ClawHub
Back to skill

Security audit

artworklady-digitizing

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed portal-automation skill for submitting Artwork Lady digitizing jobs, with live submission gated by an explicit confirm flag.

Use this only with an account authorized to submit Artwork Lady jobs. Run dry runs first, set confirm:true only after your calling routine has duplicate checks, and protect portal credentials, Playwright storage_state files, screenshots, failure HTML, and uploaded customer artwork as sensitive data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill exposes access to sensitive environment-backed credentials and browser automation but does not declare any explicit tool scope or allowed-tools boundary. In practice this can let a calling agent invoke code paths with broader capabilities than reviewers expect, increasing the chance of secret misuse or unintended portal actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
native form submit. `uploadfile()` validates, then POSTs a `multipart/form-data`
XHR to `https://www.artworklady.com/placeorder/order_form_submit`, and on the
XHR's `load` event it writes the response into `#status` and **redirects to
`/placeorder/thanks`** — *without checking the HTTP status*. So the redirect
alone is **not** proof of success.

This skill therefore judges success on the **actual `order_form_submit`
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
`digitize.demand` **only** on `status: "submitted"` — never on a `dry_run`, an
`error`, or the mere sight of `/thanks`.

A live run confirmed the endpoint returns **HTTP 200 with an empty body** — no
confirmation/ticket id comes back (and `/thanks` is static), so there is nothing
to correlate a submission to. **De-duplication is the caller's job:** stamp the
demand with its `job_reference` + a submitted-at time on `submitted`, and skip
Confidence
82% confidence
Finding
The skill acknowledges there is no portal-side confirmation identifier or deduplication, and pushes exactly-once protection to the caller. In a crash/retry scenario, this can lead to duplicate submissions to the vendor, causing unintended external actions, operational confusion, and financial/process impact.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The notes explicitly document a proven end-to-end flow that performs a real external submission, including a live test with a throwaway reference. In a skill whose purpose is to submit jobs to a third-party portal, lack of prominent operator-facing warning and strong dry-run-by-default guidance increases the risk of accidental real-world submissions, duplicate orders, and unintended data disclosure to the vendor.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation describes credentialed login and transmission of job data/files to external endpoints, but it does not prominently warn about handling credentials, customer artwork, and potentially sensitive business data. In practice, this can lead operators or integrators to use production credentials and upload sensitive files without adequate notice, review, or privacy controls.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
`/thanks` navigation is captured too, but only as corroboration.

> **Recorded from a live run:** on success `order_form_submit` returns **HTTP
> 200 with an empty body** — there is **no confirmation/ticket id** anywhere in
> the response, and `/placeorder/thanks` is a static page with none either. So
> the portal gives the caller nothing to correlate a submission back to. The
> success signal is therefore "HTTP 200 + `/thanks`", and **dedupe must live on
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.