ClawHub
Back to skill

Security audit

trackup food analyze

Security checks for vulnerabilities and agentic risk

Overview

This food-analysis skill appears purpose-aligned, but it uploads user food images or search terms to an external service and includes unsafe temporary-file and proxy-bypass guidance that should be reviewed before installation.

Install only if you are comfortable sending food images, base64 image data, food keywords, and nutrition-analysis context to deepeat.ai. Avoid using the documented /tmp workflow as written for sensitive images; prefer a private temporary directory with restrictive permissions and cleanup. Do not unset proxy variables in managed or workplace environments unless that direct connection is explicitly authorized.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:69
Finding

Predictable Temporary Files Expose Image Data and Enable Symlink Attacks

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69-80
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

The documented local-image workflow stores the complete base64-encoded image and JSON request body at fixed locations in the shared /tmp directory.

bash
base64 < /absolute/path/to/image.jpg | tr -d '\n' > /tmp/food_image.b64

Build payload:

bash
printf '{"image_base64":"' > /tmp/food_image.json
cat /tmp/food_image.b64 >> /tmp/food_image.json
printf '"}' >> /tmp/food_image.json

Technical Analysis

The workflow uses predictable filenames without secure file creation, ownership validation, restrictive permissions, or cleanup. Shell redirection follows symbolic links. An attacker with access to the shared temporary directory can therefore create /tmp/food_image.b64 or /tmp/food_image.json as a symbolic link before the workflow runs.

If a targeted link points to a file writable by the invoking user, the redirection can overwrite or corrupt that file using the invoking user's privileges. The files may also be created with permissions derived from the user's current umask; a permissive configuration could make the encoded image readable by other local users. Both temporary files remain on disk after the API call and retain the complete submitted image.

Attack Path

  1. A local attacker predicts the documented filenames.
  2. The attacker creates /tmp/food_image.b64 or /tmp/food_image.json as a symbolic link to a file writable by the user who will invoke the workflow.
  3. The user follows the documented image-analysis procedure.
  4. Shell redirection follows the attacker's symbolic link.
  5. The target file is overwritten or corrupted with base64 or JSON content.
  6. Alternatively, if the files are created normally with permissive permissions, another local user reads the retained image data from /tmp.

Impact As

...[truncated 463 chars]

Remediation
View remediation

Remediation Suggestions

  • Create a private temporary directory or files with mktemp instead of fixed filenames.
  • Set umask 077 before creating files containing image data.
  • Quote all generated paths and verify that temporary files are regular files owned by the invoking user.
  • Register an exit trap that removes temporary data on success, failure, and interruption.
  • Prefer streaming the generated JSON directly to curl so that the encoded image is not persisted.
  • A hardened shell workflow could use:
bash
umask 077
tmpdir="$(mktemp -d)" || exit 1
trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM

image_json="$tmpdir/food_image.json"
{
  printf '{"image_base64":"'
  base64 < /absolute/path/to/image.jpg | tr -d '\n'
  printf '"}'
} > "$image_json"

curl --silent --show-error --location \
  'https://deepeat.ai/step.aispark.api.API/AnalyzeWholeFood' \
  --header 'Content-Type: application/json' \
  --data-binary @"$image_json"

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:89
Finding

Proxy-Disabling Guidance Can Bypass Managed Egress Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89-95
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

The documented proxy workaround removes all conventional HTTP and HTTPS proxy environment variables before invoking curl.

bash
env -u http_proxy -u https_proxy -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY curl ...

Technical Analysis

The workaround assumes that a proxy such as 127.0.0.1:7890 is erroneous and responds by disabling every standard proxy variable. In managed environments, these variables may configure mandatory inspection, authentication, logging, data-loss prevention, or outbound access controls.

Removing the variables can cause the image-analysis request to use a direct network route rather than the administrator-configured proxy. Although the destination uses HTTPS, transport encryption does not preserve organization-level inspection and routing requirements. The instruction does not request user approval, distinguish an accidental local proxy from a mandatory proxy, or verify that direct egress is authorized.

Attack Path

  1. The normal API request fails because the configured proxy is unavailable or rejects the request.
  2. The user or Agent applies the documented workaround.
  3. All recognized proxy environment variables are removed for the curl process.
  4. curl attempts a direct connection to deepeat.ai.
  5. If direct egress is permitted, the image or search request leaves the environment without passing through the configured proxy controls.

Impact Assessment

This issue does not grant additional operating-system privileges. Its scope is network-policy bypass for the affected API request. Potential impact includes loss of required traffic inspection, logging, access control, and data-loss prevention coverage for uploaded food images or search terms. Exploitation depends on direct outbound connectivity being available despite the m ...[truncated 27 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not recommend unsetting every proxy variable as an automatic retry mechanism.
  • Treat proxy failures as configuration or policy errors and ask the user or environment administrator to correct them.
  • Require explicit user approval before attempting any direct connection.
  • Document that mandatory organizational proxy and egress policies must not be bypassed.
  • If a narrowly scoped exception is authorized, configure it for the specific destination through approved tooling rather than removing all proxy controls.
  • Preserve the default proxy configuration and report the original curl error when the request cannot be completed safely.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

md
Returns up to 20 results with macros and GI.

## Output Rules

- Numeric values are kept exactly as returned by the API
- Missing fields are not invented

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
Returns up to 20 results with macros and GI.

## Output Rules

- Numeric values are kept exactly as returned by the API
- Missing fields are not invented

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to send food images and related analysis inputs to external production APIs but does not clearly disclose that local images, potentially containing sensitive metadata or personal context, will leave the local environment. This creates a privacy and consent risk because users may provide local files without understanding they are being transmitted to a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This example performs a POST request to an external service, transmitting user-supplied food keywords to a third-party production API. While expected for the skill's functionality, it is still a real data egress path and becomes risky if users are not informed that their queries are sent off-platform.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Request example:

bash
curl --silent --show-error --location \
  'https://deepeat.ai/step.aispark.api.API/SearchFood' \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

This workflow sends a base64-encoded local image to an external production API, creating a clear exfiltration path for local user content. Food images can contain sensitive contextual information, embedded metadata, or incidental personal details, so transmitting them without prominent disclosure and consent is dangerous.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

Call full food analysis directly:

bash
curl --silent --show-error --location \
  'https://deepeat.ai/step.aispark.api.API/AnalyzeWholeFood' \
  --header 'Content-Type: application/json' \
  --data-binary @/tmp/food_image.json

Static analysis

No suspicious patterns detected.