ClawHub
Back to skill

Security audit

Fetch Pr Feedback

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it automatically feeds PR comments from other users into a downstream execution workflow, which needs human review before use.

Install only if you are comfortable letting PR reviewer comments drive an agent workflow. Use it on trusted repositories, inspect the formatted feedback before any changes are made, and ensure the receive-feedback skill independently verifies each item and asks before running commands or editing files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:214
Finding

Untrusted PR Comments Are Passed into an Agent Execution Workflow

Content
View full analysis
` sections. They do not enforce a security boundary between review content and agent instructions. Arbitrary directives that do not match the cleanup patterns remain intact. The skill also does not require explicit user approval before the downstream execution phase. Consequently, a malicious reviewer or compromised review bot can phrase prompt-injection instructions as actionable feedback. Whether those instructions produce harmful actions depends on the safeguards in the separately loaded `receive-feedback` skill and the tools and permissions available to the agent. That referenced skill was not present in the audited project, so its controls could not be verified. ### Attack Path 1. An attacker obtains permission to submit a PR review or issue comment on the target pull request, or compromises an authorized review bot. 2. The attacker posts a comment containing plausible review feedback to ...[truncated 1419 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:95
Finding

Predictable Shared Temporary Files Permit Symlink and Race Attacks

Content
View full analysis
/tmp/issue_comments.jq << 'JQEOF' ``` The resulting fixed file is subsequently consumed here: ```bash gh api --paginate "repos/$OWNER/$REPO/issues/$PR_NUMBER/comments" | \ jq -s --arg pr_author "$PR_AUTHOR" --arg current_user "$CURRENT_USER" \ -f /tmp/issue_comments.jq ``` The same pattern is repeated for review comments: ```bash cat > /tmp/review_comments.jq << 'JQEOF' ``` ```bash gh api --paginate "repos/$OWNER/$REPO/pulls/$PR_NUMBER/comments" | \ jq -s --arg pr_author "$PR_AUTHOR" --arg current_user "$CURRENT_USER" \ --argjson resolved_ids "$RESOLVED_IDS" \ -f /tmp/review_comments.jq ``` ### Technical Analysis The skill writes jq programs to predictable filenames in the globally shared `/tmp` directory. Ordinary shell redirection does not securely create a new private file and follows symbolic links. The instructions do not check whether either path already exists, verify file ownership, use exclusive creation, establish restrictive permissions, or remove the files after use. This creates two related local attack opportunities: - **Symlink attack:** A local attacker can pre-create one of the predictable paths as a symbolic link. The shell redirection may then truncate and overwrite the linked destination with the privileges of the process running the skill. - **Time-of-check/time-of-use race:** An attacker with appropriate local access can replace or modify the filter after it is written but before `jq -f` reads it. This can change filtering behavior or cause attacker-selected jq logic to process GitHub API responses. The jq language is not equivalent to arbitrary shell execution, but a manipulated filter can falsify, suppress, or expose fetched review data and can disrupt the skill's security gates. The overwrite consequence depends on the ...[truncated 1649 chars]
Remediation
View remediation
&2 exit 1 } trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM ISSUE_FILTER="$TMP_DIR/issue_comments.jq" REVIEW_FILTER="$TMP_DIR/review_comments.jq" cat > "$ISSUE_FILTER" << 'JQEOF' # jq filter content JQEOF cat > "$REVIEW_FILTER" << 'JQEOF' # jq filter content JQEOF gh api --paginate "repos/$OWNER/$REPO/issues/$PR_NUMBER/comments" | jq -s \ --arg pr_author "$PR_AUTHOR" \ --arg current_user "$CURRENT_USER" \ -f "$ISSUE_FILTER" ``` The same private path should be used for the review-comment filter. The implementation should preserve pipeline failures with appropriate shell error handling, such as `set -o pipefail`, so a failed API request cannot be mistaken for valid empty output. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.