ClawHub
Back to skill

Security audit

position-size-calculator

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does the disclosed calculator job, but it has under-disclosed ways to send an API key to a non-SentiSense server and encourages optional external CLI execution with credential access.

Use the bundled node scripts/prepare_data.mjs path rather than the optional npx CLI path. Before running it, make sure SENTISENSE_BASE_URL is unset unless you intentionally trust that endpoint, and treat SENTISENSE_API_KEY as a real credential that may expose quota or subscription data if sent to the wrong server.

A.I.G

By Tencent
Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/prepare_data.mjs:25
Finding
API Credential Can Be Transmitted to an Arbitrary Configured Server## Vulnerability Details **File Location**: `scripts/prepare_data.mjs`, lines 25-81 **Vulnerability Type**: Unvalidated credential destination **Risk Level**: Medium ### Vulnerable Code ```js const BASE = process.env.SENTISENSE_BASE_URL || "https://app.sentisense.ai"; const KEY = process.env.SENTISENSE_API_KEY; ``` ```js async function get(path, { allowNullData = false, tolerate400 = false, tolerate404 = false, optional = false, } = {}) { // ... let response; try { response = await fetch(`${BASE}${path}`, { headers: { "X-SentiSense-API-Key": KEY, Accept: "application/json", "User-Agent": UA }, }); } catch (cause) { fail(`network error calling ${path}`, String(cause && cause.message ? cause.message : cause)); } } ``` ### Technical Analysis The script obtains the sensitive `SENTISENSE_API_KEY` from the environment and attaches it to every request through the `X-SentiSense-API-Key` header. Although the intended destination is `https://app.sentisense.ai`, the undocumented `SENTISENSE_BASE_URL` environment variable can replace the complete origin. No URL parsing, HTTPS enforcement, or hostname allowlist is applied before the credential is sent. Consequently, the script can transmit the API key to any HTTP or HTTPS server selected through the process environment. This behavior exceeds the minimum privileges required by the declared functionality, which only requires authenticated requests to the official SentiSense API. ### Attack Path 1. An attacker, compromised launcher, CI configuration, wrapper script, or poisoned environment sets `SENTISENSE_BASE_URL` to an attacker-controlled server. 2. The legitimate user supplies `SENTISENSE_API_KEY` and invokes `scripts/prepare_data.mjs` as documented. 3. The script constructs API URLs from the attacker-controlled base URL. 4. It sends the victim's API key in the `X-SentiSense-API-Key` header to the attacker-controlled ...[truncated 611 chars]
Remediation
## Remediation Suggestions - Remove `SENTISENSE_BASE_URL` from production code and use a fixed API origin. - If endpoint substitution is required for development, place it behind an explicit development-only option that is disabled by default. - Parse the destination with `new URL()` and require: - The `https:` protocol. - An exact hostname match for `app.sentisense.ai`. - An approved port and base path. - No embedded username or password. - Apply the API-key header only after validating the destination origin. - Disable or carefully validate redirects for authenticated requests so credentials cannot reach an unapproved origin. - Document every supported network destination and security-sensitive environment variable. - Add automated tests confirming that HTTP URLs and unapproved hosts are rejected before any request is made.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:117
Finding
Documentation Encourages Execution of Registry-Downloaded Code with Credential Access## Vulnerability Details **File Location**: `SKILL.md`, lines 117-121 **Vulnerability Type**: Third-party package supply-chain exposure **Risk Level**: Medium ### Vulnerable Instructions ```bash npx -y sentisense@0.52.0 quote NVDA --json npx -y sentisense@0.52.0 sentiment NVDA --json ``` ```markdown `--json` returns the exact API response, envelope included. There is no CLI command for the daily bars, so the chart call stays REST on either path. Auth: `SENTISENSE_API_KEY` in the environment, or store it once with `npx -y sentisense@0.52.0 auth "$SENTISENSE_API_KEY"` (saved to `~/.config/sentisense/`, file mode 600, local to your machine, removable with `auth --remove`). The version is pinned deliberately: a pinned version runs reviewed, immutable code. ``` ### Technical Analysis The documentation offers `npx -y` commands as an alternative workflow. These commands can retrieve and execute code from the configured npm registry without an interactive confirmation. The downloaded package is outside the reviewed project files and can execute with the invoking user's filesystem, process, and environment permissions. Pinning the package version improves reproducibility but does not establish that the package is reviewed or immutable. Registry account compromise, package replacement, registry substitution, or compromise of the package's dependency graph could still expose users to malicious code. The `auth` example additionally passes the API key as a command-line argument, which can expose it through shell history or process inspection on some systems. ### Attack Path 1. The user follows the optional CLI instructions in `SKILL.md`. 2. `npx -y` resolves and downloads `sentisense@0.52.0` and any required dependencies from the configured registry or local npm configuration. 3. A compromised package, dependency, registry, or registry configuration supplies malicious code. 4. npm executes package installation lifecycle behavior ...[truncated 733 chars]
Remediation
## Remediation Suggestions - Prefer and prominently recommend the bundled zero-dependency script instead of `npx`. - Do not describe a version pin alone as making package code reviewed or immutable. - If the CLI must be supported, vendor and review its source or distribute it with verified cryptographic integrity metadata. - Use a lockfile and integrity hashes for all transitive dependencies. - Restrict npm to an explicitly trusted registry and verify package provenance or signatures where available. - Avoid `npx -y` for security-sensitive workflows because it suppresses confirmation before execution. - Do not pass secrets as command-line arguments. Read credentials from protected environment variables, standard input, or a secure credential store. - Run external package tooling in a sandbox with restricted filesystem, environment, and network access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/prepare_data.mjs:25