ClawHub
Back to skill

Security audit

Agent Conductor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent sub-agent orchestration guide, but it normalizes broad file/script delegation and shows unsafe shell-style agent invocation patterns that users should review before installing.

Install only if you intend to delegate coding work to local CLI agents. Before use, replace the shell-string examples with safer argument-array, stdin, or task-file invocation; keep writable paths scoped; confirm destructive or production-impacting operations manually; and monitor or clean up any background screen/tmux sessions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:18
Finding

Shell Command Injection Through Unescaped Sub-Agent Task Interpolation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:18-22 and SKILL.md:58-61
Vulnerability Type: Shell command injection caused by unsafe string interpolation
Risk Level: High

Vulnerable Code

SKILL.md:18-22:

text
| Claude Code | `claude '<task>'` |
| OpenAI Codex | `codex '<task>'` |
| Cursor Agent | `cursor-agent '<task>'` |
| Gemini Code | `gemini-code '<task>'` |
| Any other | `your-agent-cmd '<task>'` |

SKILL.md:58-61:

text
| Duration | Mechanism |
|----------|-----------|
| < 5 min | Foreground: `exec pty:true command:"AGENT_CMD '...'"` |
| 5–30 min | Background: `exec pty:true background:true timeout:1800 command:"AGENT_CMD '...'"` |

Technical Analysis

The Skill recommends constructing shell command strings by placing generated task text inside single quotes. Single quotes are not a safe sanitization mechanism when the interpolated task can itself contain a single quote. Such a character terminates the quoted argument, after which shell operators or additional commands can be parsed by the shell.

The documentation does not require an argument-array API, safe stdin transport, temporary task files, input validation, or platform-appropriate shell escaping. Task content may incorporate user prompts, repository text, filenames, issue descriptions, or other attacker-controlled context. Consequently, the vulnerable command-construction pattern can turn untrusted task text into executable shell syntax.

This is classified as T09: Insecure Skill Coding Practices because the exploitable condition arises from an insecure command invocation pattern documented by the Skill.

Attack Path

  1. An attacker places crafted content in task input or repository material that the orchestrator will include in a sub-agent task.
  2. The crafted text contains a single quote that closes the command's quoted task argument, followed by shell syntax an ...[truncated 1224 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not construct executable shell command strings by concatenating or interpolating task text.
  2. Invoke the selected coding-agent executable through an argument-array API that bypasses shell parsing, such as an equivalent of execFile(agentExecutable, [task]).
  3. Prefer passing large or untrusted tasks through standard input or a securely created task file. Pass only the file path as a discrete argument.
  4. If shell invocation is unavoidable, use a proven platform-specific escaping library rather than manually adding quotes. Apply escaping to every dynamic argument.
  5. Treat repository content, user prompts, filenames, issue text, and generated task descriptions as untrusted input.
  6. Use a fixed allowlist that maps supported agent names to trusted executable paths. Do not allow task content to control the executable or execution options.
  7. Run sub-agents with least privilege, a restricted environment, minimal credentials, and an isolated working directory where practical.
  8. Add acceptance tests containing single quotes, command separators, substitutions, newlines, and redirection characters to verify that the entire task remains one literal argument and no secondary command executes.
  9. Update all foreground and background examples so they demonstrate a non-shell invocation method rather than command:"AGENT_CMD '...'".

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description says to use the skill for broad categories like 'writing or modifying code files' and 'running scripts or data pipelines,' which are common tasks across many coding interactions. It does include some exclusions, but it does not define specific trigger phrases or tighter activation boundaries, so the skill could be invoked more often than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs operators to send file modification, script execution, and data-processing tasks to external coding agents without any built-in safety gate, approval checkpoint, or warning about destructive side effects. In an orchestration context, this increases the chance of unintended file changes, unsafe command execution, or data corruption because the workflow normalizes execution-by-delegation as the default path.

Content

No source excerpt is available for this finding.