ClawHub
Back to skill

Security audit

Skill Review

Security checks for vulnerabilities and agentic risk

Overview

This is a real security scanner, but its analysis agent can run broad shell commands, fetch arbitrary URLs, and inspect paths without strong containment.

Review before installing. Run this only in an isolated, disposable environment with no sensitive files or credentials available, mount the target skill read-only, restrict network access away from private/internal addresses, and pin or lock dependencies before trusting results.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
src/tools.mjs:532
Finding

Model-Controlled Commands Are Executed Through an Unrestricted System Shell

Content
View full analysis
{ const rawCommand = String(params.command || ""); const command = rawCommand .replace(/<\/?tool_call>/gi, " ") .replace(/<\/?function_call>/gi, " ") .replace(/<\/?tool>/gi, " ") .replace(/<\/?function>/gi, " ") .replace(/[{}]+$/g, "") .trim(); if (!command) { throw new Error("Command failed: empty command after sanitization"); } try { const stdout = execSync(command, { encoding: "utf-8", timeout: 30_000, maxBuffer: 1024 * 1024, cwd, }); return { content: [{ type: "text", text: stdout || "(no output)" }], details: { command, rawCommand }, }; } catch (err) { const msg = err.stderr || err.stdout || err.message; throw new Error(`Command failed: ${msg}`); } }, }; } ``` ### Technical Analysis The scanner exposes a general-purpose shell t ...[truncated 2592 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/tools.mjs:439
Finding

Binary Analysis Accepts Paths Outside the Audited Skill Directory

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/tools.mjs:296
Finding

Model-Controlled URL Analysis Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/config.mjs (reported line 10)May include surrounding context.

js
* Initialize configuration. Can only be called once.
 * @param {string} [configFile] - Optional path to a JSON config file.
 *
 * Precedence: .env > inherited shell environment > JSON config file.
 */
export function loadConfig(configFile) {
  if (_config) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/config.mjs (reported line 28)May include surrounding context.

js
* Initialize configuration. Can only be called once.
 * @param {string} [configFile] - Optional path to a JSON config file.
 *
 * Precedence: .env > inherited shell environment > JSON config file.
 */
export function loadConfig(configFile) {
  if (_config) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/config.mjs (reported line 32)May include surrounding context.

js
* Initialize configuration. Can only be called once.
 * @param {string} [configFile] - Optional path to a JSON config file.
 *
 * Precedence: .env > inherited shell environment > JSON config file.
 */
export function loadConfig(configFile) {
  if (_config) {

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · src/prompts.mjs (reported line 81)May include surrounding context.

js
### Layer-specific rules
- **\`obfuscation_binary\`**: reviewed \`risk_score: 0\` entries are allowed so the user can see what was checked, but do NOT call an artifact safe based only on its filename, extension, location, or commonness. Metadata-like or cache-like files are not automatically safe; if the skill decodes, loads, extracts from, or otherwise uses them in an execution path, judge them from that behavior rather than from the filename alone.
- **\`dependencies\`**: for every declared or undeclared-but-referenced npm/PyPI dependency you identify, you MUST verify it with \`deepAnalysis\` first and include exactly one result entry for that dependency in \`findings.dependencies\`, even when it appears safe. Do NOT judge a dependency from its name, scope, brand, or your own prior knowledge alone. Score 0 only when \`deepAnalysis\` and surrounding context support benign usage consistent with declared purpose.
- **\`code_quality\`**: this layer is problem-oriented. If there is no real issue, return an empty array and do NOT output safe or praise-only entries.

## Output format

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill exposes a general-purpose shell execution primitive via execSync on attacker-controlled input, with only superficial string sanitization that removes a few tag-like tokens but does not restrict commands or shell metacharacters. In a security-review skill, this is especially dangerous because reviewing untrusted skill content can influence tool usage, turning the scanner into a command-execution surface that can read sensitive files, access the network through shell utilities, or modify the local environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documentation claims commands should be read-only and must not execute target files, but the implementation does not enforce any of those constraints before passing the full string to execSync. This creates a dangerous mismatch where callers may trust the safety guidance while an adversarial prompt or file content can still cause destructive commands, script execution, exfiltration, or environment tampering.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · index.mjs (reported line 72)May include surrounding context.

js
await runPrompt(
    agent,
    "Your previous response did not contain valid JSON. Output ONLY the final JSON block now, with no extra text. Do not call any tools. Do not add explanation before or after the JSON.",
    label
  );

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a security scanner for Claude Code Skill packages, which is primarily an analysis/review function. This file invokes the host's which command via execFileSync to enumerate installed tools, introducing subprocess execution and host environment inspection that are not obviously required by the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The function accumulates the full assistant text output and returns it for later retrieval, effectively capturing the complete model transcript. For a code file, this is a data-handling behavior that lacks any visible warning, comment about privacy implications, or user-facing disclosure beyond the minimal functional description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code logs full tool invocation details, including raw bash commands and serialized tool arguments, which may expose sensitive user or system data in logs. While the behavior is implemented intentionally, the file contains no user-facing warning, confirmation, or disclosure about this potentially sensitive logging behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The URL analysis routine performs outbound network requests to arbitrary supplied URLs, follows redirects, and captures response metadata and preview content without any user-facing disclosure at invocation time. This can leak analyzer IP/network metadata to third parties, trigger SSRF-style access to internal resources if attacker-controlled URLs are analyzed, and retrieve potentially sensitive content into the analysis output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The bash tool enables subprocess execution without any runtime warning, confirmation, or hard enforcement of safe behavior, despite operating in the context of untrusted skill reviews. Even if intended for inspection, silent shell access materially increases the chance that malicious skill content or prompt injection causes sensitive local command execution before the user understands the risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The dependency is specified with a caret range, which allows newer compatible versions to be installed over time. This can introduce supply-chain risk because a later published version of the package or one of its transitive dependencies could change behavior or become compromised without the skill author explicitly reviewing and pinning that update.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"main": "index.mjs",
  "type": "module",
  "dependencies": {
    "@mariozechner/pi-agent-core": "^0.63.1",
    "dotenv": "^17.3.1"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The dotenv dependency is also defined with a caret range, so installs may resolve to newer releases than originally tested. In a security-review skill, even small supply-chain changes are meaningful because the tool may be trusted to evaluate other packages and could be a target for dependency compromise.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json
"type": "module",
  "dependencies": {
    "@mariozechner/pi-agent-core": "^0.63.1",
    "dotenv": "^17.3.1"
  }
}