ClawHub
Back to skill

Security audit

PullThatUpJamie

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent podcast research API skill, but its optional paid wallet workflow documents unpinned local package execution with a sensitive wallet credential.

Use the free tier or a normal wallet first. If using paid access, treat L402 and NWC values as bearer credentials, use a low-balance wallet with strict limits, avoid the unpinned `npx` command unless you have independently verified and pinned the package, and do not upload sensitive/private research material into sessions or public share links.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:107
Finding

Unpinned Third-Party Package Execution with a Sensitive Wallet Credential

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 26)May include surrounding context.

md
description: "Jamie API — podcast search, research sessions, corpus browsing, RSS feed ingestion, clip generation (all endpoints proxied for security)"
    externalTools:
      - name: "Lightning wallet (any)"
        description: "For paid tier only: Any Lightning wallet (Zeus, BlueWallet, Phoenix, Alby extension, etc.) to pay BOLT-11 invoices. NO CLI tools are required or auto-executed by this skill."
        required: false
---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
description: "Jamie API — podcast search, research sessions, corpus browsing, RSS feed ingestion, clip generation (all endpoints proxied for security)"
    externalTools:
      - name: "Lightning wallet (any)"
        description: "For paid tier only: Any Lightning wallet (Zeus, BlueWallet, Phoenix, Alby extension, etc.) to pay BOLT-11 invoices. NO CLI tools are required or auto-executed by this skill."
        required: false
---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
description: "Jamie API — podcast search, research sessions, corpus browsing, RSS feed ingestion, clip generation (all endpoints proxied for security)"
    externalTools:
      - name: "Lightning wallet (any)"
        description: "For paid tier only: Any Lightning wallet (Zeus, BlueWallet, Phoenix, Alby extension, etc.) to pay BOLT-11 invoices. NO CLI tools are required or auto-executed by this skill."
        required: false
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

1. Hit any protected endpoint

bash
curl -s -D- -X POST -H "Content-Type: application/json" \
  -d '{"query": "bitcoin energy consumption"}' \
  "https://www.pullthatupjamie.ai/api/search-quotes"

Rp1

Medium
Category
MCP Rug Pull
Confidence
78% confidence
Finding

The skill documentation recommends running npx @getalby/cli without pinning a specific version. This creates a supply-chain risk because a future compromised or malicious package version could be fetched and executed at runtime on the operator's machine. The risk is somewhat reduced because the command is presented as optional manual usage rather than auto-executed by the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/create.md (reported line 53)May include surrounding context.

Step 1 — Hit the endpoint (or purchase credits for a custom amount)

bash
curl -X POST https://www.pullthatupjamie.ai/api/make-clip \
  -H "Content-Type: application/json" \
  -d '{"clipId": "1015378_guid_p123"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/podcast-rra.md (reported line 60)May include surrounding context.

Usage

bash
curl -s -X POST \
  -H "Authorization: L402 MACAROON:PREIMAGE" \
  -H "Content-Type: application/json" \
  -d '{"query": "that time Jim talked about the AI monolith", "smartMode": true, "limit": 10}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/podcast-rra.md (reported line 152)May include surrounding context.

bash
# Step 1: Find the feed
curl -s "API_BASE/api/corpus/feeds?search=News+and+Guidance"
# Returns: feedId (e.g., 7648986)

# Step 2: Search episode titles within that feed

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

The session-creation workflow instructs clients to upload full clip metadata, including transcript text, audio URLs, listen links, dates, images, and a client identifier derived from a payment hash, to an external service. In context this is expected product behavior, but it still creates a real data-transfer risk because user-curated research content and identifiers are sent off-platform and could expose sensitive or proprietary material if agents include private data or misuse credentials.

Content

Scanner excerpt · references/podcast-rra.md (reported line 283)May include surrounding context.

Create a Session

bash
curl -s -X POST \
  -H "Authorization: L402 MACAROON:PREIMAGE" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.