ClawHub
Back to skill

Security audit

End-to-end encrypted .md documents for agents & humans to collaborate. This is a multiplayer alternative to gog and Google Docs that lets people (via CLI) and agents create, search and sync encrypted markdown docs. This service leverages https://ddocs.new which can be enabled locally or via your preferred cloud set-up to make docs accessible across any device or chatbot interface in complete privacy.

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing encrypted documents, but it asks users to trust and connect broad document-control tooling to a custom server without enough safeguards for transport security, deletion, or key-bearing links.

Install only if you control or have verified the Fileverse MCP endpoint, use HTTPS, and understand that the endpoint may receive document plaintext. Treat full ddoc links as sensitive secrets, and require confirmation before any delete or broad update operation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:14
Finding

User-Supplied MCP Endpoint Permits Insecure HTTP Transport

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–23
Vulnerability Type: Untrusted remote service configuration over insecure transport
Risk Level: High

Vulnerable code snippet:

markdown
## Agents - Setup (Device)

There are different ways to connect to the Fileverse API. First, you need to get the `<SERVER_URL>` from the user.

### MCP

The fastest way to start is by adding the Fileverse MCP server to your client.

#### Claude Code

```bash
claude mcp add --transport http fileverse-api <SERVER_URL>
text

Related setup instructions also place the unrestricted `<SERVER_URL>` into Cursor and Windsurf MCP configuration at lines 28–52. The browser setup tells the user to check **“I trust this provider”** at line 76 without documenting a verification procedure.

### Technical Analysis

The Skill accepts an arbitrary server URL and explicitly configures Claude Code with the `http` transport. It does not require HTTPS, validate the endpoint's identity, define an approved-host allowlist, or instruct users to verify the server operator and certificate.

The configured server handles plaintext document titles and contents and exposes tools that can list, search, read, create, update, synchronize, and permanently delete documents. End-to-end encryption at the storage layer does not protect plaintext submitted to a malicious MCP endpoint or content intercepted while using cleartext HTTP.

The Cursor configuration path `~/.cursor/config/mcp.json` is relevant to the declared MCP setup and does not, by itself, constitute credential theft or excessive filesystem access. The primary risk is the unrestricted and potentially unencrypted remote endpoint inserted into that trusted configuration.

### Attack Path

1. An attacker persuades a user to supply an attacker-controlled `SERVER_URL`, or alters an HTTP endpoint through DNS, routing, proxy, or local-network interception.
2. The user
...[truncated 1364 chars]
Remediation
View remediation

Remediation Suggestions

  • Require https:// endpoints with valid certificate and hostname verification; do not recommend cleartext HTTP except for explicitly identified loopback-only development environments.
  • Replace --transport http with a secure transport configuration appropriate to the MCP client.
  • Validate the URL scheme and reject cleartext, malformed, loopback, link-local, or private-network destinations unless the user explicitly selected a local deployment.
  • Provide an allowlist for officially operated endpoints, or require the user to verify the hostname and server operator before registration.
  • Explain that the MCP server receives plaintext submitted through its tools despite encrypted downstream storage.
  • Require informed confirmation before registering a new provider rather than merely instructing the user to mark it trusted.
  • Use least-privilege authentication and separate read, write, and delete capabilities where supported.
  • Require explicit user confirmation immediately before destructive document operations.
  • Document certificate pinning or equivalent endpoint-authentication controls for high-sensitivity deployments.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:389
Finding

Unconditional Disclosure of Shareable URLs Containing Document Encryption Keys

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 157 and 389
Vulnerability Type: Disclosure of bearer-like encryption material in agent output
Risk Level: Medium

Vulnerable code snippets:

markdown
**Usage notes:**

* The `link` field is only available when `syncStatus` is `"synced"`
* The link contains an encryption key fragment after `#` for end-to-end encryption
markdown
### Best Practices for Agents

1. **Always return the link** - After creating or updating a document, return the `link` field to the user so they can view/share it

Technical Analysis

The Skill identifies the URL fragment as containing the document encryption key, but then directs agents to always place the complete link in their output after creation or update. Such a link functions as a bearer secret: anyone who obtains the complete URL may possess both the document location and the material needed to decrypt it.

Returning the link unconditionally increases its exposure to conversation history, agent telemetry, screenshots, copied messages, shared chat participants, and downstream systems that process model output. URL fragments are generally not sent to an origin server during ordinary browser navigation, but that property does not protect the fragment once the complete URL is placed into chat output or otherwise copied.

Attack Path

  1. A user asks the agent to create or update a sensitive document.
  2. The service returns a shareable URL whose fragment contains the encryption key.
  3. Following the Skill's unconditional instruction, the agent prints the complete URL in its response even if the user did not request a shareable link.
  4. The response is retained in chat history, captured by telemetry, copied into another system, displayed to another participant, or exposed through an account or session compromise.
  5. A party that obtains the complete link uses the embedded key material to access ...[truncated 868 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to always return the complete link.
  • Treat the full URL, particularly its fragment, as sensitive bearer material.
  • Return the link only when the user explicitly requests it and confirms that the current conversation is an appropriate disclosure channel.
  • Redact the fragment by default, for example by displaying only the document identifier or a shortened non-secret reference.
  • Warn users not to place complete links in public messages, logs, issue trackers, or shared prompts.
  • Prevent key-bearing links from being recorded in telemetry and application logs.
  • Provide link revocation, key rotation, expiration, and audience-restricted sharing where supported.
  • Prefer a dedicated secure secret-delivery mechanism over ordinary agent output for sensitive documents.
  • Clearly distinguish between a document reference and a complete decrypting share link in tool responses and documentation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
75% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
**Setup steps:**

1. Open ChatGPT > Settings > Apps > Advanced > toggle Developer Mode on
2. Go to Settings > Apps > click Create
3. Fill in:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly tells users to check "I trust this provider" for a custom MCP server without explaining that this grants a third-party service access through the connector path and may expose sensitive prompts, documents, or tool interactions to that server. In this context, the server URL is user-supplied or self-hosted, which increases the chance of connecting to an unvetted endpoint and normalizing unsafe trust decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documents permanent deletion and even notes that related decentralized storage records are updated, but its usage guidance does not instruct agents to confirm intent before calling the delete tool. In an agent workflow, this omission can lead to accidental irreversible destruction of user data from ambiguous prompts or mistaken document selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.