ClawHub
Back to skill

Security audit

plori

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently connects your agent to Plori’s cloud workers, with disclosed costs, persistent files, and human approval controls.

Use the hosted MCP connection if you do not need the CLI; otherwise review and pin installation code. Share only data you may send to Plori and its AI providers. Set spending and runtime limits, keep external actions and deletion under human control, and clear authentication when disconnecting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The Unix command pipes a mutable remote script directly into a shell, and the Windows alternative similarly evaluates downloaded code immediately. Compromise of the distribution endpoint or installer could execute arbitrary code with the invoking user's permissions, exposing local credentials and files; HTTPS does not establish that the downloaded code is safe.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
### CLI and REST

CLI: `curl -fsSL https://plori.ai/install.sh | sh` (Windows: `irm https://plori.ai/install.ps1 | iex`),
`npm i -g @plori/cli`, or `npx -y @plori/cli`. The shell installer writes to
`~/.local/bin` and edits no rc file, so run `export PATH="$HOME/.local/bin:$PATH"` first.
`plori login` signs in through the browser; headless callers use

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
If this client already lists Plori tools and `list_workspaces` answers, skip this section.

MCP: Streamable HTTP at `https://api.plori.ai/mcp`.

- OAuth 2.1: an unauthenticated request returns 401 with the discovery chain (RFC 9728
  metadata at https://api.plori.ai/.well-known/oauth-protected-resource, dynamic client

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
MCP: Streamable HTTP at `https://api.plori.ai/mcp`.

- OAuth 2.1: an unauthenticated request returns 401 with the discovery chain (RFC 9728
  metadata at https://api.plori.ai/.well-known/oauth-protected-resource, dynamic client
  registration, authorization code + PKCE). The account owner signs in with an email code.
- API key: the account owner creates one at https://plori.ai. Send
  `Authorization: Bearer plori_sk_...`.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
`list_workspaces`.

1. Check the current MCP configuration and active tools. Reuse an existing Plori server
   at `https://api.plori.ai/mcp`; do not add duplicate entries or replace a different
   server with the same name. If missing, configure it once with
   `claude mcp add --transport http plori https://api.plori.ai/mcp`.
   Confirm the server is available in this conversation before authenticating. Saving

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
`plori login --key plori_sk_...` or set `PLORI_API_KEY`. Piped output and `--json` give
JSON.

REST: `https://api.plori.ai/v1` with the same bearer token. Detail: https://plori.ai/auth.md

## Tools

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
1. Check the current MCP configuration and active tools. Reuse an existing Plori server
   at `https://api.plori.ai/mcp`; do not add duplicate entries or replace a different
   server with the same name. If missing, configure it once with
   `claude mcp add --transport http plori https://api.plori.ai/mcp`.
   Confirm the server is available in this conversation before authenticating. Saving
   configuration alone does not prove that it loaded. If its tools are missing, ask
   the user to type `/reload-plugins` in this Claude Code conversation, then resume

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
authorization URL intact. Do not construct a new OAuth request or change its state,
   redirect URI, or PKCE challenge.
3. POST JSON `{"authorization_url":"<the exact client URL>"}` once to
   `https://api.plori.ai/oauth/pair`. The response contains `user_code`,
   `verification_uri`, `verification_uri_complete`, `device_code`,
   `expires_in` (seconds), and `interval` (seconds). Keep `device_code` private.
   If a permission rule, hook, or tool denies this request, stop and use the fallback below.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
4. Tell the user: "Open <verification_uri> and enter <user_code>. Sign in and approve
   the connection; I will continue when you finish." The user can open the page on
   their phone. Display the short address and code, not the authorization or callback
   URL. Do not ask the user to copy a callback URL into chat.
5. Poll `https://api.plori.ai/oauth/pair/poll` with JSON
   `{"device_code":"<device_code>"}`. Keep only one request in flight, allow each
   request at least 30 seconds to finish, and wait at least `interval` seconds

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
the connection; I will continue when you finish." The user can open the page on
   their phone. Display the short address and code, not the authorization or callback
   URL. Do not ask the user to copy a callback URL into chat.
5. Poll `https://api.plori.ai/oauth/pair/poll` with JSON
   `{"device_code":"<device_code>"}`. Keep only one request in flight, allow each
   request at least 30 seconds to finish, and wait at least `interval` seconds
   between requests. The server can hold a pending request for 25 seconds.

MCP server referenced without pinned version: 'npx -y @plori/cli'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The command npx -y @plori/cli downloads and executes an unpinned package without an installation confirmation. A compromised or malicious future release could execute with the agent's local permissions and access local files or credentials; this concerns the CLI package, not the remotely hosted MCP server as the static finding suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.