ClawHub
Back to skill

Security audit

Mirofish

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an offline forecasting guide, but its optional live-backend path can upload user files and inspect backend secrets without enough safeguards.

Use the offline mode freely for planning and forecasting drafts. Treat live backend mode as a review-needed path: confirm the exact backend URL, avoid uploading confidential seed files unless the destination is trusted, do not expose .env secret values, and require explicit confirmation before any reset, delete, force, or log-clearing operation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/runtime-contract.md:20
Finding

Sensitive Backend Configuration Inspection May Expose API Credentials

Content
View full analysis

Vulnerability Details

File Location: references/runtime-contract.md, lines 20-29
Vulnerability Type: Sensitive credential access without sufficient safeguards
Risk Level: Medium

Vulnerable Code Snippet

text
## Authentication

The repository routes shown in this skill do not define a request-level API token.

The backend itself requires server-side environment variables:

- `LLM_API_KEY`
- `LLM_BASE_URL`
- `LLM_MODEL_NAME`
- `ZEP_API_KEY`

If requests fail with configuration errors, do not add client auth headers. Check the backend `.env`.

A related recovery instruction appears at line 137:

text
- check `ZEP_API_KEY`

Technical Analysis

The live-backend troubleshooting workflow instructs the agent to check the backend .env file when configuration errors occur. Environment files commonly contain plaintext credentials and unrelated secrets. The instructions do not limit the operation to checking whether specific variables are present, require explicit operator authorization, or prohibit displaying secret values.

An agent following this guidance could read the complete file and place LLM_API_KEY, ZEP_API_KEY, or other credentials into its context, execution logs, tool results, or user-facing output. Accessing the values is unnecessary when a presence-only or redacted configuration check would be sufficient.

Attack Path

  1. A user requests optional live backend execution.
  2. The backend returns a configuration error, or graph construction fails because a required variable is missing.
  3. The agent follows the runtime contract and opens the backend .env file.
  4. The file exposes API keys and potentially other service credentials to the agent context.
  5. The values may subsequently appear in diagnostic output, transcripts, telemetry, or generated troubleshooting instructions.
  6. Anyone with access to those channels could reuse the credentials against the associated services.

Impact Assessment

Successful ex ...[truncated 523 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the instruction to inspect .env with a presence-only diagnostic procedure.
  • Require explicit operator approval before accessing any server-side configuration file.
  • Prohibit agents from reading, logging, returning, or retaining secret values.
  • Recommend a redacted command or administrative health check that reports only whether required variables are configured.
  • Restrict checks to an allowlist such as LLM_API_KEY, LLM_BASE_URL, LLM_MODEL_NAME, and ZEP_API_KEY.
  • Ensure diagnostic output uses fixed redaction, such as LLM_API_KEY=[SET], rather than partial secret values.
  • Store credentials in a dedicated secret manager rather than a broadly readable plaintext environment file.
  • Apply least-privilege permissions to every backend credential and rotate any credential exposed to agent context or logs.

T09 · Insecure Skill Coding Practices

Warning
Location
references/runtime-contract.md:5
Finding

Unvalidated Backend Destination Can Receive Sensitive Seed Files

Content
View full analysis

Vulnerability Details

File Location: references/runtime-contract.md, lines 5-14 and 31-45
Vulnerability Type: Unvalidated external destination and potentially plaintext file transmission
Risk Level: Medium

Vulnerable Code Snippet

text
## Backend URL

Use `MIROFISH_BASE_URL` when provided. Otherwise default to:

```text
http://localhost:5001

Do not hardcode the backend URL in generated scripts. Set:

bash
BASE_URL="${MIROFISH_BASE_URL:-http://localhost:5001}"
text

The destination is subsequently used for multipart file ingestion:

```text
## File Ingestion

Ontology generation uses multipart form data.

Accepted file extensions:

- `pdf`
- `md`
- `txt`
- `markdown`

Maximum upload size is 50 MB.

Required form fields:

- `files`
- `simulation_requirement`

Optional form fields:

- `project_name`
- `additional_context`

Technical Analysis

The runtime contract accepts MIROFISH_BASE_URL as the backend destination but does not require origin validation, HTTPS for remote hosts, or user confirmation before uploading files. The shell assignment safely quotes the value and is not itself a command-injection vulnerability; the risk arises from trusting the resolved network destination.

If an attacker can control the environment variable or influence runtime configuration, the agent may upload seed documents, simulation requirements, project names, and additional context to an attacker-controlled endpoint. These materials may contain unpublished policy drafts, financial information, personal data, or confidential business content.

The default loopback destination is appropriate for a local backend. The exposure occurs when an untrusted or incorrectly configured non-local URL overrides that default, especially when plaintext HTTP is used.

Attack Path

  1. An attacker, compromised launcher, or misconfigured environment sets MIROFISH_BASE_URL to an attacker-controlled host.
  2. The user requests live MiroFish execution a ...[truncated 936 chars]
Remediation
View remediation

Remediation Suggestions

  • Resolve and display the final backend origin before transmitting any files.
  • Require explicit user approval whenever the destination is not a loopback address or a preapproved host.
  • Enforce HTTPS for all non-loopback destinations and reject invalid certificates.
  • Maintain an allowlist of trusted schemes, hosts, and ports.
  • Reject URLs containing embedded credentials, unexpected redirects, unsupported schemes, or suspicious internal-network destinations.
  • Revalidate every redirect target and do not forward uploaded files across origins automatically.
  • Show the user an upload manifest containing the destination, filenames, sizes, and transmitted form fields.
  • Minimize uploaded content and remove secrets or unnecessary metadata before transmission.
  • Document that MIROFISH_BASE_URL is a security-sensitive configuration value and must not be accepted from untrusted project content.
  • Consider requiring a pinned backend identity or administrator-managed configuration for deployments that handle confidential documents.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (16)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 13)May include surrounding context.

md
- `GET /api/graph/task/<task_id>`
- `GET /api/graph/tasks`
- `GET /api/graph/data/<graph_id>`
- `DELETE /api/graph/delete/<graph_id>`

## Simulation

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 54)May include surrounding context.

md
- `GET /api/report/by-simulation/<simulation_id>`
- `GET /api/report/list`
- `GET /api/report/<report_id>/download`
- `DELETE /api/report/<report_id>`
- `POST /api/report/chat`
- `GET /api/report/<report_id>/progress`
- `GET /api/report/<report_id>/sections`

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-surface.md (reported line 1)May include surrounding context.

md
# MiroFish Workflow Map

## Distilled workflow

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/output-patterns.md (reported line 1)May include surrounding context.

md
# MiroFish Workflow Map

## Distilled workflow

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/runtime-contract.md (reported line 1)May include surrounding context.

md
# MiroFish Workflow Map

## Distilled workflow

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/workflow-map.md (reported line 1)May include surrounding context.

md
# MiroFish Workflow Map

## Distilled workflow

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill’s invocation guidance is broad enough that it can be triggered by many generic requests involving analysis, forecasting, planning, or report generation. That increases the chance of unintended activation, causing the agent to apply this workflow when the user did not ask for it and potentially overriding more appropriate, narrower skills or producing speculative outputs presented with undue structure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documented API surface materially exceeds the skill's stated offline, content-generation purpose by exposing remote graph, simulation, and report management operations. This capability mismatch can mislead users and reviewers about what the skill may access or control, increasing the risk of unexpected networked actions, data handling, and broader system interaction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The API reference includes reset and delete functionality for graph resources even though the skill is described as a workflow-building assistant, not an administrative or destructive tool. This discrepancy can enable accidental or unauthorized destructive actions against project data if downstream tooling exposes these endpoints without clear controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Destructive reset and delete endpoints are listed without any indication that they may erase data or require extra care. Even in documentation-only form, missing warnings and safety notes increase the likelihood of operator error, accidental data loss, and unsafe integration by downstream agents or users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Runtime control endpoints such as start, stop, environment status, and close-env extend the skill from offline artifact generation into active environment orchestration. In context, this is more dangerous because the manifest frames the skill as offline and non-backend-dependent, which can conceal operational authority over simulations and environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The report deletion endpoint is presented without warning that reports may be permanently removed. In a skill that ostensibly produces forecast briefs and related artifacts, undocumented deletion behavior creates a tangible risk of losing outputs that users expect to preserve.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Chat, search, statistics, and live log streaming significantly expand the report subsystem beyond simple report generation and retrieval. These features may expose internal execution details, user data, or interactive tool behavior that is not described in the skill purpose, increasing the chance of unintended disclosure or misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file directs operators to use a live backend and provides a default network endpoint even though the skill is described as offline. This creates a trust-boundary mismatch: a user may unintentionally send data to a running service, causing unexpected network access, leakage of uploaded material, or execution against a local service the user did not intend to use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The contract documents dependency on backend credentials and HTTP endpoints that are unnecessary for a purely offline workflow. In practice this can normalize use of privileged environment-backed services and encourage operators to troubleshoot against real infrastructure, increasing the risk of exposing sensitive source documents or interacting with configured secrets unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document enumerates live backend API stages and frames them as available execution paths, but it does not warn that using those stages may transmit repository, simulation, report, or interview data to external services. In a skill intended for offline prediction workflows, this omission can mislead downstream agents or users into sending sensitive material to backend endpoints without informed consent or clear data-handling boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.