ClawHub
Back to skill

Security audit

Buzz

Security checks for vulnerabilities and agentic risk

Overview

The skill is for a real news-alert service, but it relies on mutable remote code and documents insecure management API defaults that could expose stored tokens and configuration control.

Install only if you are comfortable reviewing the upstream GitHub project before running it. Set dashboard.password before startup, keep port 3848 bound or firewalled to localhost/private trusted hosts, avoid putting the password in shared logs or shell history, and treat Discord, Telegram, AI, and 6551 credentials in config.json as sensitive.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:34
Finding

Mutable External Repository Is Retrieved and Executed Without Version Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-39
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code:

bash
git clone https://github.com/zxcnny930/buzz.git
cd buzz
npm install
cp config.example.json config.json  # Edit config.json and set dashboard.password before starting
npm start

Technical Analysis

The setup procedure clones the current default branch of an external repository without pinning a reviewed commit, tag, or release checksum. It then installs third-party packages and executes the retrieved application.

Consequently, the code that runs is not contained in the audited artifact and can change after this Skill has been reviewed. The use of npm install can also execute package lifecycle scripts and resolve dependency versions according to the remotely retrieved package metadata. No malicious upstream content was observed in the supplied project files; the risk arises from trusting mutable, externally controlled code at installation time.

Attack Path

  1. An attacker compromises the referenced repository, its maintainer account, or a dependency included by the remote project.
  2. The attacker adds a malicious payload to the default branch, a dependency, or an npm lifecycle script.
  3. A user follows the documented installation procedure and clones the mutable repository state.
  4. npm install installs dependencies and may execute lifecycle scripts.
  5. npm start executes the externally supplied application with the user's local privileges.
  6. The payload can access resources available to that process, potentially including the service configuration and credentials stored in config.json.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the setup commands. The accessible scope may include project files, environment variables, network access, ...[truncated 275 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a reviewed commit hash or cryptographically signed release instead of cloning and executing the mutable default branch.
  • Publish and verify a checksum or signature for the expected source archive and lockfile.
  • Include a reviewed dependency lockfile and use npm ci for reproducible installation.
  • Use npm ci --ignore-scripts where package lifecycle scripts are unnecessary.
  • If lifecycle scripts are required, document and audit each script before execution.
  • Run the service under a dedicated, unprivileged account with access limited to its own working directory and required network destinations.
  • Audit the retrieved source and dependency tree before invoking npm start.
  • Consider packaging reviewed executable code with the Skill rather than retrieving mutable code during setup.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:25
Finding

Management API Is Documented as Unauthenticated and Bound to All Network Interfaces by Default

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-29
Vulnerability Type: Insecure default access-control configuration
Risk Level: High

Vulnerable Configuration Description:

markdown
## Security Notice

- `config.json` stores API keys, bot tokens, and webhook URLs locally. **Never commit it to version control** (it is gitignored by default).
- If `dashboard.password` is empty, the REST API is **unauthenticated**. Always set a password when the dashboard is exposed beyond localhost.
- The server binds to `0.0.0.0` by default. Use a reverse proxy or firewall to restrict access in production.

Related Authentication Behavior (SKILL.md, lines 44-56):

markdown
## Authentication

If a dashboard password is set, all `/api/*` endpoints require `?pw=PASSWORD`:

```bash
curl -s "http://localhost:3848/api/config?pw=YOUR_PASSWORD"

If password is empty string, no authentication is needed.

IMPORTANT: All curl examples below omit ?pw= for brevity. If the server has a password configured, append ?pw=PASSWORD to every URL.

text

### Technical Analysis

The documentation states that the server binds to `0.0.0.0` by default while an empty `dashboard.password` disables authentication. These defaults can expose the management API on every host network interface without access control.

The API is documented as supporting configuration reads and updates, monitored-account management, source status queries, and a live Server-Sent Events stream. Although sensitive fields returned by the configuration endpoint are reportedly redacted, redaction does not prevent an unauthenticated party from changing configuration or accessing other exposed information.

Authentication is also passed through the `pw` URL query parameter. Query-string credentials can be retained in shell history, client history, reverse-proxy logs, access logs, monitoring systems, and diagnostic output. The supplied fi
...[truncated 1884 chars]
Remediation
View remediation

Remediation Suggestions

  • Bind to 127.0.0.1 by default and require explicit configuration before listening on non-loopback interfaces.
  • Refuse to start on a non-loopback interface unless a strong authentication credential has been configured.
  • Generate a high-entropy credential during initial setup rather than allowing an empty password.
  • Send credentials in an Authorization header instead of a URL query parameter.
  • Store password verifiers using a modern password-hashing algorithm rather than retaining plaintext passwords, if the implementation currently stores plaintext.
  • Apply authentication and authorization consistently to configuration, KOL-management, SSE, and other sensitive endpoints.
  • Add request throttling, authentication-failure logging, and lockout or backoff controls.
  • Restrict access with host firewalls, container network policies, or an authenticated TLS reverse proxy.
  • Use HTTPS whenever requests can traverse a network, preventing credentials and configuration data from being transmitted in plaintext.
  • Update all examples to demonstrate secure authentication rather than omitting it, and clearly separate local-only examples from network deployments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The documentation explicitly allows the REST API to operate with an empty password and notes that authentication is then disabled. Combined with the documented default bind to 0.0.0.0, this creates a realistic risk of unauthorized local-network or Internet access to configuration endpoints that can change webhooks, tokens, and source settings.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

If a dashboard password is set, all /api/* endpoints require ?pw=PASSWORD:

bash
curl -s "http://localhost:3848/api/config?pw=YOUR_PASSWORD"

If password is empty string, no authentication is needed.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

Use AI translation (OpenAI-compatible API)

curl -s -X POST http://localhost:3848/api/config
-H "Content-Type: application/json"
-d '{"translator": "ai", "ai": {"apiKey": "xai-...", "model": "grok-4.1-fast", "baseUrl": "https://api.x.ai/v1"}}'

text

**Success response:**

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 367)May include surrounding context.

Use AI translation (OpenAI-compatible API)

curl -s -X POST http://localhost:3848/api/config
-H "Content-Type: application/json"
-d '{"translator": "ai", "ai": {"apiKey": "xai-...", "model": "grok-4.1-fast", "baseUrl": "https://api.x.ai/v1"}}'

text

**Success response:**

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

bash
# Enable Jin10
curl -s -X POST http://localhost:3848/api/config \
  -H "Content-Type: application/json" \
  -d '{"jin10": {"enabled": true, "pollIntervalMs": 15000}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.

bash
# Enable Jin10
curl -s -X POST http://localhost:3848/api/config \
  -H "Content-Type: application/json" \
  -d '{"jin10": {"enabled": true, "pollIntervalMs": 15000}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 462)May include surrounding context.

bash
# Enable Jin10
curl -s -X POST http://localhost:3848/api/config \
  -H "Content-Type: application/json" \
  -d '{"jin10": {"enabled": true, "pollIntervalMs": 15000}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This example instructs users to send Discord webhook URLs and Telegram bot credentials into a local API. While that is expected for the product, the context is sensitive because the same document permits unauthenticated API operation and default network exposure, making credential submission and later reconfiguration vulnerable if the dashboard is reachable by others.

Content

Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.

Set up Discord + Telegram dual push

bash
curl -s -X POST http://localhost:3848/api/config \
  -H "Content-Type: application/json" \
  -d '{
    "discord": {"webhookUrl": "https://discord.com/api/webhooks/..."},

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.

Step 2: Append and POST back

Adding Sports (100639) to existing [21, 120]

curl -s -X POST http://localhost:3848/api/config
-H "Content-Type: application/json"
-d '{"polymarket": {"tagIds": [21, 120, 100639]}}'

text

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The configuration documentation states "none" means "No translation, show English as-is," which establishes English as the default output language for that mode. Because the skill does not describe a user choice or opt-in for language/locale behavior in this path, it may conflict with organizational language-choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.