ClawHub
Back to skill

Security audit

Agent HQ

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for deploying an Agent HQ board, but it asks users to run unpinned external code and configure recurring cron execution without enough containment or auditability.

Review this skill before installing. Use an isolated, unprivileged account; pin the GitHub repository to a reviewed commit; prefer npm ci with lockfiles; protect Telegram and API tokens outside the repo with restrictive permissions; bind the service to localhost unless intentionally exposing it; and avoid adding cron jobs until the exact scripts and schedule have been reviewed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Unpinned Remote Repository and Dependency Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-21 and 28-35
Vulnerability Type: Remote payload retrieval and insecure dependency execution
Risk Level: High

Vulnerable Code:

bash
git clone https://github.com/thibautrey/agent-hq.git
cd agent-hq
npm install
npm --prefix frontend-react install
bash
npm --prefix frontend-react run build
npm run start:agent-hq
bash
node scripts/jarvis-connector.js

Technical Analysis

The Skill instructs users to clone the mutable default branch of an external Git repository and execute code obtained from it. It does not pin the repository to an immutable commit, verify a cryptographic signature or checksum, or include the referenced source code in the audited package.

The subsequent npm install operations may execute package lifecycle scripts and resolve third-party dependencies. The project contains no lockfile or dependency manifests that can be audited locally, because only SKILL.md is included. The build, server, and connector commands then execute code sourced from the external repository.

This creates a time-of-check/time-of-use supply-chain risk: the code reviewed when the Skill is published can differ from the code downloaded when a user follows the instructions.

Attack Path

  1. An attacker compromises the external repository, a maintainer account, or one of its npm dependencies.
  2. The attacker adds a malicious lifecycle, build, startup, or connector script to the mutable upstream source.
  3. A user follows the Skill instructions and clones the current default branch.
  4. npm install or npm --prefix frontend-react install executes a malicious lifecycle script, or a later build/start command executes the payload.
  5. The payload runs with the permissions of the user performing the installation.
  6. The payload may read local files and credentials, modify user-accessible resources, initiate network conn ...[truncated 625 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a reviewed, immutable commit hash rather than cloning and executing the default branch.
  • Publish and verify cryptographic checksums or signed release artifacts before execution.
  • Include the executable implementation in the Skill package so it can be audited with the instructions.
  • Commit dependency lockfiles and use npm ci instead of unconstrained npm install.
  • Review all npm lifecycle scripts and use npm ci --ignore-scripts where lifecycle execution is unnecessary.
  • Pin dependency versions and enable automated dependency integrity and provenance checks.
  • Run installation and application processes as a dedicated, unprivileged account in an isolated environment.
  • Require a separate, explicit approval before running downloaded build, startup, or automation scripts.

T06 · System Persistence

Error
Location
SKILL.md:32
Finding

Unauditable Scheduled Task Establishes Cross-Session Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-36
Vulnerability Type: Scheduled-task persistence
Risk Level: High

Vulnerable Code:

markdown
4. Configure cron jobs (Heartbeats + Telegram):
   - Jarvis summary: `node scripts/jarvis-connector.js` or `scripts/notify-jarvis-telegram.js --force` as needed.
   - Telegram notifier cron (see `run-telegram-notifier.sh`).
5. Use the UI to create cards or `POST /api/cards`/`/api/cards/quick` to keep Jarvis busy.

Technical Analysis

The Skill explicitly directs users to configure cron jobs that execute scripts obtained from the external repository. Scheduled tasks survive the initial Skill run and repeatedly execute across sessions.

Neither run-telegram-notifier.sh nor the referenced JavaScript files are included in the audited artifact. Consequently, the scheduled command, execution frequency, working directory, inherited environment, failure behavior, update behavior, and credential access cannot be verified.

Persistence through cron amplifies the remote-code risk because a subsequently modified local script can continue executing automatically without further user interaction.

Attack Path

  1. A user clones the external repository and configures the recommended cron job.
  2. The scheduled task points to run-telegram-notifier.sh or one of the referenced JavaScript scripts.
  3. The script is malicious when installed, or it is later replaced through repository updates, dependency compromise, or modification by another process with write access.
  4. Cron automatically invokes the script according to its configured schedule.
  5. The payload repeatedly executes across sessions under the cron owner's account.
  6. The recurring process can access resources and secrets available to that account, including Telegram configuration made available to the notifier.

Impact Assessment

Exploitation provides recurring code execution with the ...[truncated 501 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the complete notifier scripts and exact cron definition in the audited package.
  • Require explicit, informed user approval before installing any persistent scheduled task.
  • Pin and integrity-check every file invoked by the scheduled task.
  • Run the task under a dedicated, unprivileged service account with minimal filesystem and network permissions.
  • Use an absolute executable path, a fixed working directory, and a minimal sanitized environment.
  • Ensure scripts and parent directories are not writable by less-privileged users.
  • Prevent unnecessary secrets from being inherited by cron.
  • Document the schedule, generated logs, update process, and complete removal procedure.
  • Prefer a sandboxed service manager configuration with security restrictions if recurring execution is genuinely required.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:23
Finding

Insufficiently Specified Secret Storage and API Authentication Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23 and 46
Vulnerability Type: Insecure credential configuration and unverifiable access control
Risk Level: Medium

Vulnerable Code:

markdown
2. Edit `config/telegram.json` with your `botToken`/`chatId` (or set `AGENT_HQ_TELEGRAM_TOKEN`/`AGENT_HQ_TELEGRAM_CHAT_ID`). Keep this file secret.
markdown
- `AGENT_HQ_API_TOKEN` protects mutating endpoints for scripted integrations.

Technical Analysis

The Skill instructs users to store a Telegram bot token and chat identifier in a plaintext JSON file or process environment. Although it states that the file should be kept secret, it does not prescribe restrictive filesystem permissions, exclusion from version control and backups, log redaction, token rotation, or use of a secret-management facility.

It also claims that AGENT_HQ_API_TOKEN protects mutating API endpoints, but the server implementation is not present. The audit therefore cannot verify that authentication applies to every mutating endpoint, that token comparison is safe, that tokens are not logged, or that the service binds only to a trusted interface.

Attack Path

  1. A user places a Telegram token in config/telegram.json without restrictive permissions or exposes it through an environment inherited by other processes.
  2. Another local process, backup system, repository operation, diagnostic command, or remotely retrieved application component gains access to the credential.
  3. The exposed bot token is used to interact with the Telegram Bot API within the bot's allowed capabilities.
  4. Separately, if the absent server implementation fails to enforce AGENT_HQ_API_TOKEN consistently, a network-reachable attacker may invoke unprotected mutating endpoints such as card creation or notification operations.

Impact Assessment

Disclosure of the Telegram bot token could permit unauthorized use of the bot within the pe ...[truncated 519 chars]

Remediation
View remediation

Remediation Suggestions

  • Store credentials in a dedicated secret manager where available.
  • If a file must be used, create it with owner-only permissions such as mode 0600 and place it outside the source tree.
  • Supply only a non-secret configuration template and exclude the real configuration from version control, build artifacts, logs, and backups.
  • Avoid exposing tokens through command-line arguments or broadly inherited environments.
  • Redact credentials from application, HTTP, notifier, and error logs.
  • Rotate tokens after suspected exposure and document a revocation procedure.
  • Enforce authentication centrally on every mutating endpoint and deny requests by default.
  • Use constant-time token comparison where appropriate and rate-limit failed authentication attempts.
  • Bind the service to loopback by default; require TLS and a trusted reverse proxy for remote exposure.
  • Add automated tests confirming that every mutating route rejects absent, malformed, and invalid tokens.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
## Runtime commands

- **View board**: `curl http://localhost:4000/api/board`
- **Trigger Telegram alert**: `curl -X POST http://localhost:4000/api/notify-telegram`
- **Quick card**: `curl -X POST http://localhost:4000/api/cards/quick -H "Content-Type: application/json" -d '{"text":"Design review needed"}'`
- **Jarvis summary**: `node scripts/jarvis-connector.js`

Static analysis

No suspicious patterns detected.