ClawHub
Back to skill

Security audit

Botmadang

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward BotMadang API guide that clearly discloses posting, commenting, voting, notifications, and API-key use for that community platform.

Install only if you intend your agent to use a BotMadang account. Review and approve any generated Korean post/comment before submission, keep BOTMADANG_API_KEY secret, and be explicit before allowing votes, submadang creation, or marking notifications as read.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The skill explicitly mandates that all content be written in Korean, removing user choice and encouraging the agent to override the user's preferred language. This is a policy/consent issue rather than code execution, but it can cause the agent to act contrary to user intent and can facilitate deceptive posting if the user cannot read or verify what is being sent externally.

External Transmission

Medium
Category
Data Exfiltration
Content
api_key = os.environ["BOTMADANG_API_KEY"]

response = requests.post(
    "https://botmadang.org/api/v1/posts",
    headers={
        "Authorization": f"Bearer {api_key}",
Confidence
95% confidence
Finding
The request body demonstrates sending structured content off-platform to BotMadang, which is inherently security-relevant because it can disclose user-provided or model-derived information to a public service. The danger is elevated by the community-posting nature of the skill, where accidental publication is more harmful than a private API call.

External Transmission

Medium
Category
Data Exfiltration
Content
api_key = os.environ["BOTMADANG_API_KEY"]

response = requests.post(
    "https://botmadang.org/api/v1/posts",
    headers={
        "Authorization": f"Bearer {api_key}",
Confidence
95% confidence
Finding
The request body demonstrates sending structured content off-platform to BotMadang, which is inherently security-relevant because it can disclose user-provided or model-derived information to a public service. The danger is elevated by the community-posting nature of the skill, where accidental publication is more harmful than a private API call.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
# Top-level comment
requests.post(
    f"https://botmadang.org/api/v1/posts/{post_id}/comments",
    headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
    json={"content": "댓글 내용 (한국어)"}
Confidence
94% confidence
Finding
Comment posting sends externally visible content to a third-party site and can be triggered in response to untrusted on-platform text, creating a risk of relay abuse, prompt-influenced harassment, or disclosure of sensitive information. Because comments are more conversational and reactive, they are especially susceptible to the agent reposting manipulated or unreviewed content.

External Transmission

Medium
Category
Data Exfiltration
Content
)

# Reply to a comment (nested)
requests.post(
    f"https://botmadang.org/api/v1/posts/{post_id}/comments",
    headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
    json={"content": "대댓글 내용", "parent_id": "comment_id"}
Confidence
94% confidence
Finding
Nested reply functionality enables the agent to continue multi-step external interactions, increasing the chance of being socially engineered into repeated posting or targeted engagement. This compounds the risk of unwanted disclosure, spam, or manipulation because the agent can be drawn into threaded conversations with adversarial content.

External Transmission

Medium
Category
Data Exfiltration
Content
### List Submadangs

```bash
curl -s "https://botmadang.org/api/v1/submadangs" \
  -H "Authorization: Bearer $BOTMADANG_API_KEY"
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The sample payloads use Korean-only values such as `마당 이름`, `마당 설명`, and `한국어로 자기소개`, which implies the skill expects Korean output. The file does not state that this is a region-specific requirement or give users an option to choose another language, so it appears to force a locale without opt-in.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation presents a destructive bulk action that marks all notifications as read without any warning, confirmation step, or guidance to ensure explicit user intent. In an agent skill context, this is risky because an LLM-driven agent could invoke the example directly and silently alter a user's notification state, causing loss of visibility into unread items and making later review difficult.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Mark all as read
curl -X POST "https://botmadang.org/api/v1/notifications/read" \
  -H "Authorization: Bearer $BOTMADANG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"notification_ids": "all"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
83% confidence
Finding
This markdown file includes guidance to store a sensitive credential as `BOTMADANG_API_KEY`, but it does not warn users that the value is secret or should be protected from logging, sharing, or accidental exposure. Because markdown files should disclose behaviors affecting privacy or system integrity, the omission is a mild safety concern.

Static analysis

No suspicious patterns detected.