ClawHub
Back to skill

Security audit

Integration Testing

Security checks for vulnerabilities and agentic risk

Overview

This integration-testing skill is broadly legitimate, but its helper scripts make persistent shell changes, install or execute unverified dependencies, and may leave local test services running.

Review and edit the helper scripts before running them. Prefer a virtual environment with pinned dependencies, verify downloaded artifacts, avoid automatic ~/.bashrc changes, keep Testcontainers cleanup enabled unless you explicitly choose otherwise, bind test services to loopback, and remove any lingering containers or shell exports after use.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/init_wiremock.py:31
Finding

Remote WireMock JAR Is Downloaded and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/setup_testcontainers.py:28
Finding

Unpinned Python Dependencies Are Installed at Runtime

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
scripts/setup_testcontainers.py:49
Finding

Testcontainers Setup Persistently Disables Automatic Container Cleanup

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/start_localstack.py:109
Finding

LocalStack Setup Persistently Overrides AWS Credentials and Endpoint Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/start_localstack.py:153
Finding

LocalStack Signal Handler Exits Without Terminating the Child Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
templates/sftp-integration-tests.py:20
Finding

SFTP Test Server Uses Unverified Host Keys, Predictable Credentials, and Broad Port Publishing

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (53)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A description-behavior mismatch is dangerous because it can mislead users and orchestrators into approving a skill for harmless integration testing while it performs persistent host changes, package installation, and cleanup suppression. In particular, modifying ~/.bashrc, disabling Testcontainers Ryuk cleanup, and installing packages on the host can leave lasting side effects, weaken isolation assumptions, and cause lingering containers or altered environments beyond the test session.

Content

No source excerpt is available for this finding.

Docker Socket Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/testcontainers-guide.md (reported line 121)May include surrounding context.

md
from testcontainers.core.docker_client import DockerClient

def test_with_network():
    client = DockerClient()
    network = client.client.networks.create("test-network")
    
    with DockerContainer("nginx:latest") \

Docker Socket Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/testcontainers-guide.md (reported line 186)May include surrounding context.

md
from testcontainers.core.docker_client import DockerClient

def test_with_network():
    client = DockerClient()
    network = client.client.networks.create("test-network")
    
    with DockerContainer("nginx:latest") \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises code and operational capabilities involving containers, networked services, helper scripts, and writable setup actions, but it declares no explicit tool scope such as permissions or allowed-tools. That creates an overbroad trust boundary where an agent may invoke file, shell, or network actions without user-visible restriction, increasing the chance of unintended host modification or external connectivity during test setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The documentation instructs users to pull localstack/localstack:latest, which is a mutable tag and can resolve to different images over time. That weakens reproducibility and can expose users to unexpected or compromised upstream image changes in test environments.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/localstack-s3-config.md (reported line 103)May include surrounding context.

Use AWS CLI commands

aws s3 ls aws s3 mb s3://test-bucket aws s3 cp file.txt s3://test-bucket/

text

### Environment Variables

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · references/wiremock-patterns.md (reported line 135)May include surrounding context.

md
# Test with authorization header
        headers = {"Authorization": "Bearer token123"}
        response = requests.get(
            "http://localhost:8080/api/protected",
            headers=headers
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/init_wiremock.py (reported line 16)May include surrounding context.

python
def check_java():
    """Check if Java is available (WireMock requires Java)"""
    try:
        result = subprocess.run(
            ['java', '-version'],
            capture_output=True,
            text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

The script downloads an executable JAR from the internet at runtime using curl and then later executes it with Java, but it performs no checksum, signature, or other integrity verification. If the download source, network path, or local artifact is tampered with, this becomes arbitrary code execution on the developer or CI host.

Content

Scanner excerpt · scripts/init_wiremock.py (reported line 43)May include surrounding context.

python
print(f"📥 Downloading WireMock {wiremock_version}...")
    try:
        subprocess.run(
            ['curl', '-L', '-o', wiremock_jar, wiremock_url],
            check=True
        )

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/init_wiremock.py (reported line 59)May include surrounding context.

python
# Check if port is already in use
    try:
        response = requests.get(f"http://localhost:{port}/__admin")
        print(f"⚠️  Port {port} is already in use")
        return None
    except requests.exceptions.ConnectionError:

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/init_wiremock.py (reported line 77)May include surrounding context.

python
# Check if port is already in use
    try:
        response = requests.get(f"http://localhost:{port}/__admin")
        print(f"⚠️  Port {port} is already in use")
        return None
    except requests.exceptions.ConnectionError:

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/init_wiremock.py (reported line 96)May include surrounding context.

python
# Check if port is already in use
    try:
        response = requests.get(f"http://localhost:{port}/__admin")
        print(f"⚠️  Port {port} is already in use")
        return None
    except requests.exceptions.ConnectionError:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

This process launch executes the JAR obtained earlier, so the security risk depends on the trustworthiness of jar_path and the downloaded artifact. In this script, jar_path comes from an unverified network download, making this an effective arbitrary code execution sink if the JAR is malicious or replaced locally.

Content

Scanner excerpt · scripts/init_wiremock.py (reported line 67)May include surrounding context.

python
# Start WireMock
    try:
        process = subprocess.Popen(
            ['java', '-jar', jar_path, '--port', str(port)],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_testcontainers.py (reported line 14)May include surrounding context.

python
def check_docker():
    """Check if Docker is running and accessible"""
    try:
        result = subprocess.run(
            ['docker', 'version'],
            capture_output=True,
            text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_localstack.py (reported line 16)May include surrounding context.

python
def check_docker():
    """Check if Docker is running and accessible"""
    try:
        result = subprocess.run(
            ['docker', 'version'],
            capture_output=True,
            text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
83% confidence
Finding

The script automatically installs Python packages at runtime via pip install without pinning versions, validating hashes, or asking for confirmation. This creates a supply-chain exposure: a compromised package, typosquatted dependency, or unexpected latest-version change could execute arbitrary code during installation under the user's account.

Content

Scanner excerpt · scripts/setup_testcontainers.py (reported line 38)May include surrounding context.

python
for package in packages:
        try:
            subprocess.run(
                [sys.executable, '-m', 'pip', 'install', package],
                check=True
            )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persistently appends environment-variable exports to the user's ~/.bashrc, changing future shell behavior beyond the immediate test setup. Persistent profile modification is risky because it affects unrelated sessions, is hard for users to notice or revert, and here enables settings like disabling Ryuk cleanup that may leave test containers/resources behind.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script modifies ~/.bashrc silently and without prior warning or confirmation, which is unsafe for a setup helper intended for developers. Unexpected persistence can undermine user trust, create difficult-to-trace environment changes, and in this case may globally alter container/test behavior in subsequent sessions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_localstack.py (reported line 35)May include surrounding context.

python
"""Install LocalStack CLI"""
    try:
        # Check if localstack is already installed
        result = subprocess.run(
            ['localstack', '--version'],
            capture_output=True,
            text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

Automatically running pip install localstack causes the script to fetch and execute code from an external package source without user confirmation, version pinning, or integrity verification. That expands trust to the network, package index, and dependency chain, creating supply-chain and unexpected-environment-modification risk.

Content

Scanner excerpt · scripts/start_localstack.py (reported line 49)May include surrounding context.

python
# Install LocalStack
    print("📥 Installing LocalStack...")
    try:
        subprocess.run(
            ['pip', 'install', 'localstack'],
            check=True
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_localstack.py (reported line 78)May include surrounding context.

python
print(f"   Services: {', '.join(services)}")
    
    try:
        process = subprocess.Popen(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Appending AWS-related environment variables to ~/.bashrc persistently changes the user's shell environment beyond the lifetime of the test session. This can misdirect future AWS CLI or SDK usage to LocalStack or test credentials, causing confusion, unintended data operations, or interference with legitimate AWS workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Persistently writing AWS environment exports into ~/.bashrc without a prompt or clear warning violates the principle of least surprise and can silently alter future command behavior. Because the variables affect AWS authentication and endpoints, users may unknowingly run tools against LocalStack or with test credentials in later sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The cleanup handler claims LocalStack will stop automatically but does not terminate the spawned process, which can leave a background service running unexpectedly. A lingering LocalStack instance may continue exposing local service endpoints, consume resources, and create confusion about whether test infrastructure is still active.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/localstack-s3-config.md (reported line 149)May include surrounding context.

md
# Upload test file
        test_content = b'Hello, LocalStack S3!'
        s3_client.put_object(
            Bucket=bucket_name,
            Key='test-file.txt',
            Body=test_content

Static analysis

No suspicious patterns detected.