ClawHub
Back to skill

Security audit

notes-pack-rich

Security checks for vulnerabilities and agentic risk

Overview

This local backup tool needs review because an unchecked archive name can cause it to delete an unrelated file.

Check both configured paths and keep a separate backup before running. Prefer a version that confines the destination to the intended archive location and preserves the previous backup until its replacement passes validation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Deletes any existing archive without disclosing the destructive replacement.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The script unconditionally deletes the existing archive before creating and validating its replacement, so a packaging failure can destroy the previous backup. Additionally, archive_name is not constrained to a safe filename, allowing a configuration value containing parent-directory traversal to target another file writable by the executing user. Replacement is plausible for a packaging utility, but undisclosed deletion and the lack of path validation make this an unsafe implementation.

Content

No source excerpt is available for this finding.

Permission 'shell' is declared but no corresponding code capability (shell) was detected.

Low
Category
MCP Least Privilege
Confidence
65% confidence
Finding

Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Content

No source excerpt is available for this finding.