ClawHub
Back to skill

Security audit

feature-review

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a feature-prioritization helper, but it tells the agent to automatically run a local Python script that could execute untrusted project code.

Review this skill before installing. The analysis and scoring parts are ordinary, but the deferred-capture step should be removed or changed to require explicit confirmation, use a trusted bundled helper, and pass arguments safely without shell interpolation. Be aware that GitHub issue creation and research enrichment can also touch external services when requested.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Error
Location
SKILL.md:233
Finding

Automatic Execution of an Untrusted Repository-Relative Script

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 233-244
Vulnerability Type: Untrusted local tool execution through path resolution
Risk Level: High

Vulnerable Code

markdown
**Deferred capture for high-scoring suggestions:**
After the user confirms which suggestions to act on, any
high-scoring suggestion (score > 2.5) that is not acted on
should be preserved as a deferred item.
Run once per skipped high-scoring suggestion:

```bash
python3 scripts/deferred_capture.py \
  --title "<suggestion title>" \
  --source feature-review \
  --context "RICE score: <score>. <description>"

This runs automatically without prompting the user.

text

### Technical Analysis

The Skill instructs the Agent to execute `scripts/deferred_capture.py` automatically. That script is not included in the audited Skill package, and the command refers to it through a relative path.

When the Skill runs from the target project's working directory, this relative path can resolve to a file controlled by that project. A malicious or compromised repository can therefore provide its own `scripts/deferred_capture.py`. The Skill's instruction to run the script automatically would cause that repository-controlled Python code to execute with the privileges of the Agent process.

This behavior exceeds the minimum privileges needed for feature scoring and backlog review. Recording a deferred suggestion does not require executing arbitrary code supplied by the repository under review.

### Attack Path

1. An attacker creates or modifies a repository so that it contains a malicious `scripts/deferred_capture.py`.
2. The repository is submitted for feature review.
3. The Skill identifies a suggestion with a score greater than 2.5.
4. The user chooses not to act on that suggestion.
5. The Skill follows its automatic deferred-capture instruction.
6. `python3` resolves `scripts/deferred_capture.py` relative to the repository and executes the attacker's cod
...[truncated 937 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to execute the helper automatically.
  2. Require explicit user approval after displaying the exact operation, destination, and data that will be written.
  3. Bundle the helper inside the trusted Skill package rather than resolving it from the repository under review.
  4. Resolve the bundled helper through a canonical absolute path rooted in the verified Skill installation directory.
  5. Verify the helper's integrity before execution, such as through a package manifest or cryptographic hash.
  6. Reject helper paths that resolve outside the trusted Skill directory, including through symbolic links.
  7. Prefer a constrained file-write API over arbitrary Python execution when recording deferred suggestions.
  8. Run any unavoidable helper in a sandbox with minimal filesystem access, no inherited secrets, and network access disabled unless strictly required.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:237
Finding

Shell Command Injection Through Repository-Derived Suggestion Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 237-242
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash
python3 scripts/deferred_capture.py \
  --title "<suggestion title>" \
  --source feature-review \
  --context "RICE score: <score>. <description>"

Technical Analysis

The command template interpolates a suggestion title, score, and description into a shell command. Titles and descriptions may be derived from repository documentation, backlog entries, issue text, or other attacker-influenced project content.

Placing these values inside double quotes does not make shell interpolation safe. In common shells, command substitutions such as $(command) and backtick substitutions are evaluated inside double-quoted strings. An embedded double quote can also terminate the intended argument and expose subsequent shell metacharacters.

The Skill does not require validation, escaping, or a structured process-execution API. Because deferred capture is described as automatic, a crafted repository-derived value may reach the shell without a user reviewing the resulting command.

Attack Path

  1. An attacker places crafted text in a feature name, backlog entry, or project documentation that the Skill will use as a suggestion title or description.
  2. The text contains shell syntax, such as command substitution or a quote followed by shell operators.
  3. The Skill scores the resulting suggestion above 2.5.
  4. The suggestion is not selected for immediate action, triggering deferred capture.
  5. The Agent substitutes the attacker-controlled text into the documented shell command.
  6. The shell evaluates the injected syntax before or while launching Python.
  7. The injected command executes with the Agent process's privileges.

For example, a title containing shell command-substitution syntax could cause the shell to execute that substitution even though the title appears between double ...[truncated 650 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not construct shell command strings from repository-derived content.
  2. Invoke the helper through a structured process API that accepts an argument array and does not launch a shell. Conceptually, pass arguments as separate values:
    • python3
    • trusted absolute helper path
    • --title
    • title value
    • --source
    • feature-review
    • --context
    • context value
  3. Treat titles, descriptions, and scores as untrusted data regardless of whether they were generated by the Agent.
  4. Apply length limits and reject control characters before passing values to another process.
  5. If structured process execution is unavailable, serialize the deferred item to a safely created JSON file and pass only a trusted file path to a verified helper.
  6. Avoid relying solely on shell escaping, as correct escaping is shell- and platform-dependent.
  7. Display the exact deferred item and require explicit confirmation before performing the write.
  8. Add tests covering embedded quotes, dollar signs, command substitutions, backticks, newlines, semicolons, pipes, and redirection operators.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes generic terms like "roadmap," standalone methodology names like "RICE," "WSJF," and "Kano," and a broad natural-language phrase, which could overlap with ordinary product discussion rather than a clear request to invoke this skill. Although the document later describes when to use the skill, the trigger section itself does not provide tight activation constraints or negative examples to prevent unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document first states that GitHub issue creation requires user confirmation, then introduces an automatic deferred-capture action that runs without prompting the user. This inconsistency can mislead users and downstream agents into believing all write actions are consent-gated, when in fact a local write/command execution path is explicitly exempted.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to automatically execute a local Python script to persist deferred suggestions, creating a side effect outside the core review task. In a documentation-driven agent system, this expands capability from analysis into local code execution and file/data mutation without a fresh user confirmation, which is unsafe if the script, arguments, or environment are untrusted or have broader effects than described.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The deferred-capture behavior performs a write-oriented action via a local script without a clear warning or consent step at the point of execution. Because the skill is a prioritization tool rather than an execution tool, hidden or implicit data-writing behavior is more dangerous in context: users reasonably expect analysis, not autonomous local state changes.

Content

No source excerpt is available for this finding.