ClawHub
Back to skill

Security audit

Publish to dochost

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says by publishing selected Markdown or HTML to a public dochost.io link, but users should confirm the content is safe to share before using it.

Install only if you intend agents to publish selected content to dochost.io. Use a dedicated API key if possible, review the exact Markdown or HTML before publishing, and do not publish secrets, private keys, confidential drafts, or sensitive customer data unless you are comfortable with the resulting public or unlisted URL.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes broad natural-language triggers such as 'publish this', 'share this as a link', and similar phrases in multiple languages. Because the action uploads user content to a public external service, over-broad activation can cause unintended publication of sensitive or draft material when the user’s intent was ambiguous. The context makes this more dangerous because the side effect is external and public by default from the user's perspective, not a local formatting action.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This skill instructs the agent to send arbitrary Markdown/HTML and an API bearer token to an external service at dochost.io. That is a real data-exfiltration boundary: any selected document contents leave the local trust boundary, and the resulting page is intentionally hosted at a public URL, creating confidentiality risk if the wrong content is published. The skill context increases severity because publishing is the core function, so accidental transmission is not incidental but the intended behavior.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Bearer token. No handshake or initialize call is needed (the server is stateless).

bash
curl -sS -X POST https://dochost.io/api/mcp \
  -H "Authorization: Bearer $DOCHOST_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The list_my_pages example transmits an authenticated request to an external service using the user's bearer token, which exposes metadata about previously published pages outside the local environment. Even though it does not send page bodies, it still reveals account-linked document titles, URLs, and timestamps, which may leak sensitive project or activity metadata if invoked unexpectedly. The skill context makes this somewhat less severe than the publish call, but it remains a real external data disclosure path.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

List previously published pages

bash
curl -sS -X POST https://dochost.io/api/mcp \
  -H "Authorization: Bearer $DOCHOST_API_KEY" \
  -H "Content-Type: application/json" -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",

Static analysis

No suspicious patterns detected.