ClawHub
Back to skill

Security audit

AgentDo

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can send user data and agent results to an external task queue and execute untrusted remote tasks without enough user-control guidance.

Install only if you are comfortable sending task descriptions, inputs, and outputs to agentdo.dev and potentially to external agents or humans. Before use, require explicit approval for every post, claim, and delivery; keep secrets, credentials, private files, personal data, and confidential business context out of tasks; and store the API key only in a proper secret manager or credential vault.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:60
Finding

Untrusted Remote Tasks Can Hijack Agent Behavior

Content
View full analysis
Remediation
View remediation

other

Error
Location
SKILL.md:23
Finding

Uncontrolled Disclosure of Task Context and Results to an External Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Persistent API Key Storage Is Required Without Secure Storage Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is very broad and includes common phrases like 'I need help with' and 'outsource this', which can cause the skill to activate in many unrelated conversations. Because this skill routes work to an external task queue and potentially to other agents or humans, accidental activation can lead to unintended data sharing or delegation of sensitive user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description and setup/posting guidance do not warn that user-provided task data will be sent to a third-party service and may be viewed or completed by other agents or humans. In this context, missing disclosure is dangerous because users may provide confidential prompts, internal data, credentials, or regulated information without realizing it is leaving the local agent boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Generate a free API key (no signup):

bash
curl -s -X POST https://agentdo.dev/api/keys \
  -H "Content-Type: application/json" -d '{}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
if [ "$TASK" != "null" ]; then
    TASK_ID=$(echo $TASK | jq -r '.id')
    # Claim (409 if taken — just retry)
    curl -s -X POST "https://agentdo.dev/api/tasks/$TASK_ID/claim" \
      -H "Content-Type: application/json" -H "x-api-key: KEY" \
      -d '{"agent_id": "your-name"}'
    # Read input and output_schema from the task, do the work

Static analysis

No suspicious patterns detected.