ClawHub
Back to skill

Security audit

@Ukeyboard/homebox-skill

Security checks for vulnerabilities and agentic risk

Overview

This HomeBox inventory skill is mostly purpose-aligned, but it handles credentials and destructive inventory actions with insecure transport guidance and weak safeguards.

Review before installing. Use only with a trusted HomeBox server, prefer HTTPS with a properly trusted certificate or CA, avoid NODE_TLS_REJECT_UNAUTHORIZED=0, do not pass passwords on the command line, treat printed tokens as secrets, and manually confirm any add, update, or delete operation before allowing the agent to run it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:12
Finding

Global TLS Certificate Verification Bypass

Content
View full analysis
This disables TLS verification globally — use with caution and only in trusted networks. ``` ### Technical Analysis The Skill explicitly recommends setting `NODE_TLS_REJECT_UNAUTHORIZED=0`. This disables server-certificate validation for every TLS request made by the Node.js process. It does not merely trust one known self-signed HomeBox certificate. The executable sends login credentials, bearer tokens, and private inventory records through Node.js `fetch`. With certificate verification disabled, an attacker able to intercept or redirect network traffic can present an arbitrary certificate and impersonate the configured HomeBox server. Although support for self-signed HomeBox installations is consistent with the Skill's functionality, globally disabling TLS verification exceeds the minimum privilege and trust required. Trust should be granted only to the specific private certificate or certificate authority. ### Attack Path 1. A user follows the Skill instructions and runs the client with `NODE_TLS_REJECT_UNAUTHORIZED=0`. 2. The user connects through a compromised LAN, access point, DNS resolver, gateway, or other attacker-controlled network component. 3. The attacker redirects the configured HomeBox hostname or intercepts its traffic. 4. The attacker presents a forged TLS certificate. 5. Node.js accepts the forged certificate because verification is globa ...[truncated 917 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/homebox.js:108
Finding

Sensitive Credentials and Inventory Data Can Be Sent Over Plaintext HTTP or to an Unvalidated Origin

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/homebox.js:408
Finding

Login Passwords Are Accepted Through Process Arguments and Authentication Tokens Are Printed to Standard Output

Content
View full analysis
'); process.exit(1); } const pwIdx = args.indexOf('--password'); const password = pwIdx >= 0 ? args[pwIdx + 1] : (args[1] || ''); const params = new URLSearchParams(); params.set('username', username); params.set('password', password); params.set('stayLoggedIn', 'true'); const res = await fetch(`${BASE_URL}${p('login')}`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: params, }); const data = await res.json(); if (!res.ok) { console.error('Login failed:', data); process.exit(1); } console.log(`Token: ${data.token}`); console.log(`Expires: ${data.expiresAt}`); break; } ``` ### Technical Analysis The implementation accepts a password either through `--password` or as the second positional argument. Command-line arguments can be exposed through: - Shell history. - Process inspection facilities. - Terminal recording and auditing tools. - CI/CD command logs. - Agent execution transcripts. The Skill documentation states that login “will prompt for password,” but the implementation contains no hidden interactive prompt. If a password is omitted, an empty password is submitted. After successful authentication, the complete bearer token is printed to standard output. That output may be retained in terminal scrollback, logs, orchestration output, or Agent transcripts. Because the token is reusable until expiry or revocation, output disclosure can lead directly to account compromise. ### Attack Path 1. A user invokes the login command with a password argument, following the implemented interface. 2. The cleartext password becomes part of the process arg ...[truncated 926 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/homebox.js:319
Finding

Destructive Delete Commands Do Not Enforce Confirmation at the Code Level

Content
View full analysis
'); process.exit(1); } await api('DELETE', p('item', args[0])); console.log('Deleted'); break; } // --- Locations --- case 'locations': { const data = await api('GET', p('locations')); print(data); break; } case 'tree': { const data = await api('GET', p('tree')); print(data); break; } ``` A similar immediate deletion is implemented for labels and tags: ```js case 'label-delete': case 'tag-delete': { if (!args[0]) { console.error(`Usage: homebox.js ${cmd} `); process.exit(1); } await api('DELETE', p('label', args[0])); console.log('Deleted'); break; } ``` ### Technical Analysis The Skill instructions state that deletion must never occur without explicit, unambiguous confirmation. The executable does not enforce this rule. Possession of a valid identifier is sufficient to issue the DELETE request immediately. Relying solely on Agent behavior is weaker than enforcing the safety invariant in the destructive tool itself. A misunderstood request, incorrect identifier, copied command, or instruction-injection event can bypass the documentation-level rule and cause irreversible data loss. ### Attack Path 1. An Agent, script, or user selects the wrong item or tag identifier. 2. The delete command is invoked without a separate confirmation token or prompt. 3. The CLI immediately sends an authenticated HTTP DELETE request. 4. The HomeBox server removes the selected record. 5. If the server lacks soft deletion, backups, or recovery features, the data is permanently lost. An attacker who can influence Agent instructions could similarly induce a delete invocation without needing to bypass any code-level safeguard. ### Impact Assess ...[truncated 464 chars]
Remediation
View remediation
` rather than a generic boolean. 4. Consider requiring a separate `--force` option in addition to exact-identifier confirmation for automation. 5. Fetch and display the current record before deletion to reduce stale-ID and wrong-target errors. 6. Prefer server-side soft deletion, an archive operation, or a recovery window where supported. 7. Apply the same confirmation policy consistently to item, label, tag, location, entity-type, group, attachment, and other destructive endpoints. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The manifest describes inventory lookup and CRUD behavior, but the documentation indicates additional abilities such as login/token retrieval, group or administrative access, entity-type management, and stats access. This mismatch undermines informed consent and review, and can cause the agent to invoke more sensitive operations than the declared purpose suggests.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
node scripts/homebox.js ...

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
node scripts/homebox.js ...

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 50)May include surrounding context.

md
| **Get** | `GET /v1/items/{id}` | `GET /v1/entities/{id}` |
| **Update** | `PUT /v1/items/{id}` | `PUT /v1/entities/{id}` |
| **Patch** | `PATCH /v1/items/{id}` (limited — only `id`, `quantity`) | `PATCH /v1/entities/{id}` (full partial update) |
| **Delete** | `DELETE /v1/items/{id}` | `DELETE /v1/entities/{id}` |
| **Duplicate** | `POST /v1/items/{id}/duplicate` | `POST /v1/entities/{id}/duplicate` |
| **Path** | `GET /v1/items/{id}/path` | `GET /v1/entities/{id}/path` |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 50)May include surrounding context.

md
| **Get** | `GET /v1/items/{id}` | `GET /v1/entities/{id}` |
| **Update** | `PUT /v1/items/{id}` | `PUT /v1/entities/{id}` |
| **Patch** | `PATCH /v1/items/{id}` (limited — only `id`, `quantity`) | `PATCH /v1/entities/{id}` (full partial update) |
| **Delete** | `DELETE /v1/items/{id}` | `DELETE /v1/entities/{id}` |
| **Duplicate** | `POST /v1/items/{id}/duplicate` | `POST /v1/entities/{id}/duplicate` |
| **Path** | `GET /v1/items/{id}/path` | `GET /v1/entities/{id}/path` |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 125)May include surrounding context.

md
| **Get** | `GET /v1/items/{id}` | `GET /v1/entities/{id}` |
| **Update** | `PUT /v1/items/{id}` | `PUT /v1/entities/{id}` |
| **Patch** | `PATCH /v1/items/{id}` (limited — only `id`, `quantity`) | `PATCH /v1/entities/{id}` (full partial update) |
| **Delete** | `DELETE /v1/items/{id}` | `DELETE /v1/entities/{id}` |
| **Duplicate** | `POST /v1/items/{id}/duplicate` | `POST /v1/entities/{id}/duplicate` |
| **Path** | `GET /v1/items/{id}/path` | `GET /v1/entities/{id}/path` |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 125)May include surrounding context.

md
| **Create** | `POST /v1/locations` | Same as creating an entity, but with an entity type where `isLocation: true` |
| **Get** | `GET /v1/locations/{id}` | `GET /v1/entities/{id}` |
| **Update** | `PUT /v1/locations/{id}` | `PUT /v1/entities/{id}` |
| **Delete** | `DELETE /v1/locations/{id}` | `DELETE /v1/entities/{id}` |
| **Tree** | `GET /v1/locations/tree` | `GET /v1/entities/tree` |

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 138)May include surrounding context.

md
| **Create** | `POST /v1/labels` `{name, description, color}` | `POST /v1/tags` `{name, description, color}` |
| **Get** | `GET /v1/labels/{id}` | `GET /v1/tags/{id}` |
| **Update** | `PUT /v1/labels/{id}` | `PUT /v1/tags/{id}` |
| **Delete** | `DELETE /v1/labels/{id}` | `DELETE /v1/tags/{id}` |

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 138)May include surrounding context.

md
| **Create** | `POST /v1/labels` `{name, description, color}` | `POST /v1/tags` `{name, description, color}` |
| **Get** | `GET /v1/labels/{id}` | `GET /v1/tags/{id}` |
| **Update** | `PUT /v1/labels/{id}` | `PUT /v1/tags/{id}` |
| **Delete** | `DELETE /v1/labels/{id}` | `DELETE /v1/tags/{id}` |

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 149)May include surrounding context.

md
| **List** | `GET /v1/entity-types` |
| **Create** | `POST /v1/entity-types` `{name, description, isLocation, icon}` |
| **Update** | `PUT /v1/entity-types/{id}` |
| **Delete** | `DELETE /v1/entity-types/{id}` |

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 170)May include surrounding context.

POST /v1/{entities|items}/{id}/attachments/external ({name, url, mimeType}) GET /v1/{entities|items}/{id}/attachments/{aid} PUT /v1/{entities|items}/{id}/attachments/{aid} DELETE /v1/{entities|items}/{id}/attachments/{aid}

text

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 200)May include surrounding context.

md
| Operation | Endpoint |
|-----------|----------|
| **Get/Update** | `GET/PUT /v1/groups` |
| **Create/Delete** | `POST/DELETE /v1/groups` |
| **List all** | `GET /v1/groups/all` |
| **Invitations** | `GET/POST/DELETE /v1/groups/invitations/{id?}` |
| **Members** | `GET/DELETE /v1/groups/members/{user_id?}` |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 202)May include surrounding context.

md
| **Get/Update** | `GET/PUT /v1/groups` |
| **Create/Delete** | `POST/DELETE /v1/groups` |
| **List all** | `GET /v1/groups/all` |
| **Invitations** | `GET/POST/DELETE /v1/groups/invitations/{id?}` |
| **Members** | `GET/DELETE /v1/groups/members/{user_id?}` |

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 203)May include surrounding context.

md
| **Create/Delete** | `POST/DELETE /v1/groups` |
| **List all** | `GET /v1/groups/all` |
| **Invitations** | `GET/POST/DELETE /v1/groups/invitations/{id?}` |
| **Members** | `GET/DELETE /v1/groups/members/{user_id?}` |

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 214)May include surrounding context.

md
| **List** | `GET /v1/group/exports` |
| **Start** | `POST /v1/group/exports` |
| **Get** | `GET /v1/group/exports/{id}` |
| **Delete** | `DELETE /v1/group/exports/{id}` |
| **Download** | `GET /v1/group/exports/{id}/download` |

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 230)May include surrounding context.

md
| **Barcode** | `GET /v1/products/search-from-barcode?barcode=` | Same |
| **QR code** | `GET /v1/qrcode?content=` | Same |
| **BOM report** | `GET /v1/reporting/bill-of-materials` | Same |
| **Notifiers** | `GET/POST/PUT/DELETE /v1/notifiers/{id?}` | Same |
| **Currency** | `GET /v1/currency` | Same |
| **Status** | `GET /v1/status` | Same |

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Notifier management includes creation and update of arbitrary URLs plus a test endpoint that sends requests to a user-supplied URL. In an agent context, this can enable SSRF, internal network probing, data exfiltration to attacker-controlled endpoints, or misuse of the HomeBox server as an outbound request primitive, and these capabilities are not justified by the skill’s inventory-assistant purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Registration, login, logout, token refresh, and password-change endpoints are highly sensitive authentication surfaces that are inappropriate for a general home inventory assistant. Allowing an agent to interact with these endpoints can cause credential harvesting exposure, account takeover workflows, session abuse, or unintended account creation/deletion, especially because agents may be induced to handle secrets through prompts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill exposes capabilities that require environment access and network access, but it does not declare an explicit tool scope or allowed-tools boundary. That weakens least-privilege controls and can let the skill operate with broader runtime powers than a reviewer or orchestrator would expect, increasing the blast radius if the skill is misused or the backing script has unsafe behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The invocation description is broad enough to trigger on common queries like 'where are my keys?' even when the user did not intend to access HomeBox. In this context, the skill supports writes, deletes, login, and token-driven network actions, so overbroad triggering can lead to unintended data access or state changes in a private home inventory system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs users to set NODE_TLS_REJECT_UNAUTHORIZED=0, which disables TLS certificate validation for Node.js requests. That exposes authentication tokens, credentials, and inventory data to man-in-the-middle interception or silent endpoint spoofing, especially because the skill performs login and bearer-token-based API access.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
99% confidence
Finding

Using NODE_TLS_REJECT_UNAUTHORIZED=0 as a documented default disables server certificate verification and makes HTTPS connections insecure. Because this skill carries bearer tokens and may prompt for credentials, an attacker on the network could intercept secrets or tamper with API responses.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Self-Signed TLS Certificate

If your HomeBox instance uses a self-signed cert (like a Docker .nas.io domain), set NODE_TLS_REJECT_UNAUTHORIZED=0 in the environment before running any commands. The script relies on Node.js fetch which respects this env var.

bash
# PowerShell

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
99% confidence
Finding

The PowerShell example explicitly sets a global process environment variable that disables TLS validation for subsequent Node.js requests. This lowers transport security for the entire session and can expose credentials and API tokens during login or routine inventory operations.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash
# PowerShell
$env:NODE_TLS_REJECT_UNAUTHORIZED = 0
node scripts/homebox.js ...

# Bash

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
99% confidence
Finding

The Bash example demonstrates running the CLI with TLS verification disabled, which normalizes insecure transport as an operational pattern. In a self-hosted environment, users may assume local networks are safe, but this still permits interception, spoofing, and credential theft by any network-positioned attacker.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

node scripts/homebox.js ...

Bash

NODE_TLS_REJECT_UNAUTHORIZED=0 node scripts/homebox.js ...

text

> This disables TLS verification globally — use with caution and only in trusted networks.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
99% confidence
Finding

Repeating the advice to disable TLS verification in the operational notes reinforces an unsafe default and increases the likelihood that operators will adopt it permanently. The danger is amplified here because the same section also instructs the agent to drive login and proceed with token acquisition, putting secrets at risk over an unauthenticated channel.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
- **Always fetch fresh IDs.** HomeBox UUIDs (labels, locations, items) may change if the database is reset between sessions. Never rely on IDs cached earlier in the conversation.
- **PUT 500 with `labelIds`?** Most likely a stale label UUID. Re-fetch labels and retry.
- **Self-signed TLS cert?** Set `NODE_TLS_REJECT_UNAUTHORIZED=0` (see above).
- **Missing token?** Drive the setup yourself: when env vars are missing, ask once for URL + credentials, run `login`, and proceed — no commentary, no "shall I save?", and advise setting `HOMEBOX_TOKEN`.  Note that `login` returns a token with "Bearer " prefix — strip it before setting `HOMEBOX_TOKEN` since the script prepends its own "Bearer ".

### Search & Query

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/homebox.js:2