ClawHub
Back to skill

Security audit

champro-api

Security checks for vulnerabilities and agentic risk

Overview

The CHAMPRO skill is coherent, but it deserves Review because it can place real orders and has under-scoped handling of validation bypasses, local file writes, and sensitive order details.

Review before installing in any environment that handles customer or team data. Use sandbox first, require human approval for production orders, avoid skip_validation except under a separate operator policy, do not paste previews or summaries into tickets without redaction, and write downloaded proofs only to a private intended path rather than shared /tmp locations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The example instructs users to write live order payloads containing customer PII such as names, addresses, and phone numbers into /tmp/order.json. On many multi-user or shared environments, temporary directories can be broadly accessible, and the documentation gives no warning that this data may persist on disk or be readable by other local users, leading to unintended disclosure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The custom-order example places customer and roster data, including names, address details, phone number, and player identifiers, into /tmp/custom.json without any caution about local data handling. In agent-hosted, CI, or shared shell environments, this can expose sensitive order and team information through temporary-file disclosure or residual data left on disk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
`get_design_file` writes downloaded content to `output_path` exactly as provided, with no validation, confinement to a safe directory, or overwrite protections. If an attacker can influence this argument, they can cause arbitrary file writes on the local filesystem, potentially overwriting sensitive files or planting content in locations later consumed by other tools. The skill context increases risk because this is a supplier automation tool likely to run with operator credentials in CI, desktop, or integration environments where filesystem access is meaningful.

Ssd 3

Medium
Confidence
92% confidence
Finding
`preview_order` returns the full request body and validation report for display to users, and the surrounding code and comments explicitly support showing or pasting this preview into tickets. Because order payloads can include roster/proof-related fields and shipping/order details, this creates a real risk of unintended disclosure of personal or sensitive business data through logs, UI surfaces, or support workflows.

Ssd 3

Medium
Confidence
95% confidence
Finding
`summarise_place_order` copies `team_name`, `player_name`, and `player_number` from API responses into the returned summary object. That summary is then attached to normal return values and exceptions, increasing the chance that personal roster data is exposed in logs, CLI output, monitoring, or escalation tickets beyond what is needed to track fulfillment state.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
product_masters=product_masters,
        **credentials,
    )
    if not report["valid"] and not skip_validation:
        return {
            "outcome": "not_sent",
            "reason": "validation_failed",
Confidence
78% confidence
Finding
The code allows callers to bypass blocking validation findings simply by setting `skip_validation:true`, after which the order may still be transmitted. In this skill's context, the payload can include shipping, roster, and fulfillment-sensitive data, and sending malformed or policy-violating orders can cause accidental real-world transactions, data handling issues, or operational abuse despite other safeguards.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
"reason": "validation_failed",
            "message": (
                f"{report['blocking_count']} blocking finding(s). Fix them, or pass "
                "skip_validation:true to send anyway."
            ),
            "validation": report,
        }
Confidence
74% confidence
Finding
The user-facing message explicitly instructs operators to pass `skip_validation:true` to send anyway, normalizing unsafe behavior and making control bypass easy to discover and automate. In an ordering system with no cancel operation and possible partial placement, reducing friction around bypass materially increases the chance of harmful or noncompliant submissions.

Static analysis

No suspicious patterns detected.