ClawHub
Back to skill

Security audit

Header - Gateway to self-improving agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Header API integration, but it asks users to grant broad account access and documents sensitive sharing, billing, scheduling, and credential-handling workflows with limited safeguards.

Install only if you are comfortable giving this skill broad control over your Header account. Prefer a least-privilege or temporary API key if Header supports it, confirm any public sharing or billing action manually, and avoid putting real FreshRSS passwords directly into shell commands or agent-visible transcripts.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:60
Finding

Full-Scope API Key Violates Least-Privilege Requirements

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Excessive API privileges
Risk Level: High

Vulnerable Code

markdown
## Setup

1. Sign up at [joinheader.com](https://joinheader.com)
2. Create an API key (scope: **full**) at Dashboard > API Keys
3. Set `HEADER_API_KEY` in your environment (e.g. `.env` file, shell profile, or agent config)

Technical Analysis

The Skill requires a full-scope API key even though common workflows—such as listing topics, reading briefings, browsing source entries, and checking subscriptions—are read-only. The same credential is also used for operations that delete resources, publish briefings, modify subscriptions, access billing functions, and change account configuration.

Requiring the broadest available scope by default violates the principle of least privilege. If the API key is exposed through environment inspection, configuration leakage, agent logs, shell tracing, or another compromised process, the exposed credential may grant substantially more access than the user intended for a read-only briefing request.

The Skill includes confirmation requirements for destructive actions, but those are agent-level instructions rather than API-enforced access controls. An attacker possessing the full-scope credential would not be constrained by those instructions.

Attack Path

  1. A user follows the setup instructions and creates a full-scope Header API key.
  2. The key is stored in an environment variable, .env file, shell profile, or agent configuration.
  3. An attacker or compromised local process obtains HEADER_API_KEY through configuration disclosure, environment access, execution logs, or another local compromise.
  4. The attacker sends authenticated requests directly to the Header API.
  5. Because the key has full scope, the attacker can perform mutating operations rather than being limited to reading briefings.
  6. Depending o ...[truncated 801 chars]
Remediation
View remediation

Remediation Suggestions

  1. Default to a read-only API key for listing topics, retrieving briefings, browsing entries, and inspecting account state.
  2. Define granular scopes for distinct operations, such as:
    • topics:read
    • briefings:read
    • sources:write
    • subscriptions:write
    • sharing:write
    • billing:manage
    • resources:delete
  3. Request an elevated credential only when the user explicitly invokes a workflow that requires mutation.
  4. Use short-lived or task-specific tokens where supported.
  5. Require fresh user confirmation before using delete, public-sharing, billing, or credential-management scopes.
  6. Store credentials in a secrets manager or protected agent secret store rather than shell profiles or plaintext .env files.
  7. Ensure credentials are redacted from command output, error messages, traces, and agent transcripts.
  8. Document key rotation and revocation procedures and recommend periodic rotation.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:270
Finding

FreshRSS Credentials Are Embedded in Command-Line Request Bodies and Disclosed to a Third Party

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 270–279
Vulnerability Type: Insecure handling of authentication credentials
Risk Level: High

Vulnerable Code

bash
# OPML (max 10 MB)
curl -sL -X POST "$API/imports/opml" -H "$AUTH" -F "file=@/path/to/feeds.opml"

# FreshRSS — validate then import
curl -sL -X POST "$API/imports/freshrss/validate" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"url": "https://freshrss.example.com", "username": "user", "password": "pass"}'

curl -sL -X POST "$API/imports/freshrss" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"url": "https://freshrss.example.com", "username": "user", "password": "pass"}'

Technical Analysis

The documented workflow places the FreshRSS username and password directly in a curl command-line argument and transmits them to the Header API. If placeholders are replaced with actual credentials, the secrets may be exposed in the process argument list while the command is running. They may also be retained in shell history, agent execution records, debugging output, audit telemetry, or conversation transcripts.

The credentials are intentionally transmitted over HTTPS to Header so that its service can connect to FreshRSS. Nevertheless, this expands the credential trust boundary from the user's FreshRSS instance to the Header service and its supporting logs and infrastructure. The documentation does not state how the credentials are encrypted, retained, redacted, or deleted server-side.

Sending a long-lived primary password through a third-party import workflow is not the minimum-risk method. Validation and import also send the same credentials twice, increasing handling and observability opportunities.

Attack Path

  1. A user asks the agent to import feeds from FreshRSS.
  2. The user supplies a FreshRSS username and password.
  3. The agent substitutes those secrets into the JSON passed through `c ...[truncated 1208 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer OAuth, a revocable application password, or a narrowly scoped FreshRSS API token instead of the user's primary password.
  2. Collect secrets through a protected secret-input mechanism rather than embedding them in generated shell commands.
  3. Avoid passing credentials in command-line arguments. Supply request bodies through protected standard input or a securely created temporary file with restrictive permissions and immediate deletion.
  4. Redact usernames, passwords, authorization headers, and request bodies from agent transcripts, shell tracing, error reports, and telemetry.
  5. Obtain explicit informed consent before transmitting FreshRSS credentials to Header and clearly identify the receiving service.
  6. Document server-side encryption, retention, access controls, log redaction, and deletion behavior.
  7. Do not persist credentials after validation or import unless continuing synchronization explicitly requires it.
  8. If ongoing access is necessary, store only an encrypted, revocable, narrowly scoped token and provide a visible revocation mechanism.
  9. Warn users not to reuse their primary FreshRSS password and recommend rotating any credential previously supplied through command-line or logged workflows.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (24)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

Trigger: "header list", "show my topics", "what am I following"

bash
curl -sL -H "$AUTH" "$API/topics/dashboard" | python3 -c "
import sys, json
d = json.load(sys.stdin)
for t in d.get('custom_topics', []):

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

bash
# List briefings for a goal
curl -sL -H "$AUTH" "$API/goals/GOAL_ID/briefings" | python3 -c "
import sys, json
d = json.load(sys.stdin)
for b in d.get('briefings', d if isinstance(d, list) else []):

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Although the Python snippet itself only prints fetched text, this endpoint returns synthesized briefing content from external sources, and the skill is specifically intended to surface executable action items. In agent settings, displaying or forwarding untrusted synthesized instructions without strong prompt-injection handling can lead to indirect instruction following or unsafe downstream actions, especially because users may ask 'what should I do today' and trust the output.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
"

# Read a specific briefing
curl -sL -H "$AUTH" "$API/briefings/BRIEFING_ID" | python3 -c "
import sys, json
d = json.load(sys.stdin)
print(d.get('summary', d.get('content', 'No content')))

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash
# Browse available public topics
curl -sL -H "$AUTH" "$API/topics/catalog" | python3 -m json.tool

# Subscribe by topic ID
curl -sL -X POST "$API/topics/TOPIC_ID/subscribe" -H "$AUTH"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
curl -sL -H "$AUTH" "$API/topics/catalog" | python3 -m json.tool

# Subscribe by topic ID
curl -sL -X POST "$API/topics/TOPIC_ID/subscribe" -H "$AUTH"

# Unsubscribe (confirm with user first)
curl -sL -X DELETE "$API/topics/TOPIC_ID/subscribe" -H "$AUTH"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

This reads completed briefing text generated from aggregated external content and presents it to the agent/user. In an agent environment, such content can contain prompt-injection style instructions or manipulative action recommendations; the skill partially mitigates this by saying actions require approval, but the generic brief-me triggers and emphasis on executable action items keep the risk real.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
done

# Read the completed briefing
curl -sL -H "$AUTH" "$API/briefings/$BRIEFING_ID" | python3 -c "
import sys, json
d = json.load(sys.stdin)
print(d.get('summary', 'No content'))

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

Add sources (use member_id, not source_id)

curl -sL -X POST "$API/source-groups/$GROUP_ID/members"
-H "$AUTH" -H "Content-Type: application/json"
-d '{"member_id": "SOURCE_UUID", "member_type": "source"}'

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

"

Entries for all sources in a group

curl -sL -H "$AUTH" "$API/source-groups/GROUP_ID/entries?limit=20&offset=0" | python3 -m json.tool

text

### Refresh & validate a source

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

See what content is queued before it becomes a briefing.

bash
curl -sL -H "$AUTH" "$API/goals/GOAL_ID/feed?limit=20&offset=0" | python3 -c "
import sys, json
d = json.load(sys.stdin)
for e in d.get('entries', d if isinstance(d, list) else []):

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

bash
# Link
curl -sL -X POST "$API/goals/GOAL_ID/source-groups" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"source_group_id": "GROUP_ID"}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

curl -sL -X POST "$API/goals/GOAL_ID/subscribe" -H "$AUTH" curl -sL -X DELETE "$API/goals/GOAL_ID/subscribe" -H "$AUTH" curl -sL -H "$AUTH" "$API/goals/GOAL_ID/subscription" | python3 -m json.tool curl -sL -H "$AUTH" "$API/subscriptions" | python3 -m json.tool

text

### Share a briefing publicly

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

While not truly script fetching, this line performs a high-consequence external action: making a briefing public. In context, the real danger is privacy exposure rather than code execution, and the absence of a conspicuous privacy warning makes accidental disclosure more likely.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

Share a briefing publicly

bash
curl -sL -X PUT "$API/briefings/BRIEFING_ID/sharing" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"is_public": true}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

bash
curl -sL -H "$AUTH" "$API/preferences" | python3 -m json.tool
curl -sL -X PUT "$API/preferences" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"key": "value"}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 368)May include surrounding context.

bash
curl -sL -H "$AUTH" "$API/billing/subscription" | python3 -m json.tool
curl -sL -X POST "$API/billing/create-checkout" -H "$AUTH" | python3 -m json.tool
curl -sL -X POST "$API/billing/portal" -H "$AUTH" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 369)May include surrounding context.

bash
curl -sL -H "$AUTH" "$API/billing/subscription" | python3 -m json.tool
curl -sL -X POST "$API/billing/create-checkout" -H "$AUTH" | python3 -m json.tool
curl -sL -X POST "$API/billing/portal" -H "$AUTH" | python3 -m json.tool

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include very generic requests such as 'brief me' and 'what should I do today', which can overlap with ordinary assistant interactions and cause accidental invocation of this skill. Because the skill can make authenticated API calls that create subscriptions, topics, imports, and other state-changing actions, unintended routing could expose account data or perform actions the user did not mean to trigger.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
curl -sL -H "$AUTH" "$API/topics/catalog" | python3 -m json.tool

# Subscribe by topic ID
curl -sL -X POST "$API/topics/TOPIC_ID/subscribe" -H "$AUTH"

# Unsubscribe (confirm with user first)
curl -sL -X DELETE "$API/topics/TOPIC_ID/subscribe" -H "$AUTH"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Phase 2: Create sources

bash
curl -sL -X POST "$API/sources/" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"name": "Source Name", "url": "https://example.com/feed.xml", "type": "rss"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

Add sources (use member_id, not source_id)

curl -sL -X POST "$API/source-groups/$GROUP_ID/members"
-H "$AUTH" -H "Content-Type: application/json"
-d '{"member_id": "SOURCE_UUID", "member_type": "source"}'

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

Trigger: "refresh [source]", "check if [source] is working"

bash
curl -sL -X POST "$API/sources/SOURCE_ID/refresh" -H "$AUTH"
curl -sL -X POST "$API/sources/SOURCE_ID/validate" -H "$AUTH"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

bash
# Link
curl -sL -X POST "$API/goals/GOAL_ID/source-groups" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"source_group_id": "GROUP_ID"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents making a briefing public with is_public: true but does not warn that briefings may contain private goals, source selections, or synthesized insights derived from a user's interests. A user or agent could expose sensitive research, strategic priorities, or proprietary monitoring topics without understanding the privacy consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This call changes a briefing's sharing state to public, which can disclose potentially sensitive research summaries, goals, and strategic interests to external parties. The danger is increased because the skill lacks an adjacent explicit privacy warning, so an agent could perform the visibility change without adequately informing the user of disclosure consequences.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

Share a briefing publicly

bash
curl -sL -X PUT "$API/briefings/BRIEFING_ID/sharing" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"is_public": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

bash
curl -sL -H "$AUTH" "$API/preferences" | python3 -m json.tool
curl -sL -X PUT "$API/preferences" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"key": "value"}'

Static analysis

No suspicious patterns detected.