ClawHub
Back to plugin

Security audit

IGA Pages

Security checks for vulnerabilities and agentic risk

Overview

This package is a coherent IGA Pages deployment skill with disclosed account, deployment, environment, integration, log, MCP, and limited telemetry behavior.

Install this if you are comfortable granting the IGA Pages MCP/CLI workflow access to deploy projects, change project environment variables, inspect logs, and manage integrations. Treat pulled `.env.local` files, preview URLs with query tokens, logs, AK/SK credentials, and upload tickets as sensitive. If using the bundled non-OpenClaw client hooks, disable telemetry with `IGA_PAGES_TELEMETRY_DISABLED=1` if you do not want usage reports with a hashed device identifier.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

Writing all project env values to .env.local creates a credential access opportunity because secrets become materialized in plaintext on the local filesystem. In the context of a deployment skill, this is more dangerous than a generic doc mention because users are likely handling production credentials and may execute this routinely.

Content

Scanner excerpt · skills/iga-pages/SKILL.md (reported line 114)May include surrounding context.

md
iga pages env add <NAME>           # add (--value <v> --yes for CI)
iga pages env update <NAME>        # update existing
iga pages env remove <NAME>        # remove (--yes to skip confirm)
iga pages env pull                 # write all project env to .env.local

## integrations (Supabase and AI Gateway; linked project required)
iga pages integration list                  # bindings on this project

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/iga-pages/references/env.md (reported line 16)May include surrounding context.

iga pages env update --value --yes iga pages env remove # or: env rm — asks for confirmation iga pages env remove --yes # skip confirmation (required when no TTY) iga pages env pull # write all project env to local .env.local

text

Notes:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill recommends iga login --accessKey <YOUR_AK> --secretKey <YOUR_SK> for unattended automation without warning that these are highly sensitive long-lived credentials. Users may paste them into shell history, logs, transcripts, or shared terminals, creating a realistic credential exposure path.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly states that iga pages env pull writes all project environment variables to .env.local but does not warn that this places secrets on local disk. That can lead to accidental disclosure through backups, editor plugins, local malware, or mistaken commits if ignore rules fail or are absent.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · skills/iga-pages/references/agent-sdk.md (reported line 40)May include surrounding context.

import { store, StoreError } from "@iga-pages/agent/store";

text

| Resource      | Operations                                                                                                         |
| ------------- | ------------------------------------------------------------------------------------------------------------------ |
| Conversations | `createConversation`, `getConversation`, `listConversations`, `updateConversation`, `deleteConversation`           |
| Messages      | `appendMessage`, `appendMessages`, `getMessage`, `listMessages`, `updateMessage`, `deleteMessage`, `clearMessages` |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skills/iga-pages/references/env.md (reported line 15)May include surrounding context.

iga pages env update # change an existing variable's value iga pages env update --value --yes iga pages env remove # or: env rm — asks for confirmation iga pages env remove --yes # skip confirmation (required when no TTY) iga pages env pull # write all project env to local .env.local

text

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skills/iga-pages/references/integration.md (reported line 79)May include surrounding context.

md
## Supabase provider work → hand off to `byted-supabase`

This skill only orchestrates link / integration / env / deploy. It does **not** manage Supabase resources (creating workspaces/branches, SQL, migrations, API keys, Storage, Edge Functions). When the user wants to create or manage actual Supabase resources, hand off to the `byted-supabase` skill (`https://github.com/bytedance/agentkit-samples/blob/main/skills/byted-supabase/SKILL.md`). After it finishes, return and confirm with the user before continuing link / integration / deploy — don't auto-continue.

Static analysis

No suspicious patterns detected.