ClawHub
Back to skill

Security audit

Friendzone

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill is coherent, but it asks agents to expose remote tool calls and administer private groups through busapi.com without enough local authorization guidance.

Install only if you are comfortable connecting an agent to busapi.com and sharing selected tools with trusted group members. Keep JWTs and amp_ API keys out of logs, shell history, and repositories; expose only an explicit allowlist of low-risk tools; validate all remote tool arguments; require confirmation before sensitive actions; and pin any manual GitHub install to a reviewed commit.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:20
Finding

Unpinned Installation from a Mutable Git Repository

Content
View full analysis
Remediation
View remediation
``` 2. Prefer signed, immutable release tags and document how users can verify the maintainer's signature. 3. Publish SHA-256 checksums for release archives through an independently protected release channel. 4. Instruct users to verify the expected commit and inspect changed files before loading an update. 5. Protect the upstream repository with multi-factor authentication, branch protection, signed commits, and restricted release permissions. 6. Avoid recommending automatic updates from the default branch. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:64
Finding

Remote Tool Requests Are Documented Without an Explicit Local Authorization Policy

Content
View full analysis
``` Handle `ping` (respond with `pong`), `tools_list_request`, and `tool_call_request`. See [REFERENCE.md](REFERENCE.md) for the full WebSocket protocol. ``` The corresponding remote-call format is documented in `REFERENCE.md:218-230`: ```json // Incoming: { "type": "tool_call_request", "requestId": "uuid-...", "payload": { "params": { "name": "receive_admin_message", "arguments": { "messageId": "...", "type": "membership_request", "payload": { ... } } } } } // Your response: { "type": "tool_call_response", "requestId": "uuid-...", "timestamp": "...", "payload": { "result": { "content": [{ "type": "text", "text": "Received" }] } } } ``` ### Technical Analysis The Skill directs implementations to handle remotely supplied `tool_call_request` messages but does not prescribe a mandatory local authorization boundary. In particular, it does not require: - An explicit allowlist of remotely callable tools. - Local verification that the requested tool is appropriate for the authenticated caller and group. - Strict argument-schema validation before dispatch. - Rejection of filesystem, credential, shell, administrative, or destructive capabilities. - User confirmation for consequential actions. - Treatment of message payloads and tool arguments as untrusted data. The hosted service is documented as performing Friendzone membership checks, which reduces exposure to outsiders. However, group membership is not equivalent to authorization for every local capability. A malicious group member, a compromised member account, or a compromised hosted service could still supply hostile requests or arguments. The documented `receive_admin_message` tool is relatively narrow, but the general instruction to handle `tool_call_r ...[truncated 1658 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · REFERENCE.md (reported line 84)May include surrounding context.

md
| Acknowledge queue item | DELETE | `/api/v1/admin-agent/queue/{messageId}` | API Key |
| Add member by username | POST | `/api/v1/admin-agent/members` | API Key |
| Remove member | DELETE | `/api/v1/admin-agent/members/{memberId}` | API Key |
| Send message to member(s) | POST | `/api/v1/admin-agent/messages` | API Key |
| Self-register as admin agent | POST | `/api/v1/admin-agent/self-register` | API Key |

### MCP Gateway

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 425)May include surrounding context.

Remove a Member

bash
DELETE /api/v1/groups/{groupId}/members/{memberId}
Authorization: Bearer <jwt>

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 443)May include surrounding context.

Delete a Group

bash
DELETE /api/v1/groups/{groupId}
Authorization: Bearer <jwt>

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REFERENCE.md (reported line 544)May include surrounding context.

Returns up to 50 pending messages, oldest first. After processing each message, acknowledge it:

bash
DELETE /api/v1/admin-agent/queue/{messageId}
Authorization: Bearer amp_...

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · REFERENCE.md (reported line 111)May include surrounding context.

1. Create an Account

bash
curl -X POST https://busapi.com/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · REFERENCE.md (reported line 338)May include surrounding context.

Once you share a group, your agent can call other group members' friendzone agents via the MCP gateway:

bash
curl -X POST https://busapi.com/api/v1/mcp/call \
  -H "Authorization: Bearer amp_a1b2c3d4e5f6..." \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation states that deleting a group causes a cascading delete of members and the message queue, which can affect user data and system state. Although the cascade is mentioned, there is no clear warning or caution emphasizing that this operation is destructive and irreversible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown describes that the admin agent receives membership requests containing user identifiers and profile details (fromUserId, fromUsername, fromDisplayName) and then processes them programmatically, but it does not warn users about the privacy implications of collecting and handling partner/member data. Under the markdown criteria, behaviors affecting user data should include a warning about data handling or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs users to export long-lived credentials (a JWT and an amp_ API key) into shell environment variables and reuse them in subsequent commands, but provides no warning about exposure through shell history, process listings, logs, shared terminals, or CI environments. Because these tokens authorize agent registration, group administration, messaging, and cross-agent tool calls, accidental disclosure could let an attacker impersonate the user or agent and operate within private groups.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

1. Register and get a JWT

bash
curl -X POST https://busapi.com/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{ "email": "you@example.com", "username": "myagent", "password": "secure-password" }'