ClawHub
Back to skill

Security audit

plus-ultra

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built rather than deceptive, but its optional Claude Code hook broadly intercepts agent events and can persist command text in local logs.

Review carefully before enabling the Claude Code hooks. Prefer manual or pinned installation, understand that the hook can see broad agent events, and avoid putting secrets in commands because blocked command text may be retained in ~/.plus-ultra/audit.jsonl. This does not show exfiltration or destructive hidden behavior, but the logging and broad hook scope warrant Review.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/plusultra.py:261
Finding

Blocked Commands May Be Persisted in a Plaintext Audit Log

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:67
Finding

Installation Documentation Uses an Unpinned npx-Resolved Tool

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 85)May include surrounding context.

md
4. In a disposable test session, verify that an unplanned recognized mutation is blocked and
   that a changed turn requests a fresh reality verdict before completion.

The doctor checks for hook entries in `~/.claude/settings.json`; it does not prove the executable
is reachable, hooks are delivered, or enforcement works end to end.

### Record the actual verdicts

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/plusultra.py (reported line 182)May include surrounding context.

python
return "Bash"
    # MUTATING_BASH is tested BEFORE the allowlist and searches the WHOLE command.
    # SAFE_BASH is `^`-anchored, so consulting it first exempted everything chained
    # after a harmless verb — `ls; rm -rf x` and `pwd && git push` both walked straight
    # through the gate. The allowlist may now only exempt a command that contains no
    # mutating segment anywhere.
    if MUTATING_BASH.search(cmd):

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill references shell commands, environment variables, and file writes (for example, recording to ~/.plus-ultra/audit.jsonl and invoking plusultra CLI commands) but does not declare any explicit tool scope or permissions boundary. In hosts that honor tool declarations, this can cause the skill to run with broader-than-expected capabilities or leave reviewers unable to assess whether command execution and filesystem access are intended, increasing the risk of accidental or unsafe mutation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JSON manifest uses the matcher value "*" for UserPromptSubmit, which is an extremely broad activation condition with no stated constraints or exclusions. Because the file provides no negative examples or scope limits, the hook may fire for essentially any matching prompt event, which fits the vague-trigger category for manifest files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Hooking all PreToolUse events with a wildcard means every attempted tool invocation is intercepted by an external command. In this skill context, that increases the attack surface significantly because sensitive tool operations may be delayed, influenced, logged, or blocked by the hook process, and PreToolUse is especially security-relevant due to its position before consequential actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Stop hook also uses matcher "*", which provides no meaningful limitation on trigger scope. This is an ambiguous, overbroad activation condition in a manifest file and increases the risk of unintended hook execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This code creates the OFF_FLAG file with open(OFF_FLAG, "w").close(), which is a filesystem write. Although the module and surrounding messages discuss bypass behavior, this specific file write has no inline comment or user disclosure before it occurs, which fits the code-file warning criterion for file writes lacking local disclosure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_plusultra.py:13