ClawHub
Back to skill

Security audit

aispace

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed aispace CLI integration for user-directed remote storage and encrypted transfers, with install and invocation cautions but no hidden or destructive behavior found.

Install this only if you want Codex to use aispace for remote storage or encrypted artifact exchange. Confirm before creating public links, deleting files, or sending to recipients, protect AISPACE_KEY and transfer tokens, and consider pinning or reviewing the @aispace-sh/cli package before use in sensitive environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Executable npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–21
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

yaml
install:
  - kind: node
    package: "@aispace-sh/cli"
    bins:
      - aispace

Technical Analysis

The skill installs and executes the @aispace-sh/cli npm package without specifying an exact version or integrity digest. Consequently, installation can resolve mutable registry content that was not part of this audit. If the package, publisher account, or dependency chain is compromised, a malicious future release could execute with the permissions of the agent process.

This finding establishes supply-chain exposure, not evidence that the current package is malicious.

Attack Path

  1. An attacker compromises the npm publisher account, package, or one of its resolved dependencies.
  2. The attacker publishes a malicious release that still provides the expected aispace binary.
  3. The skill installer resolves the unpinned package to that affected release.
  4. The agent invokes aispace for a legitimate storage or transfer operation.
  5. Malicious package code executes under the agent's operating-system account and accesses resources available to that process.

Impact Assessment

Successful exploitation could expose artifacts selected for upload, environment credentials such as AISPACE_KEY, CLI configuration, identity or transfer records readable by the agent account, and network resources available to the process. The precise scope would be limited by the operating-system privileges, filesystem access, environment, and network permissions granted to the agent.

Remediation
View remediation

Remediation Suggestions

  • Pin @aispace-sh/cli to an audited, exact version rather than allowing mutable version resolution.
  • Enforce registry integrity verification with a trusted lockfile and package integrity hash where the skill installation framework supports them.
  • Verify package provenance and publisher identity before approving updates.
  • Review each dependency update before deployment and use automated supply-chain scanning for the package and its transitive dependencies.
  • Run the CLI with least privilege, exposing only the files, credentials, and network destinations required for the requested operation.
  • Prefer an installation mechanism that fails closed when the pinned version or expected integrity metadata does not match.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description and default prompt are broad enough to match many ordinary requests involving artifacts, storage, uploads, downloads, or handoffs. Because implicit invocation is allowed, this can cause the agent to route user data into the aispace workflow when the user did not clearly request remote transfer, expanding data exposure and creating unintended side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Enabling implicit invocation without tight trigger constraints allows the skill to activate automatically for ambiguous requests. In a skill that handles secure storage, delivery, identities, and recipient trust, unintended activation can transmit artifacts, create shares, or perform remote handoff operations without sufficiently explicit user consent, increasing confidentiality and integrity risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/secure-workflows.md (reported line 30)May include surrounding context.

aispace transfer create report.pdf --sealed --link
--json --include-secret > handoff.json jq -r .token handoff.json > handoff.token chmod 600 handoff.token

text

`--include-secret` requires `--json` and is refused when stdout is a terminal. Keep the protected