Spaces endpoint must use HTTPS.") if not ( hostname == "digitaloceanspaces.com" or hostname.endswith(".digitaloceanspaces.com") ): raise ValueError("Only DigitalOcean Spaces endpoints are allowed.") if parsed.username or parsed.password or parsed.query or parsed.fragment: raise ValueError("Invalid Spaces endpoint.") return endpoint ``` 2. Apply validation before creating the boto3 client: ```python endpoint = validate_spaces_endpoint(endpoint) ``` 3. If non-DigitalOcean S3 services must be supported, make that an explicitly documented opt-in mode and require separate credentials rather than reusing DigitalOcean Spaces credentials. 4. Reject plaintext HTTP endpoints and retain TLS certificate verification. 5. Use dedicated, minimally scoped Spaces credentials limited to the required bucket and operations. 6. Update the trust statement to accurately document any supported configurable destinations. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gradient_kb_query.py:88
Finding

Retrieved Knowledge Base Content Is Embedded as Trusted System Instructions

Content
View full analysis
list[dict]: """Build structured messages for RAG, separating system context from user input. Returns a list of chat messages with proper role separation to prevent prompt injection — user input stays in the 'user' role, instructions and KB context stay in the 'system' role. Args: query: The user's original question. kb_results: Results from the Knowledge Base query. Returns: List of message dicts with 'role' and 'content' keys. """ if not kb_results: context = "No relevant documents found in the knowledge base yet. It may still be building up." else: context_parts = [] for i, result in enumerate(kb_results, 1): content = result.get("content", result.get("text", "")) source = result.get("metadata", {}).get("source", "unknown") score = result.get("score", 0) context_parts.append( f"### Source {i} (relevance: {score:.2f}, source: {source})\n" f"{content}" ) context = "\n\n".join(context_parts) system_msg = f"""You are a helpful assistant with access to a knowledge base. Answer the user's question using ONLY the retrieved context below. Be specific, cite source numbers when available, and note when information might be incomplete. If the KB doesn't have enough data, say so honestly. Be concise but thorough. ## Retrieved Context (from Knowledge Base): {context}""" return [ {"role": "system", "content": system_msg}, {"role": "user", "content": query}, ] ``` ### Technical Analysis Knowledge Base results are externally sourced document text and must be treated as ...[truncated 2691 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tainted flow: 'url' from os.environ.get (line 66, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gradient_kb_query.py (reported line 72)May include surrounding context.

python
if alpha is not None:
            payload["alpha"] = alpha

        resp = requests.post(url, headers=headers, json=payload, timeout=15)
        resp.raise_for_status()

        data = resp.json()

Tainted flow: 'headers' from os.environ.get (line 170, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gradient_kb_query.py (reported line 182)May include surrounding context.

python
"max_tokens": 1500,
        }

        resp = requests.post(INFERENCE_URL, headers=headers, json=payload, timeout=30)
        resp.raise_for_status()

        data = resp.json()

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose understates or inconsistently describes capabilities including destructive knowledge-base deletion and broader management actions. Capability mismatch is security-relevant because users may install or invoke the skill expecting search/RAG behavior while unknowingly granting a tool that can modify or permanently delete cloud resources.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The documented purpose understates or inconsistently describes capabilities including destructive knowledge-base deletion and broader management actions. Capability mismatch is security-relevant because users may install or invoke the skill expecting search/RAG behavior while unknowingly granting a tool that can modify or permanently delete cloud resources.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose understates or inconsistently describes capabilities including destructive knowledge-base deletion and broader management actions. Capability mismatch is security-relevant because users may install or invoke the skill expecting search/RAG behavior while unknowingly granting a tool that can modify or permanently delete cloud resources.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requests and uses sensitive environment variables and performs networked operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens user visibility and enforcement around what the skill can access, increasing the risk of over-broad secret exposure or unintended external calls if the associated scripts are executed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

Direct API call:

bash
curl -s https://kbaas.do-ai.run/v1/{kb-uuid}/retrieve \
  -H "Authorization: Bearer $DO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md
| Endpoint | Purpose |
|----------|---------|
| `https://kbaas.do-ai.run/v1/{uuid}/retrieve` | KB retrieval API |
| `https://api.digitalocean.com/v2/gen-ai/knowledge_bases/` | KB management API |
| `https://{region}.digitaloceanspaces.com` | DO Spaces (S3-compatible) |

## Security & Privacy

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The CLI exposes a permanent delete action for knowledge bases without any interactive confirmation, dry-run, or force flag, making accidental or unintended destructive actions easy. In this skill’s context, the deleted resource contains indexed data and configuration for RAG pipelines, so a mistaken invocation can cause real availability and data loss impacts even though this is not a code-execution issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gradient_kb_query.py (reported line 72)May include surrounding context.

python
if alpha is not None:
            payload["alpha"] = alpha

        resp = requests.post(url, headers=headers, json=payload, timeout=15)
        resp.raise_for_status()

        data = resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

When RAG mode is enabled, the script forwards both the user's query and retrieved knowledge-base content to an external LLM inference endpoint. This can expose sensitive or proprietary KB data to a third-party model service, and the prompt-construction approach reduces prompt injection risk but does not prevent data disclosure to the external provider.

Content

Scanner excerpt · scripts/gradient_kb_query.py (reported line 182)May include surrounding context.

python
"max_tokens": 1500,
        }

        resp = requests.post(INFERENCE_URL, headers=headers, json=payload, timeout=30)
        resp.raise_for_status()

        data = resp.json()

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/gradient_spaces.py (reported line 104)May include surrounding context.

python
if client is None:
            client = get_spaces_client()

        client.put_object(
            Bucket=bucket,
            Key=key,
            Body=content.encode("utf-8"),

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a lower bound only (requests>=2.31.0), which allows installation of any newer release without review. This weakens reproducibility and can unintentionally pull in vulnerable, incompatible, or maliciously compromised versions from the package supply chain.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
# Python dependencies for the gradient-knowledge-base skill
# Install in a virtualenv: pip install -r requirements.txt
requests>=2.31.0
boto3>=1.34.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

requests has known security advisories across some versions, and because the manifest does not pin an exact release, it is not possible to verify that deployments will avoid affected versions. In a skill that likely performs network access to DigitalOcean and related services, using an unknowable requests version can expose credential leakage or transport-security issues if a bad release is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as boto3>=1.34.0 rather than an exact version, so builds are not deterministic and may resolve to different releases over time. That increases supply-chain risk and the chance of silently introducing a vulnerable or breaking package version.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
# Python dependencies for the gradient-knowledge-base skill
# Install in a virtualenv: pip install -r requirements.txt
requests>=2.31.0
boto3>=1.34.0