ClawHub
Back to skill

Security audit

Aicoo Share Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it also documents broad note search and note editing through the same API token, which deserves review before installation.

Review this skill before installing if your Aicoo account contains sensitive notes or investor materials. Use folder-scoped, sign-in-required, short-lived links by default; avoid anonymous links for confidential content; and do not let the skill patch notes unless you have verified the exact note ID and intended content change.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Missing User Warnings

High
Confidence
96% confidence
Finding
The example states that users can enable anonymous public access to investor materials by setting requireSignIn:false, but it provides no privacy, confidentiality, or discoverability warning. In the context of investor materials, anonymous access materially increases the chance that sensitive business information is exposed beyond intended recipients and shared uncontrollably.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
---

## DELETE /os/share/{linkId}

Revoke a share link.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The documented purpose of the skill is sharing/link management, but later instructions enable modification of note content. This mismatch is dangerous because users or orchestrators may invoke the skill expecting limited sharing actions while unintentionally granting a workflow that can write to stored content.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2) Create a share link (OS endpoint)

```bash
curl -s -X POST "https://www.aicoo.io/api/v1/os/share" \
  -H "Authorization: Bearer ${AICOO_API_KEY:-$PULSE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2) Create a share link (OS endpoint)

```bash
curl -s -X POST "https://www.aicoo.io/api/v1/os/share" \
  -H "Authorization: Bearer ${AICOO_API_KEY:-$PULSE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# update
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/share/{linkId}" \
  -H "Authorization: Bearer ${AICOO_API_KEY:-$PULSE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"notesAccess":"write","expiresIn":"30d","requireSignIn":true}' | jq .
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill is supposed to manage sharing links, but it also includes direct note search and note editing operations that can modify arbitrary content. This expands the skill's authority from link administration into content manipulation, creating an overbroad capability that could be abused to alter policies, inject instructions, or modify sensitive notes under the same API token.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# find link policy note
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \
  -H "Authorization: Bearer ${AICOO_API_KEY:-$PULSE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"query":"For-Investors"}' | jq .
Confidence
90% confidence
Finding
Searching notes via an external API goes beyond link creation and management and can expose or enumerate stored content unrelated to sharing. In this skill context, the call broadens access from metadata management into content discovery, which increases the chance of unauthorized data exposure or misuse.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"query":"For-Investors"}' | jq .

# edit policy note content
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/notes/123" \
  -H "Authorization: Bearer ${AICOO_API_KEY:-$PULSE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"content":"...\n\n## Policy\n\nBe professional, concise, and do not disclose confidential numbers."}' | jq .
Confidence
95% confidence
Finding
Patching note content through a generic notes endpoint allows the skill to modify stored data, not just sharing settings. In the context of a share-management skill, this is especially dangerous because it can silently change policies, instructions, or other notes under the user's account using a token intended for administrative sharing operations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The example instructs the agent to sync all files from a local investor-materials directory to a remote service without any user-facing caution about the sensitivity of fundraising documents. Investor decks, financials, cap tables, and diligence materials commonly contain confidential information, so normalizing bulk upload without a warning increases the risk of unintended disclosure.

Static analysis

No suspicious patterns detected.