ClawHub
Back to skill

Security audit

aggclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its advertised ad-analysis purpose, but its material download flow gives too much trust to remote file URLs and names, so it should be reviewed before installation.

Use this only if you are comfortable sending ad-analysis prompts to AppGrowing/Youcloud. Prefer explicit commands such as /aggclaw or /agg_inspire, avoid confidential campaign data unless the vendor is approved, and treat the download feature cautiously: downloads should be constrained to a dedicated folder with URL and filename validation before broad use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:82
Finding

Unvalidated API download metadata enables server-side request forgery and arbitrary file writes

Content
View full analysis
0) - Save to a new folder named after the first `## ` heading of the analysis report (strip `## `, replace illegal chars `/ \ : * ? " < > |` with `_`); filename `{id}.{ext}` (ext from download_url, else response Content-Type) ``` ```powershell $enc = [uri]::EscapeDataString($sessionId) $resp = Invoke-RestMethod -Uri "https://ai-chat-global.youcloud.com/aichat/sessions/$enc/materials" -Headers @{Authorization="Bearer $env:YOUCLOUD_API_KEY"} -TimeoutSec 120 foreach ($m in $resp) { Invoke-WebRequest -Uri $m.download_url -OutFile "$folder\$($m.id).mp4" -TimeoutSec 180 } ``` ### Technical Analysis The Skill treats `download_url` and `id` values returned by the remote API as trusted data. No validation restricts `download_url` to HTTPS or to the documented AppGrowing CDN. Consequently, a malicious or compromised API response can instruct the Agent to request an arbitrary address. Depending on network access available to the host, this can produce server-side request forgery against loopback addresses, link-lo ...[truncated 2420 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The language policy forces unsupported languages into English or omits the language code without asking the user, which can cause the system to misinterpret user intent, return analysis in the wrong language, or silently translate content. In a skill that sends user prompts to an external service and persists session behavior, this can create consent, accuracy, and privacy issues because the user may not realize how their content is being processed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level metadata advertises ambiguous trigger keywords without constraints, which increases the chance the platform routes unrelated advertising conversations into this skill. Because the skill then directly calls a third-party endpoint with the user's input, ambiguous discovery metadata materially raises the risk of unintentional data sharing and unexpected tool activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill registers on very broad natural-language keywords like 'analyze creatives' and 'global campaigns', which are likely to appear in ordinary conversation and can invoke the skill unintentionally. In this context, accidental invocation can cause unsolicited transmission of user prompts to an external API and unexpected agent behavior, making this a real prompt-scope and privacy risk rather than just a UX issue.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The instruction to 'Call the API directly' and 'do not ask the user' for clarifying information delegates important scoping decisions to the skill and encourages autonomous submission of potentially incomplete or ambiguous user content to a third-party API. In this context, the danger is not arbitrary autonomy but reduced user control over what data is sent and increased likelihood of over-broad searches, mistaken mode selection, or privacy-impacting requests.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
1. **Check API Key** (above)
2. **Detect language + determine chat_mode** (above)
3. **Call the API directly** — do not ask the user for product positioning, target market, or other supplementary info; let the API search on its own:
   - New analysis → send `input` + `chat_mode` + `language_code`, no `session_id`
   - Follow-up → reuse `session_id`, omit `chat_mode`/`language_code` (preserve the session's mode & language)
   - Output `output`; translate if its language differs from the user's; save `session_id` for follow-ups

Static analysis

No suspicious patterns detected.