ClawHub
Back to skill

Security audit

artworklady-digitizing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed portal adapter for sending and fetching embroidery digitizing jobs, with real external submission gated by an explicit confirm flag.

Install only for workflows that intentionally send customer artwork and job details to Artwork Lady. Use bound environment secrets instead of chat or inline JSON credentials, keep state and output paths inside a controlled workspace, run dry runs first, and make the calling routine record submitted job references so retries do not double-post.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares access to secrets via environment variables and also permits inline credential passing, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, that weakens reviewability and increases the chance the skill is invoked with broader capabilities than intended, especially since it can authenticate to an external portal and upload local files.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
native form submit. `uploadfile()` validates, then POSTs a `multipart/form-data`
XHR to `https://www.artworklady.com/placeorder/order_form_submit`, and on the
XHR's `load` event it writes the response into `#status` and **redirects to
`/placeorder/thanks`** — *without checking the HTTP status*. So the redirect
alone is **not** proof of success.

This skill therefore judges success on the **actual `order_form_submit`

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

The skill acknowledges that submissions have no confirmation identifier and that de-duplication is left entirely to the caller. In a failure or retry scenario, this can lead to duplicate job submissions to the external vendor, causing unintended orders, cost exposure, and operational confusion because the portal provides no intrinsic idempotency protection.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md
`digitize.demand` **only** on `status: "submitted"` — never on a `dry_run`, an
`error`, or the mere sight of `/thanks`.

A live run confirmed the endpoint returns **HTTP 200 with an empty body** — no
confirmation/ticket id comes back (and `/thanks` is static), so there is nothing
to correlate a submission to. **De-duplication is the caller's job:** stamp the
demand with its `job_reference` + a submitted-at time on `submitted`, and skip

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The notes explicitly describe a confirmed live end-to-end submission path to an external vendor portal, including file upload and real send behavior, but do not pair that with a strong operator warning about external data disclosure, test-vs-production use, or approval requirements. In this skill context, the adapter is specifically designed to transmit customer artwork and job metadata outside the primary system, so lack of an explicit safety warning increases the risk of accidental real-world disclosure or unintended vendor orders.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
83% confidence
Finding

The documentation states there is no confirmation or ticket ID from the portal and that deduplication must be handled externally, which creates a real risk of autonomous misclassification of submission success and duplicate or untraceable orders. In this context, the skill interacts with a live external ordering system; absent a durable remote acknowledgment, retries, race conditions, or polling mistakes can cause repeated submissions or loss of auditability.

Content

Scanner excerpt · references/placeorder_flow_notes.md (reported line 129)May include surrounding context.

md
`/thanks` navigation is captured too, but only as corroboration.

> **Recorded from a live run:** on success `order_form_submit` returns **HTTP
> 200 with an empty body** — there is **no confirmation/ticket id** anywhere in
> the response, and `/placeorder/thanks` is a static page with none either. So
> the portal gives the caller nothing to correlate a submission back to. The
> success signal is therefore "HTTP 200 + `/thanks`", and **dedupe must live on

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill lets the caller choose out_dir/artifact_dir, then writes downloaded files, screenshots, and failure HTML to that path without restricting it to a safe workspace. In an agent environment, a malicious or compromised caller could cause writes to arbitrary locations, potentially overwriting sensitive files, planting data in served directories, or filling important filesystem locations with attacker-influenced content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script explicitly permits credentials to be supplied inline in the JSON input in addition to environment variables. In an agent setting, task inputs are often logged, persisted, echoed in traces, or exposed to upstream orchestrators, so accepting secrets through the normal request channel increases the chance of credential disclosure even if the code does not itself print them.

Content

No source excerpt is available for this finding.