ClawHub
Back to skill

Security audit

Zipsa

Security checks for vulnerabilities and agentic risk

Overview

Review recommended: the skill is coherent as a privacy gateway, but it handles very sensitive prompts and lacks clear safeguards around local relay authentication, session isolation, cloud-routing risk, and monitoring data.

Install only if you understand and control the Zipsa gateway process. Before using it with regulated, personal, credential, or proprietary data, require authenticated local transport, unique per-conversation session IDs, explicit cloud-routing consent, and sanitized monitoring/alert outputs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/relay_zipsa.py:7
Finding

Sensitive Data Transmitted to an Unauthenticated Plaintext Endpoint

Content
View full analysis

Vulnerability Details

File Location: scripts/relay_zipsa.py, lines 7–14
Vulnerability Type: Unauthenticated plaintext transmission of sensitive data
Risk Level: Medium

python
def call_zipsa(query, session_id="test-session", base_url="http://localhost:8000"):
    try:
        response = requests.post(
            f"{base_url}/relay",
            json={
                "user_query": query,
                "session_id": session_id
            },
            timeout=10
        )

Technical Analysis

The relay transmits the complete user query to an HTTP endpoint without authenticating the receiving service. This Skill is specifically intended to process credentials, health records, government identifiers, personally identifiable information, and proprietary business data. Consequently, the request body can contain highly sensitive material.

Although the endpoint defaults to the loopback interface, loopback does not establish service identity or authorization. A malicious or compromised local process able to listen on port 8000 could impersonate Zipsa and receive the raw prompt. The zipsa-key configuration illustrated in SKILL.md is not applied by this relay.

Attack Path

  1. An attacker gains the ability to run an untrusted process in the same host or container network namespace.
  2. The attacker's process binds to localhost:8000 before the legitimate gateway starts, or replaces an existing gateway process.
  3. The user invokes the relay with sensitive information.
  4. The script sends the complete query to the attacker's /relay endpoint without credentials or service verification.
  5. The attacker records the sensitive request and may return a fabricated JSON response to avoid detection.

Impact Assessment

Successful exploitation does not directly grant additional operating-system privileges. It allows a local attacker to obtain all data submitted through the relay, poten ...[truncated 270 chars]

Remediation
View remediation

Remediation Suggestions

  • Require gateway authentication on every request using a securely provisioned credential rather than a hardcoded value.
  • Authenticate the response source and fail closed if service verification fails.
  • Prefer a permission-restricted Unix-domain socket for same-host communication.
  • If TCP is required, use mutually authenticated TLS and validate the certificate and expected service identity.
  • Bind the gateway using restrictive host and container-network settings.
  • Avoid logging request bodies containing sensitive data.
  • Return a clear security error rather than silently falling back to an unverified endpoint.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/relay_zipsa.py:7
Finding

Shared Hardcoded Session Identifier Can Cause Cross-Conversation Data Exposure

Content
View full analysis

Vulnerability Details

File Location: scripts/relay_zipsa.py, line 7
Vulnerability Type: Insecure session isolation
Risk Level: Medium

python
def call_zipsa(query, session_id="test-session", base_url="http://localhost:8000"):

Technical Analysis

The relay assigns the same default session identifier, test-session, to every invocation. The project documentation states that Zipsa maintains conversation state and separate private and cloud threads. Reusing a global identifier can therefore associate unrelated requests with the same server-side session.

This contradicts the instruction in SKILL.md to use a unique session identifier. If the gateway uses only session_id to locate state, unrelated users or processes can collide with or deliberately select this session and inherit prior conversational context.

Attack Path

  1. A victim invokes the script without supplying a unique session identifier.
  2. Sensitive conversation state is stored by the gateway under test-session.
  3. Another user or process invokes the relay, also using the default identifier.
  4. The gateway treats the later request as part of the victim's existing conversation.
  5. Prior context may influence or appear in the generated response, exposing sensitive information across otherwise unrelated requests.

Impact Assessment

Successful exploitation does not grant operating-system privileges. It can violate session confidentiality and integrity by mixing private context among users, scripts, or independent conversations that share the gateway. The exposure scope depends on the gateway's retention and synthesis behavior, but it may include any sensitive context retained under the shared session identifier.

Remediation
View remediation

Remediation Suggestions

  • Generate a cryptographically random session identifier for each new conversation, such as with Python's secrets module or UUID version 4.
  • Require callers to provide an explicit existing session identifier only when intentionally continuing a conversation.
  • Bind server-side sessions to an authenticated user or tenant rather than trusting the identifier alone.
  • Enforce authorization checks whenever a session is retrieved or updated.
  • Apply expiration, rotation, and deletion policies to retained session state.
  • Do not use predictable identifiers such as test-session outside isolated tests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly instructs the agent to route sensitive user data through a local HTTP gateway and references networked API-style usage, but it does not declare any tool scope or allowed network permissions. That mismatch weakens security controls and reviewability because a host agent may permit unintended network behavior without an explicit declaration, especially risky here because the skill handles PII, healthcare data, business secrets, and credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill switches to Korean for a substantial feature list in the Admin Console section, which imposes a specific language on readers without opt-in. This is a natural-language policy concern because the file otherwise uses English and does not explain that the console documentation is intentionally Korean-only or region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly describes sending an abstracted version of highly sensitive data to cloud providers, but it does not clearly warn users that abstraction is not a guarantee of anonymity and that residual disclosure risk remains. In a privacy-focused skill, this omission is especially dangerous because users may overtrust the system and submit SSNs, health data, or proprietary information believing it is fully protected before cloud transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document specifies logging and alerting fields that include user identity, detection type, target AI service, and endpoint identifiers, and elsewhere routes alerts/reports to external channels such as Slack, email, Teams, and webhooks. In a privacy-focused product, documenting these telemetry flows without explicit minimization, redaction, access controls, or administrator warnings creates a real risk of secondary disclosure of sensitive or regulated data through monitoring systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/relay_zipsa.py (reported line 9)May include surrounding context.

python
# Minimal Zipsa relay script for testing
def call_zipsa(query, session_id="test-session", base_url="http://localhost:8000"):
    try:
        response = requests.post(
            f"{base_url}/relay",
            json={
                "user_query": query,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code sends the user's query and session ID to a network endpoint via an HTTP POST request, which is a safety-relevant data transmission. The file contains no confirmation prompt, user-facing log message, or explanatory docstring/comment warning that input data will be sent over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The file's natural-language content is entirely in Korean and does not indicate that Korean is an optional locale or a justified region-specific requirement. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.