ClawHub
Back to skill

Security audit

Ainative Sdk Quickstart

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SDK quickstart, but it asks users to run an unpinned initializer that changes agent/IDE MCP configuration and it encourages exposing API keys in browser-visible settings.

Review this skill before installing or following it. Do not run `npx zerodb init` unless you trust the package source and are prepared for it to create credentials and modify `.claude/mcp.json` or `cursor/mcp.json`; prefer a pinned version or manual setup where you can inspect the MCP configuration first. Keep long-lived API keys server-side unless AINative documents a separate restricted publishable client token.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:10
Finding

Unpinned npm Package Is Downloaded and Executed

Content
View full analysis
Remediation
View remediation
zerodb init`, subject to verification against the package's documented invocation method. - Commit and enforce lockfiles where the CLI is installed as a project dependency. - Verify package provenance, registry source, signatures, and integrity hashes before execution. - Prefer installing the reviewed dependency first and then invoking it as a separate, auditable step. - Document the files, network endpoints, and credentials the initializer will access before asking users to execute it. - Run initialization in a restricted environment without unrelated credentials whenever practical. ]]>

T07 · Tool Hijacking and Spoofing

Error
Location
SKILL.md:10
Finding

Initializer Automatically Modifies MCP Tool Configuration Without a Reviewable Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:140
Finding

Documentation Encourages Exposure of API Keys in Browser-Accessible Configuration

Content
View full analysis
``` ```svelte setAINativeConfig({ apiKey: 'ak_your_key' }); ``` ```vue provideAINative({ apiKey: 'ak_your_key' }); ``` ### Technical Analysis Variables prefixed with `NEXT_PUBLIC_` are intentionally included in browser-accessible Next.js builds. Likewise, API keys supplied directly to React, Svelte, or Vue client code can be recovered from JavaScript bundles, runtime state, or network requests. The examples contain placeholders rather than a leaked live credential. Nevertheless, the instructions encourage developers to replace those placeholders with real API keys in locations where confidentiality cannot be maintained. If these are privileged project keys rather than deliberately public, scope-limited client tokens, any site visitor can obtain and reuse them. Sending user chat content to the declared AINative API is necessary for the advertised chat functionality. Exposing a reusable privileged credential to every client is not necessary and violates least-privilege principles. ### Attack Path 1. A developer follows the example and assigns a live API key to `NEXT_PUBLIC_AINATIVE_API_KEY` or embeds it in frontend SDK configuration. 2. The application build publishes the key to browser-accessible JavaScript or runtime configuration. 3. An attacker visits the application and inspects source files, developer tools, or network traffic. 4. The attacker extracts the API key. 5. The attacker reuses the key outside the application to make unauthorized API requests within the key's permissions and quota. ### Impact ...[truncated 480 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

The skill advertises that the setup process writes MCP configuration into .claude/mcp.json or cursor/mcp.json, which are sensitive agent/IDE integration points. Modifying these files can grant or alter tool access and embed credentials, making the action security-sensitive even if the documentation is not overtly malicious.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

text
API Key: ak_...
Project ID: proj_...
MCP config written to .claude/mcp.json (or cursor/mcp.json)

Or create manually at https://app.ainative.studio → Settings → API Keys.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guide explicitly recommends NEXT_PUBLIC_AINATIVE_API_KEY, which exposes the API key to client-side bundles and any end user of the application. In this context, that can enable unauthorized API use, quota theft, impersonation of the project, and downstream privacy issues if requests are made directly from browsers.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The .env example places a real API secret alongside a NEXT_PUBLIC_ variant, effectively normalizing exposure of the same credential to the client side. This is dangerous because secrets in public env vars are included in frontend builds and can be extracted by anyone using the app, leading to credential theft and abuse.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

7. Environment Variables

bash
# .env
AINATIVE_API_KEY=ak_your_key
NEXT_PUBLIC_AINATIVE_API_KEY=ak_your_key  # Next.js client-side

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quickstart tells users to run npx zerodb init and notes afterward that it writes MCP config files, but it does not warn up front that local IDE/agent configuration will be modified. Silent or poorly disclosed config mutation is dangerous in agent tooling because it can alter trust boundaries, add new tool access, or surprise users into persisting sensitive credentials in local config.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Using npx zerodb init without pinning a package version causes execution of whatever package version is current at invocation time. In a quickstart context this is risky because the command also changes local MCP/IDE configuration, so users may execute unreviewed code and accept side effects without realizing it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.