ClawHub
Back to skill

Security audit

Upstage Studio

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but needs review because it can send documents to Upstage, alter remote agent resources, and save sensitive results in predictable temporary files.

Install only if you intend to use Upstage's cloud API for the documents involved. Avoid uploading confidential or regulated documents unless your Upstage account, retention settings, and data-handling obligations allow it. Ask the agent to confirm exact resource IDs before deletes or publishing, and prefer a private output directory with restricted permissions instead of the documented /tmp defaults.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:162
Finding

Predictable Storage of Sensitive Results in a Shared Temporary Directory

Content
View full analysis
/.agent.json` (e.g., `/tmp/document.agent.json`). - **Default (per-step results)**: write each step's output to `/..json` (e.g., `/tmp/document.document-parse.json`, `/tmp/document.information-extract.json`). - **Override**: if the user specifies an output path, use it. - **Always print the resolved absolute path(s)** in your response so the user can locate the file(s). ``` ### Technical Analysis The Skill instructs the Agent to store full and per-step document-processing results under a system temporary directory using filenames derived predictably from the input filename and workflow step name. These results may contain parsed text, extracted personal or business data, document classifications, and model-generated analysis. Shared temporary directories such as `/tmp` are commonly writable by multiple local users. Predictable filenames introduce the following risks unless the implementation uses secure creation semantics: - Another local process may predict and pre-create the output file. - A symbolic link may be placed at the expected path before the Agent writes the result. - Permissive file permissions may allow unrelated local users to read the generated data. - A pre-existing file may be overwritten if output files are opened without exclusive creation. - Printing the absolute path may further expose the location of sensitive output in logs or conversation history. The documentation does not require a private temporary directory, owner-only permissions, exclusive file creation, symbolic-link protection, or cleanup after the results are consumed. ### Attack Path 1. An attacker with access to the same multi-user host observes or predicts the input filename, s ...[truncated 1671 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (34)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/agents-and-configs.md (reported line 160)May include surrounding context.

md
Returns the updated Agent with `thumbnail` set to a presigned URL.

### DELETE /v2/agents/{agent_id}/thumbnail — Delete Thumbnail

Removes the current thumbnail and returns the updated Agent.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Documenting a raw agent-deletion endpoint in a skill whose purpose is to create, run, and manage agents increases the chance that an LLM-driven workflow could execute irreversible destructive actions from ambiguous user input. In agent/tooling contexts, exposing deletion operations without an emphasized confirmation requirement can enable accidental or adversarial prompt-driven deletion of user assets.

Content

Scanner excerpt · references/agents-and-configs.md (reported line 164)May include surrounding context.

Removes the current thumbnail and returns the updated Agent.

DELETE /v2/agents/{agent_id} — Delete Agent

json
{ "id": "agt_xxx", "object": "agent", "deleted": true }

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/agents-and-configs.md (reported line 184)May include surrounding context.

}

text

### DELETE /v2/agents/{agent_id}/likes — Unlike Agent

Idempotent unlike endpoint.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
81% confidence
Finding

Delete-config capability is destructive and can break workflows or remove published/default configurations if triggered through an LLM-integrated management skill. In this skill context, where users ask the agent to create and run configs, exposing delete operations without strong confirmation and scoping guidance raises the risk of prompt-induced destructive actions against the wrong config.

Content

Scanner excerpt · references/agents-and-configs.md (reported line 327)May include surrounding context.

{ "name": "new-name", "is_default": true }

text

### DELETE /v2/agents/{agent_id}/configs/{config_id} — Delete Config

### Conditional Branching (next_steps)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
83% confidence
Finding

The skill documents a destructive tool action, DELETE /v2/files/{file_id}, in a workflow-oriented agent context that can upload, manage, and run document jobs. In an agent skill, exposing deletion capability without explicit guardrails such as ownership validation, confirmation requirements, or least-privilege constraints increases the risk of prompt-driven or accidental deletion of user files, especially because the endpoint is irreversible and acts directly on remote resources.

Content

Scanner excerpt · references/files.md (reported line 76)May include surrounding context.

}

text

## DELETE /v2/files/{file_id} — Delete File

```json
{ "id": "file_abc123", "object": "file", "deleted": true }

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/jobs.md (reported line 94)May include surrounding context.

Cache info is in metadata.cached ("true" / "false" string).

DELETE /v2/responses/{job_id} — Delete Job

json
{ "id": "job_xxx", "object": "job", "deleted": true }

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list contains broad phrases such as 'create agent' and 'run job', which can cause the skill to activate for generic requests that are not clearly scoped to Upstage Studio. Over-broad activation increases the chance that sensitive documents or workflow requests are routed to this skill unexpectedly, leading to unintended external API use or file handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs writing outputs into the system temporary directory and printing absolute paths, but does not warn about local artifact creation, retention, or overwrite risks. This can expose sensitive processed document contents to other local users/processes, leave residual data behind, or overwrite files if path handling is not carefully constrained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents thumbnail and agent deletion operations, including full agent deletion, but provides no warning about the irreversible impact or need for care. Under the markdown-specific warning rule, descriptions of behaviors affecting user data or system integrity should disclose the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example immediately uploads a local document to a third-party API without any notice that document contents leave the local environment. For a document-processing skill, this is particularly sensitive because uploaded files may contain confidential or regulated data, and users may not realize the privacy implications from the example alone.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 7)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 14)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 21)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 33)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 52)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 56)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 63)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 83)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 112)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 131)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 137)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 147)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 158)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 167)May include surrounding context.

bash
# 1. Upload file
curl -X POST https://api.upstage.ai/v2/files \
  -H "Authorization: Bearer $UPSTAGE_API_KEY" \
  -F "file=@invoice.pdf" \
  -F "purpose=user_data"