ClawHub
Back to skill

Security audit

xAI Prepaid Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent xAI balance-monitoring helper, but users should understand it uses an xAI management key and may be run from scheduled automations.

Install only if you intend to give this skill access to an xAI management key and allow scheduled checks to contact the xAI management billing API. For task-creation workflows, constrain the automation to a specific task list or project and test the JSON output against your xAI account before relying on low-balance alerts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'req' from os.getenv (line 34, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_xai_balance.py (reported line 44)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=20) as response:
            data = json.loads(response.read().decode("utf-8", "replace"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8", "replace")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs users to run a Python script that reads sensitive environment variables and makes outbound network requests, but the manifest does not declare any tool scope or allowed-tools restrictions. That omission weakens least-privilege controls and makes it harder for a host system to constrain or review the skill’s actual capabilities, increasing the chance of unintended secret exposure or unauthorized external access if the skill is invoked in a broader-permission runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The prompt explicitly instructs the agent to check for and potentially create tasks in the user's task system, but it provides no warning, consent requirement, or safeguard around modifying external state. In a cron/automation context this can lead to unexpected persistent actions, accidental task spam, or writes to the wrong task system if routing or matching is misconfigured.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims to monitor prepaid credit balance, but it queries a postpaid invoice preview endpoint and infers remaining prepaid credits from invoice fields. This mismatch can cause incorrect monitoring, missed low-balance alerts, or false reassurance, which is security-relevant in an automation context because dependent workflows may fail when credits are actually exhausted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code reads the sensitive environment variable XAI_MANAGEMENT_KEY and sends it as a Bearer token in an HTTP request to an external billing API. Although the behavior is functionally necessary, there is no docstring, comment, or user-facing log/print indicating that the script accesses credentials and transmits them over the network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.