ClawHub
Back to skill

Security audit

Agentcy — Your Claw's Marketing Analyst

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Agentcy marketing-intelligence integration that sends user-directed queries to Agentcy's API, with a notable but non-malicious unpinned install command.

Install only if you trust Agentcy with the client marketing questions, domain context, and connected-source access represented by your API key. Prefer a pinned installer version when available, use a least-privileged Agentcy key, and avoid putting secrets, PII, or confidential strategy into freeform queries unless that data is approved for Agentcy processing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Mutable npm Package Is Downloaded and Executed During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 26
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash
npx clawhub@latest install agentcy

Technical Analysis

The documented installation command directs npx to resolve and execute the package currently referenced by the mutable latest distribution tag. The command does not pin a reviewed package version or require verification against a trusted integrity hash or lockfile.

Consequently, the code executed during installation can differ from the code that was available when this skill was audited. If the npm publisher account, package, registry delivery chain, or a relevant dependency is compromised, an attacker could supply malicious installer code through a new release associated with latest.

This is a supply-chain weakness in the documented installation path. The reviewed local shell scripts do not themselves retrieve or execute code.

Attack Path

  1. An attacker compromises the clawhub npm publisher account, package publication process, registry delivery chain, or a dependency incorporated into a new release.
  2. The attacker publishes a malicious package version and causes the mutable latest tag to resolve to it.
  3. A user follows the installation command in SKILL.md.
  4. npx downloads and executes the attacker-controlled package in the user's environment.
  5. The malicious installer performs actions with the permissions and environmental access of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing user. Depending on that user's permissions and environment, the malicious package could read accessible files and environment variables, alter project or user-level files, install additional payloads, or access credentials available to the installation process.

The precise scope is limited by the permissions, sandboxing, and secrets available ...[truncated 160 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Use a lockfile or another reproducible installation mechanism that records dependency versions and package integrity metadata.
  • Verify the package against a trusted registry integrity hash or independently published checksum before execution.
  • Review the selected package version and its dependency tree before recommending it.
  • Use npm provenance and signature verification where supported, and document the expected publisher identity.
  • Install and execute the package in a least-privileged, isolated environment without unrelated credentials.
  • Establish a controlled update process in which newer versions are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description frames the skill as a marketing analyst for client marketing data, specifically covering analytics and commerce platforms such as GA4, Google Ads, Search Console, and WooCommerce. The supplied code does not access any of those systems, authenticate to them, or process marketing account data. Instead, it accepts a question and optional domain, calls an Agentcy /api/research endpoint, and returns synthesized content, which aligns with generic web research or competitive intelligence. This is a materially different primary purpose and resource access pattern from the declared marketing analytics capability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill exposes shell-based capabilities via bundled .sh scripts but does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens reviewability and enforcement, because consumers cannot easily tell what execution surface the skill requires and a host may grant broader capabilities than necessary.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

Using npx clawhub@latest install agentcy pulls an unpinned package version at install time, creating a supply-chain risk. If the upstream package is compromised or changed incompatibly, users may execute attacker-controlled code during installation without noticing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This command sends marketing questions, domain identifiers, and an API bearer token to an external service at data.goagentcy.com. Even if expected, it is still a real data egress point that can expose sensitive client business intelligence and account metadata to a third party if misused or over-relied upon.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
| Endpoint | Method | Purpose | Auth |
|----------|--------|---------|------|
| `https://data.goagentcy.com/api/query` | POST | Query marketing data sources | Bearer token (AGENTCY_API_KEY) |
| `https://data.goagentcy.com/api/research` | POST | Web research and competitive intelligence | Bearer token (AGENTCY_API_KEY) |
| `https://data.goagentcy.com/api/sources` | GET | List configured domains and data sources | Bearer token (AGENTCY_API_KEY) |

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The research endpoint accepts freeform questions for competitive intelligence, which increases the chance that operators send confidential strategy, customer, or campaign details to a third-party service. Because the input is unconstrained natural language, sensitive internal context may be included inadvertently and transmitted externally.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
| Endpoint | Method | Purpose | Auth |
|----------|--------|---------|------|
| `https://data.goagentcy.com/api/query` | POST | Query marketing data sources | Bearer token (AGENTCY_API_KEY) |
| `https://data.goagentcy.com/api/research` | POST | Web research and competitive intelligence | Bearer token (AGENTCY_API_KEY) |
| `https://data.goagentcy.com/api/sources` | GET | List configured domains and data sources | Bearer token (AGENTCY_API_KEY) |

## Security & Privacy

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The sources endpoint transmits the API token to retrieve configured domains and connected services from an external platform, exposing account inventory metadata to a remote service by design. The sensitivity is lower than query/research content, but disclosure of tenant structure and connected integrations can still aid profiling if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md
|----------|--------|---------|------|
| `https://data.goagentcy.com/api/query` | POST | Query marketing data sources | Bearer token (AGENTCY_API_KEY) |
| `https://data.goagentcy.com/api/research` | POST | Web research and competitive intelligence | Bearer token (AGENTCY_API_KEY) |
| `https://data.goagentcy.com/api/sources` | GET | List configured domains and data sources | Bearer token (AGENTCY_API_KEY) |

## Security & Privacy

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This URL usage corresponds to the actual curl POST request that transmits payload data and an API token to an external service. In the context of a marketing-analysis skill, outbound transmission is expected, but it is still security-relevant because client-specific business data is being shared with a remote processor and could expose sensitive operational information if used without proper consent, validation, and governance.

Content

Scanner excerpt · agentcy_query.sh (reported line 52)May include surrounding context.

sh
fi

# --- Call Agentcy REST API ---
HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "https://data.goagentcy.com/api/query" \
  -H "Authorization: Bearer ${AGENTCY_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD")

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This URL usage corresponds to the actual curl POST request that transmits payload data and an API token to an external service. In the context of a marketing-analysis skill, outbound transmission is expected, but it is still security-relevant because client-specific business data is being shared with a remote processor and could expose sensitive operational information if used without proper consent, validation, and governance.

Content

Scanner excerpt · agentcy_query.sh (reported line 52)May include surrounding context.

sh
fi

# --- Call Agentcy REST API ---
HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "https://data.goagentcy.com/api/query" \
  -H "Authorization: Bearer ${AGENTCY_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD")

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hardcoded remote endpoint in the curl call confirms that this skill sends data to an external service outside the local trust boundary. In the context of a marketing research skill, this behavior is expected, but it becomes risky if agents pass confidential business data, customer data, or internal strategy questions to the service without controls.

Content

Scanner excerpt · agentcy_research.sh (reported line 42)May include surrounding context.

sh
fi

# --- Call Agentcy REST API ---
HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "https://data.goagentcy.com/api/research" \
  -H "Authorization: Bearer ${AGENTCY_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD")

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hardcoded remote endpoint in the curl call confirms that this skill sends data to an external service outside the local trust boundary. In the context of a marketing research skill, this behavior is expected, but it becomes risky if agents pass confidential business data, customer data, or internal strategy questions to the service without controls.

Content

Scanner excerpt · agentcy_research.sh (reported line 42)May include surrounding context.

sh
fi

# --- Call Agentcy REST API ---
HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "https://data.goagentcy.com/api/research" \
  -H "Authorization: Bearer ${AGENTCY_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agentcy_query.sh (reported line 9)May include surrounding context.

sh
# Usage: ./agentcy_sources.sh ["domain"]
#
# Environment: AGENTCY_API_KEY (required)
# External:    https://data.goagentcy.com/api/sources

set -euo pipefail

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agentcy_research.sh (reported line 9)May include surrounding context.

sh
# Usage: ./agentcy_sources.sh ["domain"]
#
# Environment: AGENTCY_API_KEY (required)
# External:    https://data.goagentcy.com/api/sources

set -euo pipefail

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agentcy_sources.sh (reported line 8)May include surrounding context.

sh
# Usage: ./agentcy_sources.sh ["domain"]
#
# Environment: AGENTCY_API_KEY (required)
# External:    https://data.goagentcy.com/api/sources

set -euo pipefail

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agentcy_sources.sh (reported line 24)May include surrounding context.

sh
# Usage: ./agentcy_sources.sh ["domain"]
#
# Environment: AGENTCY_API_KEY (required)
# External:    https://data.goagentcy.com/api/sources

set -euo pipefail

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agentcy_sources.sh (reported line 26)May include surrounding context.

sh
# Usage: ./agentcy_sources.sh ["domain"]
#
# Environment: AGENTCY_API_KEY (required)
# External:    https://data.goagentcy.com/api/sources

set -euo pipefail

Static analysis

No suspicious patterns detected.