ClawHub
Back to skill

Security audit

Request Approval

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent approval-gating guide, but its setup docs include a risky unpinned MCP server command and some guidance that weakens approval requirements outside production.

Review the MCP setup before installing. Prefer direct HTTPS/SSE configuration or a pinned, purpose-specific Preloop MCP client, protect API tokens as secrets, and keep approval required for destructive or externally modifying actions even in dev and staging unless your organization has a clear policy exception.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
references/SETUP.md:17
Finding

Unpinned Package Automatically Downloaded and Executed as an MCP Server

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:80
Finding

Unpinned Global Installation of the Agent Skills Validation CLI

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/EXAMPLES.md (reported line 28)May include surrounding context.

md
- If denied: "Approval denied: Please verify the S3 backup first."

4. **Act on response**:
   - If approved: Execute `rm -rf logs/2024-01/` and confirm to user
   - If denied: Tell user "The deletion was cancelled because the approver wants to verify the S3 backup first. Would you like me to check if the backup exists?"

## Example 2: Creating a Pull Request

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
- ❌ Be vague
- ❌ Bundle multiple operations
- ❌ Proceed if denied
- ❌ Skip approval because you think it's "probably fine"

## Additional Resources

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The example explicitly allows the agent to decide on its own to skip human approval in dev/staging environments. Even outside production, actions like deletion, dependency installation, or config changes can still be destructive or externally impactful, so embedding environment-based approval bypass logic creates a real autonomous-decision pathway.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 133)May include surrounding context.

md
2. **Conditional logic**:
   - If production: Call `request_approval` (as shown above)
   - If dev/staging: Proceed directly without approval

3. **Tell the user**:
   - Production: "I've requested approval for this operation. Waiting for response..."

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

This text reinforces a norm that the agent may proceed 'without approval' solely because it believes the environment is non-production. That can be abused through environment misclassification or by normalizing bypass of human review for risky operations, undermining the purpose of the approval control.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 137)May include surrounding context.

md
3. **Tell the user**:
   - Production: "I've requested approval for this operation. Waiting for response..."
   - Dev/Staging: "This is a development environment, so I'm proceeding directly without approval."

## Example 7: Bulk File Operations

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation instructs users to place a bearer API token directly in configuration JSON but does not warn that the token is sensitive, should be kept out of source control, and should preferably be sourced from a secret store or environment variable. In practice, users often copy such examples into tracked config files, which can leak credentials and enable unauthorized access to the Preloop instance.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/SETUP.md (reported line 136)May include surrounding context.

md
- Check that the token has the correct permissions
- Ensure the token is included in the headers correctly

### No Approval Policy

**Problem**: "No default approval policy found"

Static analysis

No suspicious patterns detected.