ClawHub
Back to skill

Security audit

测试驱动开发

Security checks for vulnerabilities and agentic risk

Overview

This is a TDD tutorial skill with visible example code and no hidden install, persistence, credential access, or data exfiltration behavior.

Before installing, treat this as a Chinese TDD reference and be cautious about copying the builtins mutation example directly; prefer normal module-local function replacement or dependency injection in real test code.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:143
Finding

Process-Wide Built-in Namespace Mutation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 143–145
Vulnerability Type: Process-wide namespace pollution
Risk Level: Low

python
import builtins
builtins.fib = fib_refactored
results2 = cycle.run_tests()

Technical Analysis

The example modifies Python's global builtins module by assigning fib_refactored to builtins.fib. The built-in namespace is shared throughout the current Python interpreter, so this change is visible to unrelated modules and code running in the same process.

Adding application-specific functions to builtins bypasses normal module scoping and can create unexpected name resolution behavior. It may overwrite an existing attribute, conflict with another component that uses the same name, or leave process-wide state behind after the demonstration completes. Although the assigned function is locally defined and no direct attacker-controlled value is present in the audited code, this pattern is unsafe if copied into a shared, long-running, or extensible interpreter.

Attack Path

  1. A user copies or executes the example in a Python process shared with other components.
  2. The example assigns fib_refactored to the process-wide builtins.fib attribute.
  3. Other code in that interpreter resolves an otherwise undefined fib name through the modified built-in namespace.
  4. That code executes the injected function or experiences behavior different from its intended module-local resolution.
  5. In an extensible environment where another component can replace fib_refactored before assignment, the same pattern could expose unrelated code to substituted behavior.

This finding does not establish remote code execution or privilege escalation by itself. Exploitation depends on the example being executed in a shared interpreter and other code relying on built-in name resolution.

Impact Assessment

The mutation affects the entire current Python interpreter rather ...[truncated 435 chars]

Remediation
View remediation

Remediation Suggestions

Keep the refactored implementation in module-local scope and explicitly update the test references instead of modifying builtins. For example:

python
fib = fib_refactored
results2 = cycle.run_tests()

Preferably, redesign TDDCycle so tests receive the implementation explicitly through dependency injection:

python
def fib_test_basic(implementation):
    assert implementation(0) == 0
    assert implementation(1) == 1

Additional hardening measures:

  • Remove import builtins and the builtins.fib assignment.
  • Avoid process-global mutation in documentation examples.
  • Restore any global state in a finally block if temporary mutation is unavoidable.
  • Run demonstrations in isolated subprocesses when global interpreter changes are required.
  • Add a regression test confirming that executing the example does not add or replace attributes in builtins.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description and activation text are presented in Chinese, and the skill does not indicate that language is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

文档在守则中明确写明“有任何测试失败时，不允许重构”“重构只改结构，不改功能”，但前面的示例在L141先调用 cycle.refactor("fib_refactored")，此时 refactor 仅把字符串写入 self.implementation 并重新运行旧测试函数，真正切换到新实现 builtins.fib = fib_refactored 却发生在之后的L144。也就是说，示例把‘验证重构’放在‘实际替换实现’之前，和所宣称的重构流程存在直接冲突。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.