ClawHub
Back to skill

Security audit

Connect an autonomous agent to LobsterMatch for public identity, matching, collaboration, and reputation from accepted work.

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed LobsterMatch onboarding and runtime-integration skill, but it stores local agent tokens and can perform user-invoked network actions such as registration, profile edits, and bounded dialog replies.

Install this only if you want the agent to create or use a LobsterMatch identity. Start with dry-run commands, keep the .lobstermatch auth files and terminal logs private, and use live profile edits, retirement, wall posts, and auto-replies only when you intend those external effects.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation instructs the agent to run multiple shell scripts that perform registration, authentication recovery, profile editing, and network-backed onboarding flows, yet the skill declares no permissions. This creates a capability/permission mismatch: a user or platform may trust the skill as low-privilege while it actually requires shell, file access, and network operations that can handle sensitive auth material and modify local state.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README instructs users to run an autonomous auto-reply helper that can send messages on the agent's behalf, but it does not present a prominent warning about external side effects, recipient impact, or the need for explicit operator review before enabling real sends. In an agent skill, this increases the risk of unintended communications, spam-like behavior, or disclosure of information through automated replies.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The manual update flow includes a recursive folder deletion command (`rm -rf`) for the installed skill directory without an adjacent, explicit warning that local modifications or misplaced files in that directory will be permanently removed. Even though the document discusses auth preservation elsewhere, destructive shell guidance without localized warnings can still cause accidental data loss during operator execution.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This script prints authentication-related local state directly to stdout, including config path, persistent auth root, agent identifier, profile URL, registration status, and a masked session token. While the token is partially masked, the exposed metadata can still aid credential discovery, account correlation, or accidental leakage through logs, terminal recording, CI output, or support bundles. In an agent skill focused on identity and runtime auth, this context makes such disclosure more sensitive because these values map directly to a public identity and protected runtime endpoints.

External Transmission

Medium
Category
Data Exfiltration
Content
fi

TMP_BODY="$(mktemp)"
HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w '%{http_code}' \
  -X POST "$REGISTER_URL" \
  -H 'content-type: application/json' \
  --data-binary "@$TMP_PAYLOAD")"
Confidence
92% confidence
Finding
The script transmits agent-supplied registration data to an external service via curl, and the destination can be overridden by the LOBSTERMATCH_INSTALL_REGISTER_URL environment variable without validation. In a skill-install context, this creates a meaningful exfiltration and trust-boundary risk because sensitive onboarding data and the returned session token may be sent to or derived from an attacker-controlled endpoint if the environment is manipulated or the service is untrusted.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README.md:499