ClawHub
Back to skill

Security audit

Harbor — Curated and shared Memory for AI Agents

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent memory and credential-management purpose, but it asks for high-impact credential and persistence access while documenting misleading credential isolation and unexpected cloud account behavior.

Install only if you are comfortable giving Harbor persistent memory access and credential-broker authority. Prefer pinned audited versions, avoid `harbor auth get` in agent/tool code, use low-scope dedicated API tokens, review what gets remembered before enabling sync, and expect the recommended plugin to create a cloud account on first load.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

other

Error
Location
SKILL.md:57
Finding

Automatic Cloud Account Creation Contradicts the Declared Opt-In Network Model

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:122
Finding

Authenticated HTTP Proxy Does Not Document Destination Binding for Stored Credentials

Content
View full analysis
# 2. Tool retrieves key (any injection format) harbor auth get # raw key to stdout # 3. Or let Harbor inject into header automatically harbor fetch --auth # header-based APIs ``` ### Technical Analysis The documented proxy interface accepts a caller-controlled URL, credential name, and authentication-header format. It is explicitly described as able to “call any API.” The reviewed documentation does not describe any of the following safeguards: - Binding a credential to one or more approved origins. - Restricting which skill may use each credential. - Requiring confirmation when a credential is used with a new destination. - Rejecting cross-origin redirects. - Preventing credentials from being sent over plaintext HTTP. - Restricting access to loopback, link-local, or cloud metadata addresses. Credential isolation is not achieved merely by hiding the secret val ...[truncated 1481 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:205
Finding

Raw Credential Retrieval Through Standard Output Breaks Credential Isolation

Content
View full analysis
# Store credential harbor auth get # Retrieve credential (stdout) harbor auth sync # Sync cloud → local ``` ```typescript export const tavily_search = { name: "tavily_search", description: "Web search via Tavily (credential-isolated through Harbor)", parameters: { type: "object", required: ["query"], properties: { query: { type: "string" } }, }, async execute({ query }: { query: string }) { const { execSync } = require("node:child_process"); const key = execSync("harbor auth get tavily", { encoding: "utf-8" }); const res = await fetch("https://api.tavily.com/search", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ api_key: key, query, max_results: 5 }), }); return res.json(); }, }; ``` ```typescript export const stripe_balance = { name: "stripe_balance", description: "Check Stripe balance (credential-isolated)", parameters: { type: "object", properties: {} }, async execute() { const { execSync } = require("node:child_process"); const key = execSync("harbor auth get stripe", { encoding: "utf-8" }); const res = await fetch("https://api.stripe.com/v1/balance", { headers: { Authorization: `Bearer ${key}` }, }); return res.json(); }, }; ``` ### Technical Analysis The `harbor auth get` command returns the complete plaintext credential through standard output. The examples then copy that value into a JavaScript string controlled by the tool process. This behavior contradicts the stated security property that skills never see raw API keys. On ...[truncated 1493 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Executable Dependencies Are Installed From Mutable Unpinned Sources

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md
harbor get <connector.resource> --param key=value         # Connector fetch
harbor remember <topic> "Your analysis summary"             # Save context
harbor remember --connector <name> <topic> "summary"       # Scoped to connector
harbor forget mem_xxx                                      # Delete memory
harbor recall --search "keyword"                          # Search memory
harbor auth <name>                                        # Store credential
harbor auth get <name>                                    # Retrieve credential (stdout)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill repeatedly claims that skills or tool code never see raw API keys, but later documents harbor auth get, which returns credentials to stdout and into the calling process. That inconsistency can mislead users and developers into adopting weaker patterns under the impression they still have strong credential isolation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Agent prompt: "Enter API key for github-pat:"

Call API through Harbor — agent never sees the key

harbor fetch https://api.github.com/repos/oSEAItic/harbor --auth github-pat

text

Or via MCP tool:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

Agent prompt: "Enter API key for github-pat:"

Call API through Harbor — agent never sees the key

harbor fetch https://api.github.com/repos/oSEAItic/harbor --auth github-pat

text

Or via MCP tool:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

Agent prompt: "Enter API key for github-pat:"

Call API through Harbor — agent never sees the key

harbor fetch https://api.github.com/repos/oSEAItic/harbor --auth github-pat

text

Or via MCP tool:

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill encourages persistent storage of agent-generated summaries and auto-injection of prior context across sessions, with optional cloud sync of memories and schemas. In practice, users and agents often summarize sensitive prompts, investigation details, credentials-adjacent data, or proprietary content into natural language, so this creates a real cross-session data leakage and unintended retention risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Syncing workspace/session context on start and capturing context before compaction normalizes broad collection of conversational state that may contain secrets, regulated data, or confidential analysis. Even if framed as convenience, the plugin context makes this more dangerous because agents routinely process mixed-sensitivity information and users may not realize it is being persisted or prepared for sync.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This section states that tool code never touches raw API keys, then immediately introduces a mode where tools call harbor auth get and receive the raw key. In an agent skill ecosystem, that defeats the advertised isolation boundary and may cause operators to install the skill with incorrect trust assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Examples labeled as credential-isolated fetch secrets into the Node.js process via execSync("harbor auth get ..."). Once the secret is in-process, any compromised dependency, logging, exception trace, subprocess, or malicious skill code can exfiltrate it, so the example undermines the claimed security model.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md
async execute({ query }: { query: string }) {
    const { execSync } = require("node:child_process");
    const key = execSync("harbor auth get tavily", { encoding: "utf-8" });
    const res = await fetch("https://api.tavily.com/search", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ api_key: key, query, max_results: 5 }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md
async execute({ query }: { query: string }) {
    const { execSync } = require("node:child_process");
    const key = execSync("harbor auth get tavily", { encoding: "utf-8" });
    const res = await fetch("https://api.tavily.com/search", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ api_key: key, query, max_results: 5 }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md
async execute() {
    const { execSync } = require("node:child_process");
    const key = execSync("harbor auth get stripe", { encoding: "utf-8" });
    const res = await fetch("https://api.stripe.com/v1/balance", {
      headers: { Authorization: `Bearer ${key}` },
    });
    return res.json();

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The markdown explicitly says to always pass "OpenClaw Agent" as the author, which imposes a fixed natural-language value rather than offering user choice. This is a locale/language-style policy concern because it hardcodes one labeling convention without opt-in or justification.

Content

No source excerpt is available for this finding.