ClawHub
Back to skill

Security audit

QA API Tester

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent API testing helper, but it can run authenticated write/delete requests and concurrent traffic without enough safeguards, so users should review it before installing.

Install only if you are comfortable with the agent generating and potentially running API calls. Use scoped test tokens, approved non-production endpoints, disposable data, and explicit confirmation before POST/PUT/PATCH/DELETE or concurrent request checks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Chaining Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The xargs -P 10 pipeline enables automated concurrent request fan-out, which can be repurposed for service stress or abuse with minimal modification. In an agent skill that may be executed directly, this makes high-rate request chaining more dangerous than a simple single-request example, especially if pointed at production or third-party systems.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

done

Concurrent requests (requires GNU parallel or xargs)

seq 1 50 | xargs -P 10 -I {} curl -s -o /dev/null -w "{}: %{http_code} %{time_total}s\n"
"https://api.example.com/health"

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The examples send Authorization headers and request bodies to external endpoints without warning that secrets and business data will be transmitted off-host. In an automation skill, users may paste real tokens or sensitive payloads, leading to unintended disclosure to third-party or production services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
# GET
curl -s -w "\n%{http_code} %{time_total}s" \
  -H "Authorization: Bearer $TOKEN" \
  "https://api.example.com/users/1" | jq .

# POST with JSON body
curl -s -X POST \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
# GET
curl -s -w "\n%{http_code} %{time_total}s" \
  -H "Authorization: Bearer $TOKEN" \
  "https://api.example.com/users/1" | jq .

# POST with JSON body
curl -s -X POST \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md
# GET
curl -s -w "\n%{http_code} %{time_total}s" \
  -H "Authorization: Bearer $TOKEN" \
  "https://api.example.com/users/1" | jq .

# POST with JSON body
curl -s -X POST \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
# GET
curl -s -w "\n%{http_code} %{time_total}s" \
  -H "Authorization: Bearer $TOKEN" \
  "https://api.example.com/users/1" | jq .

# POST with JSON body
curl -s -X POST \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
"https://api.example.com/users/1" | jq .

# POST with JSON body
curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name":"test","email":"test@example.com"}' \

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
assert resp.status_code == 404

    def test_create_user_success(self, auth_headers):
        """TC003: Create user with valid data"""
        payload = {"name": "Test User", "email": "test@example.com"}
        resp = requests.post(f"{BASE_URL}/users", json=payload, headers=auth_headers)
        assert resp.status_code == 201

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
def test_create_user_success(self, auth_headers):
        """TC003: Create user with valid data"""
        payload = {"name": "Test User", "email": "test@example.com"}
        resp = requests.post(f"{BASE_URL}/users", json=payload, headers=auth_headers)
        assert resp.status_code == 201
        data = resp.json()
        assert data["name"] == payload["name"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
def test_create_user_success(self, auth_headers):
        """TC003: Create user with valid data"""
        payload = {"name": "Test User", "email": "test@example.com"}
        resp = requests.post(f"{BASE_URL}/users", json=payload, headers=auth_headers)
        assert resp.status_code == 201
        data = resp.json()
        assert data["name"] == payload["name"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
def test_create_user_success(self, auth_headers):
        """TC003: Create user with valid data"""
        payload = {"name": "Test User", "email": "test@example.com"}
        resp = requests.post(f"{BASE_URL}/users", json=payload, headers=auth_headers)
        assert resp.status_code == 201
        data = resp.json()
        assert data["name"] == payload["name"]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The CRUD workflow includes create, update, and delete operations but does not warn that executing generated tests can modify or remove real data. In an agent setting, this raises the risk of accidental destructive actions against staging or production systems when users or the model reuse examples without isolation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
def test_full_crud_flow(self):
        # Step 1: Login
        resp = requests.post(f"{BASE_URL}/auth/login",
                           json={"username": "admin", "password": "pass"})
        assert resp.status_code == 200
        token = resp.json()["token"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
assert get_resp.json()["name"] == "E2E Test"

        # Step 4: Update
        update = requests.put(f"{BASE_URL}/users/{user_id}",
                            json={"name": "Updated"}, headers=headers)
        assert update.status_code == 200

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill says not to use it for load testing at scale, but later provides concurrent request guidance using xargs -P 10 and repeated curls. That contradiction can encourage operators to run ad hoc stress activity against real endpoints without safeguards, potentially causing service degradation or violating usage expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.