ClawHub
Back to skill

Security audit

Blackbox

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently delegates coding work to Blackbox AI, but it asks users to install and trust a mutable third-party CLI with broad coding-agent authority without enough safety guidance.

Review this carefully before installing. Use a pinned, reviewed Blackbox CLI version in an isolated environment, avoid `--yolo` on real repositories, do not run install commands with elevated privileges, and assume prompts and code may be sent to Blackbox or configured model providers. Remove secrets from projects before delegation and review all file changes before merging or running them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` 2. Document package integrity verification using a trusted checksum, registry integrity metadata, or signed release artifact. 3. For source installation, pin the repository to a reviewed commit or signed tag: ```sh git clone https://github.com/blackboxaicode/cli.git cd cli git checkout ``` 4. Use lockfile-enforced dependency installation, such as `npm ci`, with a reviewed and committed lockfile. 5. Review package lifecycle scripts before installation and disable them with `--ignore-scripts` when they are not required. 6. Prefer an isolated, non-global installation environment, such as a dedicated container or restricted user account, to limit access to host files and credentials. 7. Explicitly warn users not to run the installation as root or through `sudo`. 8. Establish a process for periodically reviewing pinned versions and updating them only after source, dependency, and release-integrity validation. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
| Command | Effect |
|---------|--------|
| `/compress` | Shrink conversation history to save tokens |
| `/clear` | Wipe history and start fresh |
| `/stats` | View current token usage |
| `Ctrl+C` | Cancel current operation |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs users to configure a Blackbox API key for a third-party CLI but gives no guidance on secure storage, scope minimization, logging exposure, or the privacy implications of sending code and prompts to an external service. Because this skill is specifically designed to delegate coding tasks, users may inadvertently expose proprietary source code or credentials to the provider.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

--yolo explicitly enables autonomous decision-making by allowing the delegated agent to approve actions and model switches without human oversight. For a multi-model coding agent operating through a terminal, this can translate into unreviewed modifications, command execution, or risky environment interactions.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
|------|--------|
| `--prompt "task"` | Non-interactive one-shot execution |
| `--resume-checkpoint "tag"` | Resume from a saved checkpoint |
| `--yolo` | Auto-approve all actions and model switches |
| `blackbox session` | Start interactive chat session |
| `blackbox configure` | Change settings, providers, models |
| `blackbox info` | Display system information |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises --yolo as an available flag that auto-approves all actions and model switches, but does not warn that this can authorize filesystem changes, code execution, or other destructive operations without user review. In the context of a coding agent that delegates work to a third-party CLI, normalizing auto-approval materially increases the chance of unsafe autonomous behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.