ClawHub
Back to skill

Security audit

4chan-reader

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its optional save feature can write outside the intended output folder because command arguments are not validated.

Install only if you are comfortable with the agent fetching public 4chan pages and storing their content locally. Avoid passing untrusted board, thread_id, or output_root_dir values, and use a dedicated output folder because the current script does not enforce that saved files stay inside it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/chan_extractor.py:99
Finding

Unsanitized Path Components Permit Output Directory Escape

Content
View full analysis
4: # Check if arg4 is a digit (word_limit) or a directory if sys.argv[4].isdigit(): word_limit = int(sys.argv[4]) else: out_root = sys.argv[4] if len(sys.argv) > 5 and sys.argv[5].isdigit(): word_limit = int(sys.argv[5]) get_thread(board, thread_id, out_root, word_limit) ``` ### Technical Analysis The caller-controlled `board` and `thread_id` values are incorporated into filesystem paths without validation, normalization, or a containment check. `os.path.join()` does not guarantee that the resulting path remains beneath `output_root`. Traversal components such as `..` may resolve outside the intended directory. An absolute path component may also cause preceding path components to be discarded. The program subsequently creates directories with `os.makedirs()` and opens the destination in write mode, which truncates an existing file. The intended output layout is `/_/.txt`, but the implementation does not enforce that boundary. Exploitation is constrained because the file-writing logic runs only after the constructed 4chan re ...[truncated 1768 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: 4chan-reader
description: Browse 4chan boards and extract thread discussions into structured text files. Use when you need to fetch catalog information or specific thread content (including post text and file metadata) from 4chan boards like /a/, /vg/, /v/, etc.
---

# 4chan Reader

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
name: 4chan-reader
description: Browse 4chan boards and extract thread discussions into structured text files. Use when you need to fetch catalog information or specific thread content (including post text and file metadata) from 4chan boards like /a/, /vg/, /v/, etc.
---

# 4chan Reader

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

text
Output format: `ThreadID|PostCount|TeaserText`

### 2. Extract Thread Content
To read a specific thread and optionally save it:
```bash
python3 scripts/chan_extractor.py thread <board> <thread_id> [output_root_dir] [word_limit]

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises and invokes network access and optional file writes, but it declares no explicit tool scope or permissions boundaries. That increases the chance an agent can use broader capabilities than the user expects, especially when fetching remote content and persisting it locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents saving thread contents to disk but does not clearly warn that local files will be created and retained. This can lead to unexpected storage of untrusted or sensitive content on the host, reducing user awareness and informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code writes fetched thread contents into a newly created directory under a user-provided output root, but there is no confirmation prompt or explicit warning in the usage text that running the command may create files and directories. Although the write is part of the script's functionality, the only disclosure appears after the write succeeds, not before it happens.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.