ClawHub
Back to skill

Security audit

Context Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-built for syncing content to Aicoo, but it gives an agent broad authenticated upload, edit, shared-folder, identity-file, and delete powers without requiring clear confirmation safeguards.

Review this before installing. Use it only if you intend to let an agent read selected local files and use your Aicoo API key to create, edit, move, copy, search, and delete Aicoo content. Ask for a file list and destination preview before any sync, avoid syncing secrets or private repositories by default, and require explicit confirmation for deletes, shared-folder writes, and memory/self policy changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises very broad trigger phrases like 'update my agent', 'browse workspace', and 'what does my agent know', which can overlap with common user requests and cause the skill to activate in situations involving sensitive local or remote data. Because this skill performs authenticated remote reads/writes/deletes, overbroad invocation increases the chance of unintended data transmission or modification without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill provides detailed instructions for creating, editing, moving, copying, bulk uploading, and deleting remote files, but it does not require prominent user-facing consent, preview, or warnings about data integrity and exfiltration risks. In this context, the absence of safeguards is dangerous because the skill is specifically designed to send local content to an external service and mutate remote state, including shared folders and identity files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Step 3: Search existing notes first

bash
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"project roadmap"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Step 3: Search existing notes first

bash
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/search" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"project roadmap"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
-d '{"query":"project roadmap"}' | jq .

# deterministic grep (regex/literal + context lines)
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/grep" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pattern":"roadmap|timeline","mode":"regex","caseSensitive":false,"contextBefore":3,"contextAfter":3}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This example creates a remote note by transmitting content to an external service, which directly enables exfiltration of local or user-provided data into Aicoo. In the skill context, this is more dangerous because the trigger phrases are broad and there is no required confirmation or preview before uploading content that may be sensitive.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

bash
# create
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title":"Project Roadmap Q2","content":"# Q2 Roadmap\n\n## Goals\n- Launch v2 API"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
-d '{"title":"Project Roadmap Q2","content":"# Q2 Roadmap\n\n## Goals\n- Launch v2 API"}' | jq .

# snapshot before edit
curl -s -X POST "https://www.aicoo.io/api/v1/os/snapshots/42" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"Pre-edit"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This PATCH request modifies remote note content and can overwrite or corrupt knowledge stored in Aicoo, including shared resources if the note is in a shared folder. Without explicit confirmation, diff preview, or authorization checks at the skill level, the instruction materially increases integrity risk.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
-d '{"label":"Pre-edit"}' | jq .

# edit
curl -s -X PATCH "https://www.aicoo.io/api/v1/os/notes/42" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"# Updated Roadmap\n\n..."}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Moving a note changes its remote location and can alter organization, visibility, and workflow semantics, especially across owned versus shared folders. In a skill that can be broadly invoked, such state-changing operations are risky without confirmation because they may unintentionally reclassify or expose information.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
-d '{"content":"# Updated Roadmap\n\n..."}' | jq .

# move (mv)
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/42/move" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"folderName":"Technical"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

Copying a note duplicates content to another location, which can broaden exposure and create uncontrolled propagation of sensitive data. In shared-folder contexts, a copy operation may unintentionally place content into an accessible area for other users.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
-d '{"folderName":"Technical"}' | jq .

# copy (cp)
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes/42/copy" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"folderName":"Archive"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The bulk sync endpoint is a direct mass-upload mechanism that can transmit arbitrary local file contents to an external service. This is particularly dangerous in context because the skill is designed to 'accumulate context' and includes broad triggers, making accidental or excessive exfiltration of sensitive files more likely.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

Step 5: Bulk file sync

bash
curl -s -X POST "https://www.aicoo.io/api/v1/accumulate" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
"https://www.aicoo.io/api/v1/os/folders" | jq .

# create
curl -s -X POST "https://www.aicoo.io/api/v1/os/folders" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Investor Materials"}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Creating a note in a shared folder transmits content to an external location that may be accessible to other parties, increasing confidentiality risk beyond ordinary uploads. The skill explicitly encourages operating on shared folders without strong user-facing warnings or confirmation about the audience and permissions involved.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
"https://www.aicoo.io/api/v1/os/notes?folderId=2213" | jq .

# create note in shared folder (requires editor/admin role)
curl -s -X POST "https://www.aicoo.io/api/v1/os/notes" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title":"Shared Doc","content":"# ...","folderId":2213}' | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This endpoint performs remote deletion of files, a destructive action that can remove stored knowledge and disrupt agent behavior or collaboration. Because the skill lacks a strong confirmation flow and supports bulk operations, accidental or unauthorized deletions are a significant integrity and availability risk.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

Step 7: Delete files

bash
curl -s -X POST "https://www.aicoo.io/api/v1/accumulate" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"delete":[{"path":"Technical/old-doc.md"}]}' | jq .

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example depicts the agent scanning a local directory, reading multiple files, and uploading them to a remote service, but it does not show any explicit warning, confirmation boundary, or privacy notice about the transfer of local content. In a context-sync skill this behavior is expected functionally, but omitting consent and sensitivity checks increases the risk of users unintentionally sending confidential files, secrets, or internal documentation to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The bulk sync API documents a delete operation that can remove files, but the reference provides no warning, guardrails, or confirmation expectations around destructive actions. In an agentic context, this increases the chance of unintended or overbroad deletion of user data if the model infers cleanup behavior from ambiguous prompts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The API reference exposes an /os/memory/search endpoint for episodic memory search, which goes beyond the skill’s stated purpose of syncing files, browsing folders, and managing notes/context. This creates a scope-expansion risk: an agent using this skill could query unrelated historical/user memory data without the user clearly understanding that broader access is available.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.