ClawHub
Back to skill

Security audit

zambo-receipts

Security checks for vulnerabilities and agentic risk

Overview

The skill performs disclosed, read-only receipt checks with access proportionate to its purpose.

Keep secrets out of Zambo tool arguments because receipts may be public. Treat verification as a consistency check: [Zambo’s verifier](https://zambo.dev/verify/) states that matching hashes do not authenticate the issuer. AER-1 is an [individual Internet-Draft](https://datatracker.ietf.org/doc/draft-zambo-aer1/), not an IETF-endorsed standard. The Python sample also needs its JSON parsing corrected before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
## Gotchas

- **Hash the exact output text.** The digest covers the raw output string. Normalize nothing (no trimming, no re-encoding) before hashing.
- **Receipts are public and shareable.** `https://zambo.dev/run/<id>` is designed to be linked in posts, reports, and PRs. Never put secrets in tool arguments; they may appear in shared receipts.
- **Use the right words.** Never call a receipt "signed". The correct phrase is **verifiable receipt**.
- **Missing receipt = incomplete response.** If a response has no `_receipt`, treat the result as unrecorded and say so.