ClawHub
Back to skill

Security audit

cli2skill

Security checks across malware telemetry and agentic risk

Overview

This skill’s core purpose is legitimate, but its MCP conversion can create persistent agent skills with unrestricted shell access.

Install only if you are comfortable reviewing generated skills before enabling them. Generate into a temporary directory first, inspect allowed-tools and copied descriptions, avoid using untrusted CLI or MCP configs, and narrow or remove Bash(*) before placing generated MCP skills in an agent skills directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# On Windows, commands like npx/node need shell=True or .cmd suffix
    use_shell = sys.platform == "win32"
    proc = subprocess.Popen(
        command,
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
88% confidence
Finding
The code executes an external command supplied by the caller and, on Windows, enables `shell=True`, which changes argument handling and can allow shell metacharacter interpretation. In a tool whose purpose is to connect to arbitrary MCP servers, this creates real command-execution risk if untrusted input reaches `command`, especially because the process inherits a merged environment and is run without validation or user warning.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Support multi-word executables like "python script.py"
    cmd = executable.split() + (args or []) + ["--help"]
    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=10,
        )
        return result.stdout or result.stderr
Confidence
95% confidence
Finding
The code executes an externally supplied executable string via subprocess.run after splitting it with executable.split(), with no allowlist, path validation, or trust boundary checks. In this skill's context, that means analyzing a CLI can directly cause arbitrary local command execution just by invoking its --help or subcommand help, which is dangerous if the executable comes from user-controlled input or an untrusted skill workflow.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The generated skill frontmatter always grants `allowed-tools: Bash(*)`, which gives unrestricted shell capability regardless of the original MCP server's intended scope. This is a privilege-expansion flaw: even a read-only or narrowly scoped MCP toolset is converted into a skill that can execute arbitrary commands, making downstream use substantially more dangerous than the source capability.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The examples instruct users to write generated skills directly into ~/.claude/skills/ without noting that this creates or may overwrite files in a trusted skill directory. In this context, that is risky because generated content is effectively being installed into an agent-consumed location, which could replace an existing skill or introduce unsafe behavior if the generated skill is not reviewed.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This code launches an external process, potentially through the shell on Windows, with no explicit user-facing disclosure that arbitrary local code will be run. In the context of a skill-generator that may consume untrusted config or commands, silent subprocess execution increases the chance of unexpected code execution and makes misuse harder for users to recognize before damage occurs.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill exposes broad GitHub CLI functionality, including authentication, API access, secret management, workflow control, and repository mutation, but provides no guardrails or warnings about network access, credential use, or state-changing operations. In an agent context, this increases the chance that a model or user invokes sensitive commands such as `gh auth`, `gh api`, `gh secret`, or repo-modifying actions without understanding their security and operational consequences.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.