ClawHub
Back to skill

Security audit

bluesky-research

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed Bluesky research helper, but its executable helper is broader than the stated Bluesky-only purpose and can send arbitrary requests to Crawlora.

Review this skill before installing if you expected a strictly Bluesky-only helper. It requires a Crawlora API key and sends request data to Crawlora; the bundled script should be constrained to documented /bluesky endpoints if you do not want agents using the same key for unrelated Crawlora services.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The helper advertises and accepts generic Crawlora endpoints such as Amazon, YouTube, Google search, and Google Trends, which materially exceeds the stated Bluesky-only scope of the skill. In an agent setting, this scope mismatch can be abused to exfiltrate arbitrary user-supplied research queries or enable unintended third-party data collection through a broader API surface than users expect.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code forwards an arbitrary path plus arbitrary query/body data to the Crawlora API, effectively turning a Bluesky skill into a generic third-party research proxy. That broader capability is unjustified by the skill purpose and increases the risk of policy bypass, unexpected data disclosure, and misuse of the API key for unrelated collection tasks.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The executing code path sends request contents directly to an external service, including POST bodies, without any runtime user-facing notice or consent gate. In an agent workflow, users may believe analysis is local or Bluesky-limited, while sensitive prompts, identifiers, or research terms are transmitted to Crawlora instead.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
94% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

External Transmission

Medium
Category
Data Exfiltration
Content
set -euo pipefail

: "${CRAWLORA_API_KEY:?Set CRAWLORA_API_KEY first — get a free key at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills}"
base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}"

method="GET"
body=""
Confidence
88% confidence
Finding
https://api.crawlora.net/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:24