ClawHub
Back to skill

Security audit

SecureVibes Scanner

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real security-scanning helper, but it combines persistent scheduled scans, networked/credential-backed tooling, and under-scoped command execution with a concrete Git argument-handling flaw.

Review before installing. Use this only on repositories and DAST targets you are authorized to test, pin and verify the securevibes CLI before production or cron use, avoid passing untrusted --remote or --branch values, and enable cron monitoring only when you are comfortable with recurring background scans and stored .securevibes artifacts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
ops/incremental_scan.py:242
Finding

Git Option Injection Through Unvalidated Remote Argument

Content
View full analysis

Vulnerability Details

File Location: ops/incremental_scan.py:82 and ops/incremental_scan.py:242-249
Vulnerability Type: Git argument injection
Risk Level: High

The scanner accepts a caller-controlled Git remote and passes it directly to git fetch in an option-sensitive position.

python
parser.add_argument("--remote", default="origin", help="Git remote")
python
result = subprocess.run(
    ["git", "fetch", remote, branch],
    cwd=repo,
    capture_output=True,
    text=True,
    timeout=timeout_seconds,
    check=False,
)

Technical Analysis

The use of a subprocess argument list prevents shell metacharacter expansion, but it does not prevent option injection into the invoked program. Because remote is placed immediately after git fetch, a value beginning with - can be parsed as a Git option instead of a remote name.

The branch argument is also caller-controlled. If the supplied remote is interpreted as an option, the branch value can shift into the repository operand. This allows an attacker to alter fetch transport behavior, remote selection, protocol parameters, or other Git-fetch semantics. Depending on the installed Git version, enabled protocols, repository configuration, and crafted arguments, this could cause unintended network access or command execution through dangerous transport mechanisms.

Attack Path

  1. An attacker controls, supplies, or persuades an operator to use crafted --remote and --branch values.
  2. The incremental scanner accepts these values without rejecting leading hyphens or validating them as configured Git remote and branch names.
  3. git_fetch() constructs git fetch with the attacker-controlled remote in an option-sensitive position.
  4. Git interprets the crafted remote as one or more command-line options rather than as a remote name.
  5. The controlled branch value may then be interpreted as the repository operand.

...[truncated 818 chars]

Remediation
View remediation

Remediation Suggestions

  1. Reject remote and branch values that are empty, contain control characters, or begin with -.
  2. Verify that the remote is an existing configured remote, for example by comparing it against the output of git remote.
  3. Validate the branch using an appropriate Git reference validation command such as git check-ref-format --branch.
  4. Use an explicit option terminator before positional arguments wherever the relevant Git command supports it.
  5. Prefer resolving the configured remote URL independently and applying an allowlist for permitted URL schemes and hosts.
  6. Disable dangerous Git transports in the scanner environment and use a restricted environment for automated fetches.
  7. Add regression tests covering remote and branch values beginning with -, transport-like values, control characters, and malformed references.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Installation of a Security-Sensitive Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

The documented prerequisite installs the latest available release of the third-party securevibes package without an exact version or integrity verification.

markdown
1. Install the CLI: `pipx install securevibes` (preferred) or `uv tool install securevibes`. Avoid `pip install` — it can create stale shims if you have multiple Python environments.

Although scripts/scan.sh checks for a minimum version, it does not enforce an audited exact version:

bash
MIN_VERSION="0.4.0"
INSTALLED_VERSION="$(securevibes --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "0.0.0")"

Technical Analysis

Unversioned package installation makes the effective executable payload dependent on the package registry's current state. A future release, compromised publisher account, package-index compromise, or malicious dependency update could therefore introduce behavior that was not present during this audit.

The minimum-version check only rejects old versions. It continues to trust every future version and does not verify an artifact hash, signature, lock file, or approved release digest. This is particularly sensitive because the CLI is intentionally run against source repositories and may inherit authentication context from the execution environment.

Attack Path

  1. The upstream package, publisher account, distribution channel, or transitive dependency is compromised, or a malicious future release is published.
  2. A user follows the documented pipx install securevibes or uv tool install securevibes instruction.
  3. The package manager installs the current unreviewed release.
  4. The wrapper accepts that release because it satisfies the minimum-version requirement.
  5. The installed executable runs while processing sensitive local repositories and with access to the ...[truncated 558 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact audited version in installation instructions, such as securevibes==0.5.2, after independently verifying that release.
  2. Publish and verify cryptographic hashes or signatures for approved distribution artifacts.
  3. Pin or lock transitive dependencies where the installation mechanism permits it.
  4. Replace the minimum-only runtime check with an allowlist of explicitly supported versions, or enforce an exact version for automated deployments.
  5. Review release notes and package contents before changing the approved version.
  6. Run the CLI in a sandbox with restricted filesystem access, minimal environment variables, and constrained outbound network access.
  7. Use a trusted internal package mirror or artifact repository for production and scheduled scanning environments.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
- Always use the `scripts/scan.sh` wrapper for full scans — it validates paths and rejects shell metacharacters before invoking `securevibes`.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill clearly instructs use of shell commands, file reads/writes, git operations, cron scheduling, and optional networked DAST, but the manifest declares no explicit tool scope or permission boundaries. That mismatch can cause the host agent to invoke the skill without clear least-privilege constraints, increasing the chance of unintended command execution or network access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description uses broad phrases like scanning code for security vulnerabilities, reviewing code for security issues, and setting up continuous monitoring, which overlap heavily with common user requests and can trigger the skill in many contexts. Without boundaries such as requiring explicit user consent for shell execution, cron setup, or network scans, the skill may be selected too aggressively for high-impact actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
| `--resume-from` | Resume from a specific phase onwards |
| `--dast` | Enable dynamic testing (requires `--target-url`) |
| `--target-url` | URL for DAST (e.g., `http://localhost:3000`) |
| `--force` | Skip prompts, overwrite existing artifacts |
| `--quiet` | Minimal output |
| `--debug` | Verbose diagnostics |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The request-to-action table maps very common phrases such as 'Scan this for security issues' and 'Quick security check' directly to shell commands, and includes setup for continuous monitoring and DAST. This creates a high risk of overbroad auto-invocation where ordinary conversational requests lead to filesystem changes, background jobs, or network activity without an explicit safety gate.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ops/incremental_scan.py (reported line 209)May include surrounding context.

python
if not repo.exists() or not repo.is_dir():
        raise RuntimeError(f"Repository path does not exist: {repo}")

    result = subprocess.run(
        ["git", "rev-parse", "--is-inside-work-tree"],
        cwd=repo,
        capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ops/incremental_scan.py (reported line 247)May include surrounding context.

python
last_error = ""
    for attempt in range(1, attempts + 1):
        try:
            result = subprocess.run(
                ["git", "fetch", remote, branch],
                cwd=repo,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ops/incremental_scan.py (reported line 276)May include surrounding context.

python
) -> str:
    """Resolve the latest commit SHA for remote branch."""
    try:
        result = subprocess.run(
            ["git", "rev-parse", f"{remote}/{branch}"],
            cwd=repo,
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ops/incremental_scan.py (reported line 303)May include surrounding context.

python
) -> bool:
    """Return True when ancestor is reachable from descendant."""
    try:
        result = subprocess.run(
            ["git", "merge-base", "--is-ancestor", ancestor, descendant],
            cwd=repo,
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ops/incremental_scan.py (reported line 331)May include surrounding context.

python
) -> list[str]:
    """Collect commits in base..head ordered oldest-to-newest."""
    try:
        result = subprocess.run(
            ["git", "rev-list", "--reverse", f"{base}..{head}"],
            cwd=repo,
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
82% confidence
Finding

The wrapper executes an external 'securevibes' binary resolved from PATH, which can be dangerous in cron or automation contexts if PATH is attacker-influenced or writable by lower-privileged users. Because this skill is specifically designed for scheduled security scans, PATH hijacking could let an attacker run arbitrary code under the scanner's privileges and falsify scan outputs.

Content

Scanner excerpt · ops/incremental_scan.py (reported line 454)May include surrounding context.

python
command.append("--debug")

    try:
        result = subprocess.run(
            command,
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
82% confidence
Finding

This since-date scan path has the same external binary execution risk as the normal scan path: 'securevibes' is looked up via PATH and then executed in an automation-friendly workflow. An attacker who can influence PATH or place a malicious binary earlier in resolution order could gain code execution and manipulate security review results.

Content

Scanner excerpt · ops/incremental_scan.py (reported line 510)May include surrounding context.

python
command.append("--debug")

    try:
        result = subprocess.run(
            command,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function pacific_today() explicitly uses the America/Los_Angeles timezone for scan behavior, and that locale choice is then used in rewrite fallback mode. This is a natural-language locale policy concern because the skill enforces a specific regional timezone without offering a user choice or documenting why that locale is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.