ClawHub
Back to skill

Security audit

Global Price Comparison

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed price-comparison helper that uses search and exchange-rate APIs for its stated purpose, with no hidden persistence or unrelated access found.

Install only if you are comfortable sending product search terms to Brave or Tavily and using their API keys in the local environment. Keep confidential product names, unreleased purchasing plans, or internal identifiers out of discovery queries unless third-party search disclosure is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tainted flow: 'req' from os.environ.get (line 257, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/global_price_compare.py (reported line 61)May include surrounding context.

python
def http_json(url: str, headers: dict[str, str] | None = None, timeout: int = 20) -> Any:
    req = urllib.request.Request(url, headers=headers or {})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        charset = resp.headers.get_content_charset() or "utf-8"
        return json.loads(resp.read().decode(charset, errors="replace"))

Tainted flow: 'req' from os.environ.get (line 257, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/global_price_compare.py (reported line 260)May include surrounding context.

python
def http_json(url: str, headers: dict[str, str] | None = None, timeout: int = 20) -> Any:
    req = urllib.request.Request(url, headers=headers or {})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        charset = resp.headers.get_content_charset() or "utf-8"
        return json.loads(resp.read().decode(charset, errors="replace"))

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes a Python script that can read and write files, access environment variables, and perform network searches via Brave/Tavily, but the skill manifest declares no explicit tool scope or permissions. This creates an unnecessary trust gap: an agent or reviewer cannot easily determine the intended capability boundary, increasing the risk of overbroad execution, accidental data exposure from environment variables, or unintended network/file access in environments that honor manifest-declared permissions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill sends search queries and related metadata to Brave's external API. In the context of an agent skill, that creates a real data exposure boundary because user prompts and product interests may contain confidential or sensitive business information.

Content

Scanner excerpt · scripts/global_price_compare.py (reported line 215)May include surrounding context.

python
last_err: Exception | None = None
    for params in candidates:
        url = "https://api.search.brave.com/res/v1/web/search?" + urllib.parse.urlencode(params)
        try:
            payload = http_json(url, headers={"Accept": "application/json", "X-Subscription-Token": key}, timeout=timeout)
            results = []

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

User-supplied product queries are transmitted to external search providers without any notice, consent gate, or redaction. In an agent setting, users may include sensitive terms, internal product names, or confidential purchasing intents, which would then be disclosed to Brave or Tavily.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill transmits user search queries and an API credential to Tavily, a third-party service. Even though this is expected functionality, it is still a meaningful external data-sharing risk in an agent environment if users are unaware their input leaves the system.

Content

Scanner excerpt · scripts/global_price_compare.py (reported line 246)May include surrounding context.

python
if not key:
        raise RuntimeError("TAVILY_API_KEY is required for Tavily search")

    url = "https://api.tavily.com/search"
    body = json.dumps(
        {
            "api_key": key,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The Tavily request embeds the TAVILY_API_KEY and query into a POST body sent over the network, but the script provides no user-facing warning that credentials and search input are being transmitted to a third-party service. For this code file, outbound transmission of user/system data should have some visible disclosure unless clearly warned elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.