ClawHub
Back to skill

Security audit

Lovense Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly discloses local Lovense device control, but its install step fetches and runs unaudited mutable code from GitHub.

Review this before installing. The device-control behavior is disclosed and includes consent-oriented rules, but the actual Python program is downloaded later from a mutable GitHub branch. Only use it if you are comfortable auditing and pinning the referenced script yourself, or wait for a version that bundles the reviewed executable or verifies a fixed digest.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:12
Finding

Unpinned Remote Payload Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–17; execution examples at lines 32–55
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -sL https://raw.githubusercontent.com/2b-jr26/lovense-cli/main/lovense.py -o lovense.py
chmod +x lovense.py

The downloaded file is subsequently invoked using commands such as:

bash
SCRIPT="{baseDir}/lovense.py"

python3 $SCRIPT <ip> <port> gettoys
python3 $SCRIPT <ip> <port> vibe 12 6
python3 $SCRIPT <ip> <port> stop

Technical Analysis

The Skill instructs users or agents to download a Python program from the mutable main branch of a personal GitHub repository and execute it locally. The downloaded source is not included in the audited package, so its behavior cannot be verified as part of this audit.

The retrieval process provides no immutable commit pin, expected cryptographic digest, signature verification, or other integrity control. Consequently, the effective program can change after the Skill has been reviewed. Compromise of the upstream account or repository, a malicious upstream update, or unauthorized modification of the branch could replace the expected utility with arbitrary Python code.

The use of curl -sL also suppresses useful diagnostics and does not use --fail, while chmod +x unnecessarily marks the payload executable because the documented commands invoke it through python3. These choices increase the chance that users will treat an unaudited remote file as trusted executable content.

The declared LAN-control functionality does not inherently require fetching mutable executable code at installation time. Bundling a reviewed implementation within the Skill would satisfy the stated function with a smaller supply-chain trust boundary.

Attack Path

  1. An attacker compromises the upstream GitHub account or repository, or otherwise gains permission to mod ...[truncated 1457 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include lovense.py directly in the Skill package so that its exact contents can be reviewed and distributed with the audited artifact.
  2. If remote retrieval is unavoidable, pin the URL to an immutable, reviewed commit rather than the mutable main branch.
  3. Publish an expected SHA-256 digest through a trusted channel and verify it before any execution. Abort on mismatch.
  4. Prefer cryptographic signature verification with a documented, trusted public key where maintainable release signing is available.
  5. Use strict download behavior, including curl --fail --show-error --location, and write to a controlled destination only after validation.
  6. Require explicit user approval before retrieving or executing external code, clearly displaying the source URL, pinned revision, and verification result.
  7. Remove chmod +x unless direct execution is necessary; invoking a verified file through python3 does not require executable permission.
  8. Review the bundled or pinned script for its network destinations, command construction, input validation, file access, and handling of device-control requests before release.
  9. Run the utility with only the minimum account and filesystem permissions needed for local-network device control.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
`SKILL.md` ships with this skill; the executable lives in the source repo. Fetch it once: