ClawHub
Back to skill

Security audit

Launch Sentiment Sweep

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent social-reaction research workflow, but it asks users to enable broader third-party capabilities and unpinned local package execution than the stated Reddit-and-X purpose requires.

Install only if you are comfortable sending the launch/topic terms and selected public URLs to Veezee. Prefer the separate Reddit and X MCP endpoints instead of `/all`, avoid the unpinned `npx` CLI unless you have reviewed or pinned the package, and do not use this for confidential or unreleased launch names without explicit approval.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- SDK: `import { VeezeeClient } from "@veezee/sdk"`; `const client = new VeezeeClient(); await client.mint();` mints and stores the free key the first time and reuses it on later runs. Reddit methods live on `client.reddit.search/getSubreddit/getSubredditPosts/getUser/getPost/resolveUrl`; X methods follow the same per-platform pattern (`client.x.search`, `client.x.getProfile`, `client.x.getTweets`, `client.x.getTweet`, `client.x.resolveUrl`). `client.resolveUrl` and `client.getUsage` are also available top-level. The `veezee` CLI (`npx @veezee/sdk init`) mints and stores the same key.

Technical Analysis

The Skill recommends executing npx @veezee/sdk init without specifying an exact package version, lockfile, or integrity hash. By default, npx may retrieve and execute the package version currently resolved by the configured package registry. The executed code can therefore differ from the code that existed when the Skill was audited.

This creates a supply-chain trust boundary: package maintainers, compromised publisher accounts, registry infrastructure, or a modified package release can change the effective executable payload after review. npm lifecycle hooks and CLI initialization code may execute with the invoking user's local privileges.

The same instruction indicates that the SDK mints and stores an API key, but it does not identify the storage location, file permissions, credential lifecycle, or protections against access by other local users and processes.

Attack Path

  1. An attacker compromises the package publisher, release process, registry account, or another relevant supply-chain component.
  2. The attacker publishes a malicious or compromised version of @veezee/sdk.
  3. A user or agent follows the Skill and runs `npx @vee ...[truncated 804 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin @veezee/sdk to an exact version that has been reviewed, rather than relying on the registry's current resolution.
  • Install dependencies through a committed lockfile and enforce package integrity verification.
  • Prefer a documented local installation followed by execution with package downloads disabled.
  • Audit package lifecycle scripts and the CLI entry point before permitting execution.
  • Use an approved registry and dependency allowlist where available.
  • Document where the minted key is stored and enforce owner-only permissions.
  • Provide procedures for key revocation, rotation, and deletion.
  • Avoid exposing the key through command-line arguments, logs, shell history, or broadly readable configuration files.

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:13
Finding

Over-Privileged MCP Endpoint Exposes an Unneeded Platform Capability

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Low

Vulnerable Code Snippet:

markdown
- MCP: add `https://mcp.veezee.io/reddit` and `https://mcp.veezee.io/x` (streamable-http, one platform each), or `https://mcp.veezee.io/all` for both plus LinkedIn in one mount. Hosts that support MCP authorization (Claude Code, claude.ai) open a Veezee sign-in on connect (email code, no password): that is the whole auth step. Other hosts: mint a key with `POST https://api.veezee.io/v1/keys/mint` (empty body; the key is shown once) and put it in the connection's `Authorization: Bearer` header.

Technical Analysis

The Skill states that its operational scope is limited to Reddit and X, but it also recommends the /all MCP endpoint, which includes LinkedIn functionality. Mounting that endpoint grants the agent a capability unrelated to the declared task.

This violates the principle of least privilege. Even if the normal workflow never invokes LinkedIn tools, exposing unnecessary tools increases the potential impact of agent mistakes, ambiguous instructions, prompt injection in retrieved content, or later instructions issued within the same session.

The issue is capability exposure rather than evidence of actual unauthorized LinkedIn access. The separate /reddit and /x endpoints already provide the capabilities required by the Skill.

Attack Path

  1. A user follows the setup instructions and mounts https://mcp.veezee.io/all.
  2. The MCP connection exposes Reddit, X, and LinkedIn capabilities to the agent.
  3. The agent processes untrusted social-media content or receives ambiguous or manipulated follow-up instructions.
  4. Those instructions cause the agent to invoke the unnecessary LinkedIn capability.
  5. LinkedIn data is accessed outside the Skill's declared Reddit-and-X scope, subject to the permissions associat ...[truncated 535 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the /all endpoint from this Skill's default setup instructions.
  • Direct users to mount only https://mcp.veezee.io/reddit and https://mcp.veezee.io/x.
  • Require explicit, informed user authorization before enabling any additional platform.
  • Separate LinkedIn functionality into a different Skill or optional configuration with a clearly documented purpose.
  • Enforce an allowlist restricting tool calls to Reddit and X operations during this workflow.
  • Document what information is sent to each external service and which account permissions are used.
  • Review granted platform entitlements periodically and revoke capabilities that are not required.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation language is very broad and can cause the skill to trigger on many generic user requests about reactions or sentiment, increasing the chance that user queries are routed to this external-data skill unnecessarily. In context, that means more chances of sending user-provided topics or launch names to a third-party service without a narrowly scoped need.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill explicitly instructs the agent to connect to external MCP and API endpoints and to transmit search queries, URLs, and authentication material to veezee.io. While external transmission is core to the skill's function, it is still a real data-exposure risk if user-supplied terms, internal project names, or sensitive launch details are sent to the third party without clear consent and minimization.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
Every call needs an API key. Minting one is free and human-free: no signup, no card. A call without a key fails with `KEY_REQUIRED` (401) carrying `mint_url`; the fix is the free mint below, never a payment. Two equivalent surfaces; pick whichever your environment has:

- MCP: add `https://mcp.veezee.io/reddit` and `https://mcp.veezee.io/x` (streamable-http, one platform each), or `https://mcp.veezee.io/all` for both plus LinkedIn in one mount. Hosts that support MCP authorization (Claude Code, claude.ai) open a Veezee sign-in on connect (email code, no password): that is the whole auth step. Other hosts: mint a key with `POST https://api.veezee.io/v1/keys/mint` (empty body; the key is shown once) and put it in the connection's `Authorization: Bearer` header.
- SDK: `import { VeezeeClient } from "@veezee/sdk"`; `const client = new VeezeeClient(); await client.mint();` mints and stores the free key the first time and reuses it on later runs. Reddit methods live on `client.reddit.search/getSubreddit/getSubredditPosts/getUser/getPost/resolveUrl`; X methods follow the same per-platform pattern (`client.x.search`, `client.x.getProfile`, `client.x.getTweets`, `client.x.getTweet`, `client.x.resolveUrl`). `client.resolveUrl` and `client.getUsage` are also available top-level. The `veezee` CLI (`npx @veezee/sdk init`) mints and stores the same key.

A fresh `vz_trial_` key runs under a free per-IP daily budget of 200 credits shared across platforms, cached data only, first page only on any cursor sequence. That covers a small test sweep; a real two-platform sweep needs purchased credits. When the budget or a trial cap runs out (`TRIAL_CAP_EXCEEDED`, `INSUFFICIENT_CREDITS`, `BUDGET_EXHAUSTED`), the error carries `upgrade_url` and a machine-readable `offer`: hand that link to your human; purchases credit the same key directly, nothing to reconfigure.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.