ClawHub
Back to skill

Security audit

Upstage Solar Delegation

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly designed to send long responses to Upstage or OpenRouter, but its delegation and persistent policy controls are too broad for shared or sensitive sessions.

Review this skill before installing in any workspace that handles private, regulated, customer, or multi-user chat content. Only enable delegation for sessions whose users understand that prompts may be sent to Upstage or OpenRouter, keep thresholds conservative, restrict who can change persistent policy, and store provider API keys in environment variables or a secrets manager rather than checked-in config files.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

Unrestricted Transmission of Conversation Context to External Model Providers

Content
View full analysis
= threshold, run `sessions_spawn` with Solar Pro3. Example spawn task pattern: ```text Important: Do not use any tools. Output text only. No file read/write or tool calls allowed. ``` Set model to: - `solar-pro3` (Upstage direct — recommended) - `openrouter/upstage/solar-pro-3` (via OpenRouter) ``` ### Technical Analysis The Skill instructs the agent to send unspecified “context” to Solar Pro3 through either Upstage or OpenRouter whenever the session is enabled and the estimated response exceeds the configured threshold. External model delegation is part of the declared functionality, but the instructions do not constrain the transmitted context to the minimum content required for drafting. They also do not require: - Explicit user consent before third-party transmission. - Secret, credential, or personal-data detection. - Redaction or data minimization. - Exclusion of system prompts, unrelated conversation history, tool results, or private metadata. - Special handling for confidential sessions. - Disclosure of which third-party provider will receive the content. The “no tool call” instruction limits the delegated model's capabilities but does not prevent disclosure because the sensitive information has already been transmitted when the delegated task is created. ### Attack Path 1. A user provides confidential content, credentials, personal information, proprietary text, or another sensitive value in the conversation. 2. Delegation is enabled for the current session. 3. The expected output reaches the configured threshold, which defaults to 200 tok ...[truncated 989 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Note
Location
SKILL.md:105
Finding

Persistent Delegation Policy Can Be Changed Without a Defined Authorization Boundary

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill explicitly instructs delegating user-facing content to an external third-party API endpoint, which means user prompts and generated content may be transmitted outside the primary environment. In this context that is the intended feature, but it still creates a real data exposure boundary and could leak sensitive user or session content if delegation occurs without strict gating and consent.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
client = OpenAI(
    api_key=os.environ["UPSTAGE_API_KEY"],
    base_url="https://api.upstage.ai/v1"
)

response = client.chat.completions.create(

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

text
<context + writing instruction>

Important: Do not use any tools. Output text only. No file read/write or tool calls allowed.

Set model to:

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The setup instructions direct operators to configure an external Upstage endpoint for model calls, reinforcing that this skill depends on sending data to a third-party service. Although this is configuration guidance rather than executable code, it still operationalizes external transmission and can lead to unreviewed data sharing if adopted without safeguards.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
1. Confirm user wants setup.
2. Verify `UPSTAGE_API_KEY` environment variable is configured. Get key at [console.upstage.ai](https://console.upstage.ai).
3. Set base_url to `https://api.upstage.ai/v1`, model to `solar-pro3`.
4. Confirm delegation is active and report current threshold.

### Option B: Via OpenRouter

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide instructs users to obtain and place live API keys directly into configuration, including an example value field for the OpenRouter key, but it does not warn against committing secrets to source control, sharing configs, or using secure secret storage. In a setup document, this omission can lead to accidental credential exposure through copied config files, screenshots, logs, or repositories, especially for less experienced users following the example literally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.