ClawHub
Back to skill

Security audit

DokuTipp

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and purpose-aligned, but it relies on a downloaded public catalog and should be used with normal caution around cached data and links.

Install only if you are comfortable with the skill creating or reading PROFILE.md, downloading and caching a public media catalog, and sending recommendations through your configured output channel. Treat recommendation links as external links, and prefer added resource limits and URL validation for shared, sensitive, or low-resource environments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/parse_filmliste.py:106
Finding

Unbounded Download and Full Decompression of Remote Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/parse_filmliste.py:149
Finding

Unvalidated Remote URLs Included in Trusted Recommendation Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

This finding indicates the skill may download external data, maintain a local cache, and apply hard-coded selection logic despite presenting itself as an on-demand personalized recommender. Undisclosed network access and persistence expand the attack surface and can introduce privacy, integrity, and supply-chain risks if users or policy engines are not made aware.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
87% confidence
Finding

This finding indicates the skill may download external data, maintain a local cache, and apply hard-coded selection logic despite presenting itself as an on-demand personalized recommender. Undisclosed network access and persistence expand the attack surface and can introduce privacy, integrity, and supply-chain risks if users or policy engines are not made aware.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell execution (python3 scripts/start_curation.py) but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can allow broader-than-expected command execution in environments that rely on the manifest for sandboxing and user trust.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions explicitly require that recommendations be written in German, including a note that output must be in German even though the template is in English. This imposes a language/locale constraint without offering the user a choice or documenting a clear region-specific justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
87% confidence
Finding

This code downloads data from a remote URL via curl and writes it directly to a trusted local file that is then consumed by the workflow. While there is no shell injection here, it creates a supply-chain trust boundary: if the remote endpoint, transport, or downloaded content is compromised, the downstream parser may process malicious input and potentially fail or be exploited depending on parser robustness.

Content

Scanner excerpt · scripts/start_curation.py (reported line 30)May include surrounding context.

python
if needs_download():
    log("Downloading Filmliste-akt.xz ...")
    result = subprocess.run(["curl", "-fsSL", "-o", str(FILMLISTE), DOWNLOAD_URL])
    if result.returncode != 0:
        print("Error: Download of Filmliste-akt.xz failed.", file=sys.stderr)
        sys.exit(1)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/start_curation.py (reported line 40)May include surrounding context.

python
parser = Path(__file__).parent / "parse_filmliste.py"
log("Starting parse_filmliste.py ...")
subprocess.run(
    [sys.executable, str(parser), str(FILMLISTE), "--limit", "1337", "--min-duration", "42"],
    check=True,
)

Static analysis

No suspicious patterns detected.