ClawHub
Back to skill

Security audit

Sky - Email for AI Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to document a real email API for agents, but some examples can leak the API key and encourage unsafe automated processing of inbound messages.

Review this skill before installing or copying its examples. Use the API only for email workflows you intend to connect to Sky, do not print or log the API key, store the key in a secret manager or protected environment, and treat all inbound messages as untrusted data before passing them to scripts or agents. Avoid the cron pipeline as written unless the processing script safely parses JSON, validates fields, and cannot execute message content as commands or instructions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:402
Finding

Live API Key Exposed Through Terminal and Log Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 402-405
Vulnerability Type: Credential exposure through insecure logging
Risk Level: Medium

Vulnerable Code

bash
export SKY_API_KEY=$(echo $RESPONSE | jq -r '.api_key')
export SKY_EMAIL=$(echo $RESPONSE | jq -r '.email')
echo "API Key: $SKY_API_KEY"
echo "Email: $SKY_EMAIL"

Technical Analysis

The documented setup script extracts a live bearer API key from the signup response and then prints it to standard output. Although storing the key in an environment variable is consistent with earlier guidance, explicitly displaying it creates additional copies of the credential in terminal scrollback, CI/CD logs, shell-session recordings, remote execution logs, and monitoring platforms.

The API key authenticates requests to Sky messaging endpoints. Consequently, it must be treated as a secret and should not be included in routine output. The exposure is particularly significant because the documentation states that signup keys use the production-oriented sky_live_ prefix.

Attack Path

  1. A user copies and executes the documented setup script.
  2. The signup endpoint returns a live API key.
  3. The script writes that key to standard output.
  4. A terminal recorder, CI system, centralized logging service, shared console, or unauthorized observer captures the output.
  5. An attacker extracts the bearer key from the captured output.
  6. The attacker supplies it in an Authorization: Bearer header to impersonate the affected agent and access API operations permitted to that key.

Impact Assessment

Successful exploitation grants access within the scope of the compromised agent API key. Based on the documented API, an attacker may be able to send messages under the agent's identity and retrieve messages accessible to that account. This can result in agent impersonation, disclosure of email contents, abuse of the sending quota, and reputational harm.

The issue does not directly gra ...[truncated 144 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the statement that prints SKY_API_KEY.
  • Write the key directly to an approved secret manager or permission-restricted configuration without passing it through logs.
  • Disable shell tracing with set +x around secret-handling operations where applicable.
  • Configure CI/CD systems to mask values matching the API-key format, while treating masking only as defense in depth.
  • Restrict access to build logs, terminal recordings, and execution output.
  • Avoid placing the key in command-line arguments, which may be visible through process inspection.
  • Provide a redacted confirmation message, such as API key stored successfully, instead of displaying the secret.
  • Rotate any API key that has already appeared in logs and remove retained copies where feasible.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:294
Finding

Malformed Webhook Signature Can Trigger an Unhandled Exception

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 294-302
Vulnerability Type: Improper input validation in webhook signature verification
Risk Level: Low

Vulnerable Code

javascript
const expected = 'sha256=' + crypto
  .createHmac('sha256', secret)
  .update(JSON.stringify(payload))
  .digest('hex');
return crypto.timingSafeEqual(
  Buffer.from(signature),
  Buffer.from(expected)
);

Technical Analysis

Node.js crypto.timingSafeEqual requires both input buffers to have the same byte length. If an attacker supplies a missing, truncated, oversized, or otherwise malformed signature, Buffer.from(signature) may either fail for an invalid type or produce a buffer whose length differs from the expected signature. timingSafeEqual then throws rather than returning false.

The example does not validate the signature's type, prefix, encoding, or length and does not catch comparison errors. An implementation copied directly into a webhook handler may therefore convert an ordinary authentication failure into an exception.

The code also computes the HMAC over JSON.stringify(payload). Secure webhook verification generally needs to use the exact raw request bytes specified by the provider. Parsing and re-serializing JSON can change whitespace, key ordering, or representation, causing valid signatures to fail even when the request was not modified.

Attack Path

  1. An attacker identifies the public webhook endpoint configured for the Sky agent.
  2. The attacker sends a request with a signature whose byte length differs from the expected sha256=-prefixed hexadecimal digest, or supplies an invalid signature type.
  3. The webhook handler passes the attacker-controlled value to Buffer.from and crypto.timingSafeEqual.
  4. Signature processing throws an exception instead of returning an authentication failure.
  5. If the surrounding application lacks robust exception handling, repeated malformed requests cause request failures, er ...[truncated 734 chars]
Remediation
View remediation

Remediation Suggestions

  • Reject missing or non-string signature values before creating buffers.
  • Validate the exact required prefix, encoding, and digest length.
  • Compare equal-length digest buffers rather than unvalidated full strings.
  • Wrap signature parsing and comparison in exception handling and return HTTP 401 for every validation failure.
  • Compute the HMAC over the raw HTTP request body bytes, according to the provider's signing specification, rather than JSON.stringify of a parsed object.
  • Apply webhook request-size limits, rate limiting, and bounded error logging.
  • Use a maintained verification helper supplied by the service provider if one is available.
  • Add tests for missing, truncated, oversized, non-string, incorrectly encoded, and otherwise malformed signatures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

One API call to get your email address and API key:

bash
curl -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myagent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

One API call to get your email address and API key:

bash
curl -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myagent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

One API call to get your email address and API key:

bash
curl -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myagent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

One API call to get your email address and API key:

bash
curl -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myagent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.

One API call to get your email address and API key:

bash
curl -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myagent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 435)May include surrounding context.

One API call to get your email address and API key:

bash
curl -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myagent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

One API call to get your email address and API key:

bash
curl -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "myagent",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

2. Send Your First Email

bash
curl -X POST https://api.sky.ai/v1/messages/send \
  -H "Authorization: Bearer $SKY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The cron example pipes untrusted remote message content directly into process_emails.sh without any validation, isolation, or framing. This creates a realistic risk that downstream shell-based processing could mis-handle attacker-controlled input, leading to command injection, unsafe parsing, or prompt-injection-driven automation abuse.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

bash
# Example: Check every 5 minutes
*/5 * * * * curl -s https://api.sky.ai/v1/messages?direction=inbound&limit=5 -H "Authorization: Bearer $SKY_API_KEY" | process_emails.sh

For AI agents (OpenClaw, Cron-based systems):

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.

md
#!/bin/bash

# 1. Sign up and get your @claw.inc email (do this once)
RESPONSE=$(curl -s -X POST https://api.sky.ai/v1/signup \
  -H "Content-Type: application/json" \
  -d '{
    "username": "assistant",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example script prints a live API key to stdout, which can leak credentials into shell history, CI logs, terminal recordings, process supervisors, or shared observability systems. Anyone obtaining that key could send or read messages as the agent, depending on API scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 435)May include surrounding context.

md
echo "Email: $SKY_EMAIL"

# 2. Send a test email
curl -X POST https://api.sky.ai/v1/messages/send \
  -H "Authorization: Bearer $SKY_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The documentation states that messages with security tier blocked are 'not delivered to webhook' at L314, yet this same webhook-format section presents a generic inbound payload schema that includes security.tier values including blocked at L303-L309. This is an intent/documentation contradiction about whether blocked messages can appear in webhook-delivered payloads.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:57