ClawHub
Back to skill

Security audit

Skillboss

Security checks for vulnerabilities and agentic risk

Overview

SkillBoss mostly matches its app and AI gateway purpose, but it uses broad local and remote authority with credential persistence and an automatic updater path that can run an uninspected shell script.

Install only if you are comfortable with a Bash-based gateway that sends prompts, files, deployment bundles, emails/SMS requests, product changes, and payment setup requests to SkillBoss/HeyBoss services. Keep API keys out of client-side code and public repositories, review any install/update.sh before allowing updates, and use the deployment/product/email/SMS commands only for projects and recipients you explicitly intend to modify or contact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (146)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The description presents a very broad fullstack application platform with deployment, databases, payments, auth, and serverless/webhook features. The supplied code chunk instead implements a command-line multi-provider API client/hub focused on AI/media, search/scraping, documents, email, and SMS verification. That overlap is real for AI generation, email, presentations, scraping/search, document parsing, and SMS verification, but major declared capabilities such as Cloudflare deployment, DB integrations, Stripe, and general auth are not evidenced here. More importantly, the code includes an undeclared capability: contacting a remote service to check versions and automatically running a local update shell script (install/update.sh) via execSync, which is materially different from the declared gateway description. Because the code's actual behavior is narrower in some areas and includes undeclared self-update/script execution behavior, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied code chunk only provides chat-completion request preparation and dispatch. It accepts chat-related parameters, constructs a messages array, optionally sets system/max_tokens/temperature, and calls run(). Nothing in this snippet implements or directly interfaces with deployment, databases, payments, auth, media generation, communications, scraping, document processing, or serverless/webhook features described in the declaration. While the declared description could refer to a larger skill, this specific code chunk materially underdelivers relative to that broad stated purpose and instead has a much narrower primary behavior: chat completion orchestration.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description claims a comprehensive gateway/platform with many major capabilities across app deployment, databases, payments, authentication, AI generation, scraping, parsing, messaging, and APIs. The actual code shown only provides fetch retry logic for transient network failures and rate limiting. While this helper could support such a platform internally, the chunk itself does not implement or expose those declared capabilities. This is a material description-to-code mismatch in primary purpose, not merely an omitted implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a very broad platform/gateway for fullstack app development and many service integrations. The supplied code chunk is much narrower and has a different concrete purpose: a command-line product manager for an e-commerce/shopping backend. It performs CRUD operations on products through /api/shopping-service/admin-products endpoints and relies on local configuration files plus an API key for authorization. This is a materially different primary behavior from the declared purpose. While product management could loosely relate to ecommerce, the description does not accurately represent this code chunk's actual functionality, and most declared capabilities are absent from the code shown.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This code chunk does not implement or expose any of the major capabilities described. It only configures CSS tooling for a worker ecommerce template. While such configuration could be a minor supporting detail within a larger fullstack project, the supplied code itself is narrowly focused and does not accurately represent the declared broad gateway functionality. Therefore, for this chunk, the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The supplied code chunk does not implement or expose the broad gateway functionality described. It is فقط a Tailwind configuration file for scanning HTML/React source files and setting theme/plugins. While a Tailwind config could be a supporting detail inside a larger ecommerce template, this specific chunk’s actual behavior is narrowly focused on CSS tooling and does not substantively match the declared primary purpose of a multi-capability fullstack/AI gateway. Therefore, the description materially overstates what this code chunk does.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
node ./scripts/api-hub.js version

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
node ./scripts/api-hub.js version

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The documentation instructs developers to read an API key from local credential files and integrate it directly into app code. In the context of public-facing apps, this creates a serious risk that the secret will be embedded in client-side code, exposed to users, or reused insecurely, enabling unauthorized API use and billing abuse.

Content

Scanner excerpt · api-integration.md (reported line 19)May include surrounding context.

md
**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `Authorization: Bearer <your-api-key>`
**API Key:** Read from `~/.config/skillboss/credentials.json` -> `api_key` field, or `skillboss/config.json` -> `apiKey` field

## Code Examples (TypeScript/JavaScript)

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The example shows assigning the API key into application code from local credentials/config and then using it in Authorization headers. In a skill focused on helping build apps, developers may copy this pattern into frontend code, leaking the credential to end users and enabling account takeover of API usage, data access through the API, and cost theft.

Content

Scanner excerpt · api-integration.md (reported line 25)May include surrounding context.

typescript
// Read API key from credentials file or config.json
const API_KEY = '<your-api-key>' // from ~/.config/skillboss/credentials.json or config.json
const API_BASE = 'https://api.heybossai.com/v1'

// ============================================================================

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Telling users that keys are auto-saved to predictable local file paths increases the chance those secrets are mishandled, copied into code, or accidentally committed. In combination with the rest of the document's integration guidance, this makes insecure secret handling more likely for less experienced developers.

Content

Scanner excerpt · api-integration.md (reported line 367)May include surrounding context.

md
## Setup Steps

1. Run `./scripts/skillboss auth trial` or `./scripts/skillboss auth login` to get an API key
2. The key is auto-saved to `~/.config/skillboss/credentials.json` and `config.json`
3. Use the code patterns above, adjusting for your specific model

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · extensions/remotion/rules/maps.md (reported line 41)May include surrounding context.

pnpm i mapbox-gl @turf/turf @types/mapbox-gl

text

The user needs to create a free Mapbox account and create an access token by visiting https://console.mapbox.com/account/access-tokens/.

The mapbox token needs to be added to the `.env` file:

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The file explicitly instructs placement of an access token in .env without any safeguards or caveats. Although Mapbox public tokens are often intended for client use, presenting it generically as a secret-bearing env var can mislead users into unsafe handling and accidental disclosure through commits, logs, or build output.

Content

Scanner excerpt · extensions/remotion/rules/maps.md (reported line 45)May include surrounding context.

The mapbox token needs to be added to the .env file:

txt
REMOTION_MAPBOX_TOKEN==pk.your-mapbox-access-token

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script performs a network version check and then automatically executes a local shell updater via execSync with no integrity verification, explicit opt-in, or trust boundary hardening. That creates a software supply-chain and arbitrary code-execution path: if the update source, local update script, or install directory is tampered with, running ordinary CLI commands can trigger unintended code execution.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/api-hub.js:804

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/stripe-connect.js:112

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/lib/client.js:112