ClawHub
Back to skill

Security audit

Dashtask.ai - Task/Project manager and CRM built for AI Agents and Humans to work together.

Security checks for vulnerabilities and agentic risk

Overview

This DashTask skill appears to be a legitimate API integration, but it needs review because it can change or delete business records and send emails without clear confirmation guidance.

Install only if you trust the DashTask endpoint and can configure a least-privilege API key. Grant only the scopes the agent actually needs, and require explicit human approval before deletes, archive actions, settings changes, notifications, or any email send.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:29
Finding

Configurable API Endpoint Can Redirect Credentials and Sensitive Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-32 (also repeated at SKILL.md:37-40, SKILL.md:45-48, and SKILL.md:53-56)
Vulnerability Type: Unvalidated credential-bearing endpoint configuration
Risk Level: High

bash
curl -s -X POST "$DASHTASK_ENDPOINT" \
  -H "X-API-Key: $DASHTASK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action": "get_org_context"}'

Technical Analysis

The skill instructs the agent to send the DashTask API key through the X-API-Key header to the independently configurable DASHTASK_ENDPOINT. The documented request pattern does not enforce HTTPS, validate the destination hostname, restrict the endpoint to trusted DashTask infrastructure, or explicitly reject redirects.

If the environment variable is compromised or incorrectly configured, the agent will transmit the API key and request payloads to that destination. Requests may also contain sensitive organizational, task, contact, lead, or CRM data. This is an insecure configuration pattern rather than evidence that the packaged skill intentionally exfiltrates data.

Attack Path

  1. An attacker obtains the ability to modify the agent's environment or OpenClaw configuration.
  2. The attacker sets DASHTASK_ENDPOINT to an attacker-controlled URL.
  3. The agent follows the skill instructions and executes a credential-bearing request.
  4. The attacker's server receives the X-API-Key header and any submitted request data.
  5. The attacker reuses the captured key against the legitimate DashTask API.
  6. The attacker can perform operations permitted by the key's assigned scopes until the key is revoked or expires.

Impact Assessment

Successful exploitation discloses the DashTask API key. The resulting privileges are limited to the scopes assigned to that key, but may include reading or modifying tasks, projects, CRM leads, contacts, companies, activities, quotes, dimensions, tags, and settings. De ...[truncated 264 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the unrestricted endpoint variable with a fixed, trusted HTTPS endpoint where possible.
  • If endpoint configurability is required, validate the URL before sending credentials:
    • Require the https scheme.
    • Allowlist approved DashTask or Supabase hostnames.
    • Reject embedded credentials, unexpected ports, IP literals, and malformed URLs.
    • Resolve and reject loopback, link-local, private-network, and metadata-service destinations where they are not explicitly required.
  • Disable HTTP redirects for credential-bearing requests or validate every redirect destination against the same allowlist.
  • Use a trusted, credential-aware HTTP integration instead of arbitrary shell-based requests.
  • Apply least privilege when generating API keys and issue separate keys for tasks, crm, and settings when practical.
  • Add endpoint verification to installation and startup checks.
  • Revoke and rotate the API key immediately if endpoint configuration is suspected to have been altered.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:29
Finding

API Key Is Exposed Through Curl Process Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-32 (also repeated at SKILL.md:37-40, SKILL.md:45-48, and SKILL.md:53-56)
Vulnerability Type: Secret exposure through command-line arguments
Risk Level: Low

bash
curl -s -X POST "$DASHTASK_ENDPOINT" \
  -H "X-API-Key: $DASHTASK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action": "get_org_context"}'

Technical Analysis

The shell expands $DASHTASK_API_KEY before starting curl, placing the completed X-API-Key header in the process argument vector. On systems where process arguments are visible to other local users, monitoring utilities, process supervisors, audit systems, or diagnostic collectors, the expanded API key may be captured while the request is running.

Exploitation requires local process-observation access or access to tooling that records command arguments. The short lifetime of a curl process reduces exposure but does not eliminate it.

Attack Path

  1. The agent invokes the documented curl command.
  2. The shell expands $DASHTASK_API_KEY into the header argument.
  3. A local attacker or monitoring component reads or records curl's process arguments.
  4. The API key is extracted from the X-API-Key header value.
  5. The attacker submits authenticated requests using the captured key.
  6. Unauthorized access continues within the key's granted scopes until revocation or expiration.

Impact Assessment

A captured key grants the attacker the same API permissions assigned to the agent. Depending on its scopes, this can permit access to task, CRM, team, notification, or settings operations. The vulnerability does not directly grant operating-system privilege escalation; its impact is confined to the API privileges associated with the exposed credential.

Remediation
View remediation

Remediation Suggestions

  • Avoid passing sensitive headers directly as command-line arguments.
  • Prefer a credential-aware HTTP client or OpenClaw API tool that injects authentication without exposing it in the process argument vector.
  • If curl must be used, provide the sensitive header through a protected configuration stream or file descriptor rather than directly through -H.
  • Ensure any temporary credential configuration is created with restrictive permissions, removed immediately after use, and never written to shared temporary directories.
  • Restrict local process inspection and prevent command-line collection systems from recording secret-bearing arguments.
  • Rotate the API key if process arguments may have been logged or observed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README prominently advertises destructive operations (for example delete and archive actions) and external communications (sending emails and notifications) but does not include clear user-facing safety guidance, confirmation requirements, or warnings about irreversible side effects. In an agent skill context, this increases the chance that an autonomous or semi-autonomous agent will invoke high-impact actions without adequate user awareness, especially because the skill encourages broad operational use across tasks, CRM, settings, and communications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

1. Get Organization Context (call ONCE per conversation — never repeat in the same session)

bash
curl -s -X POST "$DASHTASK_ENDPOINT" \
  -H "X-API-Key: $DASHTASK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action": "get_org_context"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents multiple destructive operations such as delete_task, delete_lead, delete_company, delete_contact, and dimension deletion actions without warning that they permanently modify or remove data. In an autonomous or semi-autonomous agent workflow, omission of confirmation guidance increases the risk of accidental or prompt-induced destructive changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes outbound email capabilities (send_nudge and send_crm_email) but does not warn that these actions contact third parties and may transmit sensitive customer, employee, or organizational data outside the chat context. In an agent setting, this can lead to unintended external communication, privacy incidents, or social-engineering misuse if the model sends emails without explicit user confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.