ClawHub
Back to skill

Security audit

Jules CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a clear Jules CLI helper, but its documented command pattern can accidentally run local shell commands from task text.

Review before installing. The skill is not deceptive and its Jules workflow is disclosed, but users should avoid passing untrusted or unsanitized task text through the documented shell command. Prefer invoking `jules` with shell processing disabled or using a task file/stdin mechanism if the CLI supports it, and inspect any remote changes before applying them locally.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:47
Finding

Shell Command Injection Through Unsafely Interpolated Task Descriptions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:47-50, 76-80; duplicated in references/usage.md:19-23
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

From SKILL.md:47-50:

markdown
2.  **Quoting**: Always wrap shell placeholders in double quotes (e.g., `"<repo>"`).
3.  **No Inline Injection**: Never embed user-provided data directly into script strings (like `python3 -c`). Use environment variables to pass such data safely.
4.  **Sanitization**: Ensure task descriptions do not contain malicious shell characters if passed directly to the shell.

From SKILL.md:76-80:

bash
# Capture the output to get the ID
# Replace <repo> and task description with validated inputs
jules remote new --repo "<repo>" --session "Detailed task description" < /dev/null

The same unsafe invocation pattern appears in references/usage.md:19-23:

bash
### 1. New Session
Always quote the repository name and session description.
```bash
jules remote new --repo "<repo>" --session "Detailed task description" < /dev/null
text

### Technical Analysis

The documented workflow directs an agent to replace `"Detailed task description"` with task content and execute the resulting command through a shell. Double quotes preserve argument grouping but do not suppress shell substitutions. Constructs such as `$(command)` and backtick command substitutions are still evaluated by the shell before the `jules` process starts.

The general instruction to sanitize malicious shell characters does not define an enforceable validation algorithm or safe encoding procedure. It is therefore insufficient for arbitrary task descriptions, which naturally may contain punctuation, code, paths, quotation marks, or shell syntax. This also conflicts with the document's more secure principle of not embedding user-provided data directly into command strings.

Explic
...[truncated 1771 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not construct a shell command by interpolating repository names, session IDs, or task descriptions.
  2. Invoke jules through an argument-array API with shell processing disabled. For example, an implementation in Python should use subprocess.run([...], shell=False) and provide every value as a distinct array element.
  3. If the Jules CLI supports reading a task from a file or standard input, use that interface so arbitrary task text is treated as data rather than shell syntax.
  4. Retain strict allowlist validation for repository names and session IDs. Validate the complete value and reject newline characters or unexpected delimiters.
  5. Do not attempt to support free-form task descriptions with a restrictive character allowlist unless the permitted syntax is clearly documented, because legitimate coding tasks commonly contain shell metacharacters.
  6. If a shell is unavoidable, apply a proven platform-specific argument-escaping function to each complete argument immediately before invocation. Do not rely on manually adding double quotes.
  7. Update both SKILL.md and references/usage.md so that the reference documentation cannot reintroduce the unsafe pattern.
  8. Add adversarial tests covering descriptions containing command substitutions, backticks, quotation marks, newlines, semicolons, redirections, and variable expansions. Verify that these values reach Jules literally and never execute locally.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.