ClawHub
Back to skill

Security audit

Subfeed

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Subfeed cloud integration, but it asks agents to load mutable remote instructions and create cloud resources before clear user approval.

Review before installing. Only use this skill if you intend to connect your agent to Subfeed Cloud, and do not let it register accounts, create entities, upload RAG/chat content, or use a full account API key unless you have explicitly approved the exact action and data being sent. Prefer a scoped agent token and avoid following remotely fetched skill instructions unless you can verify what changed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:16
Finding

Mandatory Retrieval of Mutable Remote Instructions

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:21
Finding

Autonomous Third-Party Registration and Cloud Resource Creation Without Prior User Approval

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:168
Finding

Use of Full-Account Credentials for Operations That Can Use a Scoped Agent Token

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

GET /v1/entity — List entities GET /v1/entity/{id} — Get entity PATCH /v1/entity/{id} — Update entity DELETE /v1/entity/{id} — Delete entity POST /v1/entity/{id}/chat — Chat with entity

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

POST /v1/rag — Create knowledge base GET /v1/rag — List knowledge bases GET /v1/rag/{id} — Get knowledge base DELETE /v1/rag/{id} — Delete knowledge base POST /v1/entity/{id}/attachments — Attach RAG to entity

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

text
GET    /v1/entity/{id}/addons           — List enabled addons
POST   /v1/entity/{id}/addons           — Enable addon
DELETE /v1/entity/{id}/addons/{type}    — Disable addon

Available: web_search, code_execution, image_gen, image_input, streaming, web_scrape, web_screenshot, web_extract

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description promises that an IDE agent will 'self-register and start building' with 'Human is optional,' which encourages autonomous execution of account creation and remote actions without a clear consent boundary. In the context of an agent skill, overly broad activation language increases the chance the agent will initiate external operations or onboarding flows unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to ask for the user's email and transmit it to Subfeed, but the top-level description does not provide an upfront privacy warning before the workflow begins. This is risky because users may invoke the skill without realizing personal data will be collected and sent to a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This step directs the agent to register itself by sending data to an external API, including agent identity details and potentially credentials generated by the service. External transmission is expected for a cloud integration, but it is still security-relevant because the skill encourages autonomous account creation and token handling with a third party.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Create your agent identity:

text
POST https://api.subfeed.app/v1/agents/register
Content-Type: application/json

{

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This step instructs collection of a human email address and transmission of that personal data plus an agent token to Subfeed to create an account. Because it involves personal data and account provisioning on behalf of the user, the risk is higher than generic external transmission, especially if the user has not been clearly warned beforehand.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Ask them: "What email should I use for your Subfeed account?"

text
POST https://api.subfeed.app/v1/agents/register
Content-Type: application/json

{ "email": "human@example.com", "agentToken": "sf_agent_..." }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md
| URL | Purpose | Data Sent |
|-----|---------|-----------|
| `https://api.subfeed.app/*` | All API calls | Entity configs, messages, RAG content |
| `https://subfeed.app/skill/*.md` | Sub-skill docs | None (read-only fetch) |

All data is sent to Subfeed Cloud servers only. No third-party data sharing.

Static analysis

No suspicious patterns detected.