ClawHub
Back to skill

Security audit

authz-code-design

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local credential-broker skill, but it needs Review because it handles vault secrets and exposes its dashboard PIN in URL and console output.

Review before installing if you plan to use real credentials. Treat the included broker as a prototype: remove PINs from URLs and startup output, prefer header or session-based local authentication, keep it bound to 127.0.0.1, use an isolated environment, and protect the audit log because it records credential titles, scopes, devices, and activity metadata.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The code advertises that sensitive configuration is not logged, but startup prints the dashboard URL with the PIN embedded in cleartext. Console output is commonly captured by terminal scrollback, shell history copies, process supervisors, CI logs, or remote session recording, so this exposes the broker’s authentication secret and undermines the localhost trust boundary.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
Allowing the dashboard PIN in the URL query string weakens the intended authentication model because query parameters are easily exposed through browser history, bookmarks, copy/paste, crash reports, proxy logs, and screen captures. Even on 127.0.0.1, localhost services are frequently accessed via a browser, making this skill context more dangerous because the broker protects credential inventory and active authorization state.

Static analysis

No suspicious patterns detected.