ClawHub
Back to skill

Security audit

Agent Causal

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent analytics purpose, but it asks users to install unverified remote code and under-documents its network-facing modes.

Review before installing. Prefer a pinned, checksummed release or isolated environment, avoid the mutable git clone install path, use read-only PostHog tokens, and do not expose the HTTP mode beyond localhost without your own authentication and transport controls.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding

Integrity-Unverified Remote Code Retrieval and Installation

Content
View full analysis
Remediation
View remediation
agent-causal.tar.gz" | sha256sum --check --strict ``` 3. Abort installation if download or integrity verification fails. Avoid `curl -s` because it suppresses useful diagnostics; use `--fail --show-error`. 4. Sign release artifacts and verify signatures against a documented, independently distributed maintainer key. 5. Remove the mutable default-branch installation path. If Git is required, check out and verify an immutable commit identifier before installation. 6. Pin all transitive Python dependencies and use hash verification, such as a locked requirements file with `pip --require-hashes`. 7. Align the Skill metadata version, release archive version, local source version, and documented schema version. 8. Perform installation in an isolated virtual environment or container using a non-privileged account. Do not run `pip install` with `sudo`. 9. Include the connector implementation in the audited artifact and test that PostHog credentials are neither logged nor transmitted to hosts other than the explicitly configured PostHog instance. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description materially understates the skill's capabilities by omitting local SQLite persistence and history retrieval. This can mislead operators and downstream policy engines into treating the tool as stateless when it actually stores experiment results, which may include sensitive business metrics, audit data, or connector-derived metadata.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The security model claims the tool performs only local statistical calculations and implies no network exposure during normal use, but the same document later exposes HTTP server and external connector functionality. This inconsistency can cause users or orchestrators to grant the skill broader trust than warranted, increasing the chance that network-facing features are enabled without appropriate controls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill reads long-lived credentials from environment variables or a persistent ~/.posthogrc file, creating a local secret persistence surface that is only lightly documented. In multi-user or shared agent environments, weak file permissions, accidental inclusion in backups, or later compromise of the host could expose the PostHog API key and associated project access.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
**No runtime network access during analysis.** The decision engine, audit, and cohort analysis do not make outbound requests.
**Tools used:** `exec` (for running the `agent-causal` CLI commands you specify). Commands are fully hardcoded with no user-supplied strings interpolated into shell execution.
**PostHog token scope:** Use a read-only API token with minimal scopes. Do not use tokens with write or admin permissions.
**Credential handling:** PostHog API credentials are read from env vars (`POSTHOG_API_KEY`/`POSTHOG_PROJECT_ID`) or a local `~/.posthogrc` file — never hardcoded or logged.

---

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Documenting an HTTP server mode expands the attack surface from local-only execution to a potentially network-accessible service, yet this broader exposure is not reflected in the manifest description. In agent environments, operators may approve the skill for local analytics while overlooking that it can listen on a port and accept requests, creating opportunities for unauthorized access or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The HTTP mode is presented with a simple --port 8000 example but no warning about binding scope, authentication, TLS, or firewalling. If implemented naively, users may expose an unauthenticated decision API on a reachable interface, allowing unauthorized requests, data exfiltration from stored results, or abuse of connector-backed functionality.

Content

No source excerpt is available for this finding.