ClawHub
Back to skill

Security audit

Dialogflow Cx Agents

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it can delete and export Dialogflow CX agents without enough warning, scoping, or confirmation.

Review this skill before installing if it may run against production Dialogflow CX projects. Use least-privilege Google credentials, restrict allowed projects and locations, avoid giving delete/export permissions unless needed, and require manual confirmation plus backups before deleting or exporting agents.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/agents.py:17
Finding

Unpinned Python Dependencies Permit Unreviewed Package Versions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The documented DELETE endpoint enables irreversible deletion of Dialogflow CX agents, which is a high-risk destructive action if exposed through an agent skill without strong guardrails. In an AI-tooling context, parameter abuse or prompt-induced misuse could target arbitrary agent resource names and cause loss of production chatbot assets.

Content

Scanner excerpt · references/agents.md (reported line 42)May include surrounding context.

Delete Agent

text
DELETE /v3beta1/{name=projects/*/locations/*/agents/*}

Export Agent

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

List Agents

bash
curl -X GET \
  "https://dialogflow.googleapis.com/v3beta1/projects/${PROJECT_ID}/locations/${LOCATION}/agents" \
  -H "Authorization: Bearer ${TOKEN}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file includes a direct agent deletion command but provides no caution that the operation is destructive and may permanently remove a Dialogflow CX agent and its configuration. For markdown files, destructive behaviors that could affect user data or system integrity should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill metadata says it is for creating, listing, updating, and deleting agents, but the reference also documents export, restore, and validate operations. This expands the effective capability surface beyond the declared scope, which can enable unreviewed destructive or sensitive data-moving actions such as restoring arbitrary agent content or exporting agent configurations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The delete command performs an irreversible destructive action immediately on user-supplied input with no confirmation, dry-run, or safety interlock. In an agentic or automated context, this increases the chance of accidental or misrouted deletion of production Dialogflow agents, especially when resource names are passed through from other tools or prompts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description limits the skill to managing Dialogflow CX agents through create, list, update, and delete operations. This file also implements export_agent, which retrieves full agent content and writes it to a local file or reports a GCS URI, a materially different capability not described in the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The CLI hard-codes --language to default to en, which imposes a specific language choice when the user does not explicitly select one. This is a natural-language policy concern because the tool forces a locale/language default rather than requiring user choice or clear opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The Create Agent example sets defaultLanguageCode to en as the default behavior, and the document does not indicate that users may choose another language or that the skill is intentionally English-only. This can violate language/locale policy guidance when a specific language is imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest says the skill is for creating, listing, updating, and deleting chatbot agents. validate_agent adds a separate validation operation that is not mentioned in the declared description, creating a scope mismatch between stated and actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.