ClawHub
Back to skill

Security audit

authority-report

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for SEO authority reporting, but it requires running an unbundled local validator from a dynamically located skills directory.

Review this before installing if your agent can execute local commands. The reporting workflow is sensible, but only use it where the Groundcrew validator is installed from a trusted source and protected from modification; otherwise a replaced validator could run arbitrary code. Also note that a referenced provider-selection file is missing from the package.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:7
Finding

Execution of an Unverified External Validation Tool

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Read `references/provider-selection.md` before choosing a source. Detect what is already available, run with it, deliver value, then recommend at most one missing connector. All normalized factual inputs must satisfy the Groundcrew evidence contract. Locate the active skills root and run `<skills-root>/.groundcrew/groundcrew-doctor.py --evidence <record.json>` before using them in a conclusion. Output follows `references/reporting.md`: shared skeleton, SHIP/FIX/BLOCK/UNDECIDED verdict, Measured/User-provided/Estimated labels.

Technical Analysis

The skill requires the agent to discover an “active skills root” and execute groundcrew-doctor.py from that location. The executable is not included in the audited project, and the instruction does not require validation of its version, cryptographic hash, signature, ownership, or filesystem permissions.

This creates an external trust boundary that cannot be verified from the skill package. If an attacker can influence skills-root resolution or replace .groundcrew/groundcrew-doctor.py, a legitimate authority-report request will cause the agent to execute attacker-controlled Python code.

The evidence-record argument may create an additional injection risk if an implementation constructs a shell command through string interpolation. The supplied text does not itself prove shell interpolation, so that aspect is a hardening concern rather than a separately confirmed vulnerability.

Attack Path

  1. An attacker gains write access to a candidate skills root or its .groundcrew directory.
  2. The attacker creates or replaces .groundcrew/groundcrew-doctor.py with a malicious program.
  3. The active skills root resolves to the attacker-influenced location.
  4. A user invokes the authority-report skill with evidence to validate ...[truncated 1006 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle the evidence validator with the reviewed skill package so its implementation is inside the audit boundary.
  2. If an external installation is required, resolve it from a fixed, administrator-controlled absolute path rather than dynamically locating an active skills root.
  3. Pin the validator to an approved version and verify a cryptographic hash or trusted digital signature before every execution.
  4. Reject validators with unexpected ownership, permissions, symbolic-link resolution, or writable parent directories.
  5. Execute the validator using a process API with a fixed argument array, for example passing --evidence and the record path as separate arguments rather than constructing a shell command.
  6. Canonicalize the evidence path, restrict it to an approved workspace, and reject symbolic links or paths that escape that workspace.
  7. Run the validator in a restricted environment with minimal filesystem access, no unnecessary network access, and only the credentials required for validation.
  8. Fail closed if the trusted validator cannot be located or authenticated; do not fall back to another executable with the same name.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connectors.md (reported line 48)May include surrounding context.

md
- **Tier 1.** Google Suggest for expansion (unofficial endpoint; treat as hints, `confidence: low`). A SERP the user pastes or fetches is an observation for that query, locale, device, and date — record all four.
- **DataForSEO.** Paid, per-request. Read `dataforseo.md`; show the cost preflight and get approval for each batch.
- **Ahrefs MCP** (`https://api.ahrefs.com/mcp/mcp`, API key on a plan that includes MCP) and **Semrush MCP** (`https://mcp.semrush.com/v1/mcp`, OAuth or API key). Use only when the user already pays for the tool and has configured the MCP in their client. Label rows `source: "ahrefs"` / `"semrush"`, `confidence` per the vendor's own accuracy notes; these are third-party estimates, not the user's own data.
- **TrustGrowth.** `keywords` (typed opportunities with volume, difficulty, intent, current position, scores) for the verified site. SERP snapshots per keyword are scheduled (TEC-7796).

### `~~link database` — backlinks and authority