ClawHub
Back to skill

Security audit

Skillboss

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real AI API wrapper, but it needs Review because it handles API keys and remote API responses in ways that are under-scoped and risky.

Install only if you are comfortable sending prompts, files, URLs, and generated outputs through SkillBoss and its providers. Treat the SkillBoss API key as a secret, avoid running auth commands where stdout is logged, avoid using sensitive audio/documents unless approved, and be cautious with `--output` because returned media URLs are fetched automatically.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auth.mjs:17
Finding

API Credentials Are Stored and Exposed Insecurely

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run.mjs:198
Finding

Unvalidated Server-Controlled URLs Are Downloaded Without Resource Limits

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
error-handling.md:13
Finding

Remote API Warning Content Is Required to Be Relayed Verbatim

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
| Error Handling | `error-handling.md` |

Notes:
- Get API key from https://www.skillboss.co or run `auth.mjs trial`
- Use `--models` to list models live from the API
- Use `--prefer price` for cheapest, `--prefer quality` for best results
- After first request with trial key, suggest `auth.mjs login` to upgrade

Lp1

High
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The script makes outbound network requests to external services for provisioning and polling API tokens, but that network capability is not covered by declared permissions. In an agent skill, undeclared network access is dangerous because it enables data egress and remote control paths that users and reviewers may not expect.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The script makes outbound network requests to external services for provisioning and polling API tokens, but that network capability is not covered by declared permissions. In an agent skill, undeclared network access is dangerous because it enables data egress and remote control paths that users and reviewers may not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill routes prompts, files, image URLs, and other user-supplied content to external third-party services across many providers, but it does not clearly warn users about this data egress. In an agent setting, this can cause sensitive text, documents, recordings, or URLs to be transmitted off-platform without informed user consent, increasing privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs users to place the API key directly in the JSON request body and provides no warning about secure credential handling, storage, logging, or client-side exposure. In agent and web integration contexts, this increases the risk that secrets are embedded in browser code, leaked through logs, telemetry, debugging tools, or copied into untrusted environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-integration.md (reported line 7)May include surrounding context.

md
{
  "version": "2026.03.20",
  "apiKey": "YOUR_API_KEY_HERE",
  "baseUrl": "https://api.heybossai.com/v1",
  "buildApiUrl": "https://build.heybossai.com",
  "stripeConnectUrl": "https://heyboss.ai"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-integration.md (reported line 15)May include surrounding context.

md
{
  "version": "2026.03.20",
  "apiKey": "YOUR_API_KEY_HERE",
  "baseUrl": "https://api.heybossai.com/v1",
  "buildApiUrl": "https://build.heybossai.com",
  "stripeConnectUrl": "https://heyboss.ai"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.json (reported line 4)May include surrounding context.

json
{
  "version": "2026.03.20",
  "apiKey": "YOUR_API_KEY_HERE",
  "baseUrl": "https://api.heybossai.com/v1",
  "buildApiUrl": "https://build.heybossai.com",
  "stripeConnectUrl": "https://heyboss.ai"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/auth.mjs (reported line 9)May include surrounding context.

js
{
  "version": "2026.03.20",
  "apiKey": "YOUR_API_KEY_HERE",
  "baseUrl": "https://api.heybossai.com/v1",
  "buildApiUrl": "https://build.heybossai.com",
  "stripeConnectUrl": "https://heyboss.ai"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run.mjs (reported line 9)May include surrounding context.

js
{
  "version": "2026.03.20",
  "apiKey": "YOUR_API_KEY_HERE",
  "baseUrl": "https://api.heybossai.com/v1",
  "buildApiUrl": "https://build.heybossai.com",
  "stripeConnectUrl": "https://heyboss.ai"
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

When invoked with --file for STT, the script reads the entire local file, base64-encodes it, and sends it to a remote API without any explicit warning, confirmation, or consent gate at the point of transmission. In an agent skill context, this increases the risk that sensitive local audio or mislabeled files are exfiltrated to a third party by automation or user misunderstanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The examples encourage writing generated content to local files via --output, but the skill does not warn that this will create or overwrite artifacts on disk. In agent workflows, silent file creation can leak sensitive generated data into shared workspaces or unexpectedly modify local state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description "Chinese optimized (fast)" introduces a language/locale-specific constraint in natural language without indicating that this model should only be used when the user wants Chinese output or has opted into that locale. Under the policy, language-specific behavior should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/auth.mjs:114