ClawHub
Back to skill

Security audit

Abra

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed guide for using a local secrets vault, with sensitive capabilities but clear scope and safety limits.

Install this only if you actually use abracadabra/abra and want agents to work with secrets from that vault. Keep grants narrow and expiring, prefer loopback over LAN, do not let agents broaden scope or revoke grants without a clear request, and treat treasury payments or cartridge restore/checkpoint actions as requiring explicit human confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
secrets the human has scoped to this agent (issued abra key or Touch ID grant),
  key issue/scope/revoke, health checks, keygen/connectors, USB/LAN sync, cartridge
  checkpoints, and treasury USDC payments (Touch ID). Do not use for generic env var,
  API token, wallet, or SSH key questions, or for other vaults or .env files. Never
  print secret values in chat.
---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
65% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md
in-process — never treat `result.content[0].text` as a script. Never write fetched
secrets to disk for later sessions.

### 1b. Manual one-off with curl (humans, not agents)

If you must use curl, pass the header via a config read from stdin so the key is
not on the command line:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
65% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

abra serve --open # + web dash abra serve --lan # HTTPS 0.0.0.0; writes ~/.abracadabra/lan-serve.pem abra serve --lan --tls-cert c.pem --tls-key k.pem

Clients: curl --cacert ~/.abracadabra/lan-serve.pem … — NEVER curl -k

text

`GET /health` · `GET /grants` · `DELETE /grants` · `POST /secret`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
65% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

abra serve --open # + web dash abra serve --lan # HTTPS 0.0.0.0; writes ~/.abracadabra/lan-serve.pem abra serve --lan --tls-cert c.pem --tls-key k.pem

Clients: curl --cacert ~/.abracadabra/lan-serve.pem ... — NEVER curl -k

text

`GET /health` · `GET /grants` · `DELETE /grants` · `POST /secret`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Documenting a sensitive state-changing endpoint like DELETE /grants in an agent skill increases the chance an agent or downstream automation could revoke grants without sufficient user confirmation or safety checks. In a secrets-management context, destructive control-plane actions can disrupt access, cause denial of service for active sessions, or be misused by prompt injection that steers the agent toward revocation operations.

Content

Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.

Clients: curl --cacert ~/.abracadabra/lan-serve.pem … — NEVER curl -k

text

`GET /health` · `GET /grants` · `DELETE /grants` · `POST /secret`

## Anti-patterns (do not)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
**Default for unattended work:** scoped API key + `POST /secret` (no Touch ID).
**Default when human is at the keyboard:** MCP `get_secrets` with `ttl`.

Rule: **do not ask the user to paste a secret value into chat** when it is already
stored in abra and within your scope. Discover the key name, fetch it within the
grant, and load it into env/files safely (see §1). Asking the human to widen scope
or approve Touch ID is always fine; asking them to type the value is not.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
if (!cmd) { console.error("usage: node - -- <absolute-command> [args]"); process.exit(2); }
if (!path.isAbsolute(cmd)) { console.error("child command must be an absolute path"); process.exit(2); }
(async () => {
  const res = await fetch("http://127.0.0.1:7331/secret", {
    method: "POST",
    headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
    body: JSON.stringify({ project: process.env.ABRA_PROJECT, keys: allow }),

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
if (!cmd) { console.error("usage: node - -- <absolute-command> [args]"); process.exit(2); }
if (!path.isAbsolute(cmd)) { console.error("child command must be an absolute path"); process.exit(2); }
(async () => {
  const res = await fetch("http://127.0.0.1:7331/secret", {
    method: "POST",
    headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
    body: JSON.stringify({ project: process.env.ABRA_PROJECT, keys: allow }),

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md
After injecting via §1a (or MCP `get_secrets` into the current process), treat
values as opaque. **Do not** feed vault JSON, `.env` lines, or secret values to a
shell. MCP `get_secrets`: parse JSON, pick allowlisted keys, assign to env
in-process — never treat `result.content[0].text` as a script. Never write fetched
secrets to disk for later sessions.

### 1b. Manual one-off with curl (humans, not agents)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md
in-process — never treat `result.content[0].text` as a script. Never write fetched
secrets to disk for later sessions.

### 1b. Manual one-off with curl (humans, not agents)

If you must use curl, pass the header via a config read from stdin so the key is
not on the command line:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md
**LAN (`abra serve --lan`):** point the fetch/curl at `https://$LAN_IP:7331/secret`
and trust only `~/.abracadabra/lan-serve.pem` (Node: `NODE_EXTRA_CA_CERTS`; curl:
`--cacert`). **Never `curl -k` / `--insecure`** or `NODE_TLS_REJECT_UNAUTHORIZED=0`
— that enables MITM theft of `ABRA_KEY` and secret payloads. Prefer loopback when
the agent is on the same machine.

Static analysis

No suspicious patterns detected.