ClawHub
Back to skill

Security audit

Cyber OWASP Review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local OWASP-mapping helper, with one limited dry-run file-write bug users should notice.

Before installing, users should treat this as a local report-generation skill: provide only intended scanner findings as input and choose a safe output path. Do not rely on --dry-run to avoid filesystem changes until that bug is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/map_findings_to_owasp.py:128
Finding

Dry-Run Mode Performs Filesystem Writes and Can Overwrite Existing Files

Content
View full analysis

Vulnerability Details

File Location: scripts/map_findings_to_owasp.py, lines 29, 76-104, and 128
Vulnerability Type: Dry-run contract violation resulting in unintended filesystem modification
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--dry-run", action="store_true", help="Run without side effects.")
python
def render(result: dict, output_path: Path, fmt: str) -> None:
    output_path.parent.mkdir(parents=True, exist_ok=True)

    if fmt == "json":
        output_path.write_text(json.dumps(result, indent=2), encoding="utf-8")
        return

    if fmt == "md":
        lines = [
            f"# {result['summary']}",
            "",
            f"- status: {result['status']}",
            "",
            "## Findings By Category",
        ]
        for category, count in result["details"]["category_counts"].items():
            lines.append(f"- {category}: {count}")
        lines.extend(["", "## Remediation Checklist"])
        for category, actions in result["details"]["remediation_checklist"].items():
            lines.append(f"- {category}")
            for action in actions:
                lines.append(f"  - {action}")
        output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
        return

    with output_path.open("w", newline="", encoding="utf-8") as handle:
        writer = csv.DictWriter(
            handle,
            fieldnames=["id", "severity", "category", "title"],
        )
        writer.writeheader()
        writer.writerows(result["details"]["mapped_findings"])
python
render(result, Path(args.output), args.format)

Technical Analysis

The command-line interface explicitly describes --dry-run as running without side effects. However, the flag does not control output behavior. It is only recorded in the generated result, while render() is called unconditionally.

The render() function always creates the output file's parent directories and then create ...[truncated 1915 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prevent all rendering when dry-run mode is active:
python
if args.dry_run:
    print(json.dumps(result, indent=2))
else:
    render(result, Path(args.output), args.format)

  1. Prefer making --output optional during dry runs so callers do not need to provide a potentially destructive path.

  2. If preview output is required, emit it to standard output rather than opening a filesystem destination.

  3. Add automated tests confirming that --dry-run:

    • Does not create the output file.
    • Does not modify an existing output file.
    • Does not create missing parent directories.
    • Produces preview output only through a documented non-mutating channel.

  4. Consider writing normal output atomically through a temporary file in the destination directory followed by a controlled replacement. This reduces corruption risk during interrupted non-dry-run operations.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill references bundled resources and directs the agent to run a local script and read a file, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where the runtime may permit file read/write behaviors more broadly than intended, increasing the chance of unintended file access or modification if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.