ClawHub
Back to skill

Security audit

Event Planner

Security checks for vulnerabilities and agentic risk

Overview

This event-planning skill uses Google APIs in a disclosed, purpose-aligned way, but several advertised planning options are not actually implemented.

Install only if you are comfortable sending event locations, venue searches, route details, and your Google API key to Google services, with possible API billing. Treat generated hours, availability, budgets, and routes as suggestions to verify. Do not rely on the advertised trip, preference, date, or duration handling until the skill is fixed or documented more accurately.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/plan_event.py:3
Finding

Unpinned Runtime Dependency Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: scripts/plan_event.py:3-7
Vulnerability Type: Unpinned third-party runtime dependency
Risk Level: Medium

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.31.0",
# ]
# ///

Technical Analysis

The script declares requests>=2.31.0 using an open-ended version constraint. The documented invocation through uv run can resolve and install any future package version satisfying that constraint. No committed lockfile, exact version pin, or package hash is present in the audited project.

Although requests is a legitimate package and no malicious dependency was observed in the audited source, the reviewed code does not uniquely determine which dependency version will execute. A compromised, malicious, or unexpectedly incompatible future release could therefore enter the runtime dependency chain without a corresponding change to this repository.

Attack Path

  1. An attacker compromises the upstream package, its maintainer account, or a relevant distribution channel and publishes a malicious version satisfying >=2.31.0.
  2. A user invokes the documented uv run .../scripts/plan_event.py command in an environment where dependency resolution selects that version.
  3. uv downloads and installs the selected package.
  4. The script imports requests, causing dependency-controlled Python code to execute.
  5. The malicious code operates with the same OS permissions and environment access as the invoking process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user or Agent running the Skill. This may expose environment variables—including GOOGLE_PLACES_API_KEY—and any files, network resources, or process capabilities available to that account. The code does not itself request elevated system privileges, so the direct scope is limited to the invoking process's ...[truncated 22 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the open-ended constraint with an exact, audited version.
  • Commit and enforce a lockfile so installations resolve to reviewed artifacts.
  • Verify dependency artifacts with cryptographic hashes where supported.
  • Use a controlled package index or registry mirror with provenance and integrity checks.
  • Configure automated dependency monitoring, but require review and testing before updating the lockfile.
  • Run the Skill with least privilege and expose only the environment variables and filesystem paths required for event planning.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tainted flow: 'headers' from os.environ.get (line 164, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/plan_event.py (reported line 174)May include surrounding context.

python
for attempt in range(retry_count):
        try:
            response = requests.post(url, json=body, headers=headers, timeout=30)

            if response.status_code == 200:
                return response.json()

Tainted flow: 'params' from os.environ.get (line 336, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/plan_event.py (reported line 343)May include surrounding context.

python
"key": API_KEY,
    }
    try:
        resp = requests.get(DIRECTIONS_URL, params=params, timeout=10)
        if resp.status_code == 200:
            data = resp.json()
            if data.get("status") == "OK":

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The skill materially overstates what it does: it claims to honor preferences, duration, date, and broader trip planning, while the implementation reportedly ignores or downgrades several of those inputs. In a planning skill, this can mislead users into acting on inaccurate itineraries or venue choices, including date/time-sensitive availability assumptions, which is a safety and trust issue even if not a classic code-execution flaw.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises executable behavior that uses environment variables and outbound network access, but it does not declare any explicit tool scope or permission boundaries. That weakens least-privilege controls and makes it harder for a host agent or reviewer to understand that API-key access and external requests are required before invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The invocation guidance is broad enough to trigger on many generic planning requests, which can cause over-invocation of a networked skill that uses an API key and external search. In context this increases the chance of unnecessary data sharing to third-party APIs and accidental use when a simpler local response would suffice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/plan_event.py (reported line 174)May include surrounding context.

python
for attempt in range(retry_count):
        try:
            response = requests.post(url, json=body, headers=headers, timeout=30)

            if response.status_code == 200:
                return response.json()

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest says the skill plans trips, and the CLI even accepts event_type 'trip'. But EVENT_TEMPLATES contains no 'trip' template, so trip requests silently fall back to the 'dinner' template. That means the implemented behavior does not match the advertised trip-planning capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The --duration help explicitly states it is currently unused, and the --date argument claims day-specific checks, but no code consumes either value anywhere in execution. Given the skill advertises detailed itinerary generation, this inline documentation creates a misleading impression of implemented intent that the code does not fulfill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says the skill auto-selects venues based on location, budget, party size, and preferences. However, the only preferences handling is an argparse option, and the value is never incorporated into venue search, filtering, scoring, or itinerary generation. This is a direct mismatch between the claimed behavior and the implemented logic.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.