ClawHub
Back to skill

Security audit

deferred-capture

Security checks for vulnerabilities and agentic risk

Overview

The skill is documentation-only and mostly coherent, but its contract can cause wrappers to publish verbatim context plus local/session metadata into GitHub issues without required redaction or confirmation.

Review any wrapper built from this contract before using it on private or customer work. Ensure it redacts secrets, avoids absolute paths and sensitive session IDs, previews the issue body, and requires confirmation before creating issues, especially in public repositories.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:45
Finding

Sensitive Context and Local Metadata May Be Published Without Safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–49 and 63–71
Vulnerability Type: Sensitive information exposure through unsafe issue-generation requirements
Risk Level: Medium

Relevant Code Snippet:

markdown
- `--session-id` (str): Session ID. Canonical source:
  `$CLAUDE_SESSION_ID` env var, fallback: UTC timestamp
  `YYYYMMDD-HHMMSS`
- `--artifact-path` (str): Absolute path or `$HOME`-based
  path to source artifact
- `--captured-by` (str): `explicit` (default) or `safety-net`
markdown
**Source:** <source> (session <session-id>)
**Captured:** <YYYY-MM-DD>
**Branch:** <current git branch>
**Captured by:** <explicit|safety-net>

### Context

<context argument verbatim>

### Original Artifact

<artifact-path if provided, otherwise "N/A">

Technical Analysis

The deferred-capture contract directs conforming wrappers to include a session identifier, current Git branch, context supplied verbatim, and an optional absolute or home-based local path in a GitHub issue. GitHub issues are remote records whose audience depends on repository visibility and collaborator access.

The specification does not require secret detection, redaction, repository-visibility validation, path normalization, a sanitized preview, or explicit confirmation before publication. Consequently:

  • Verbatim context can contain API keys, access tokens, internal URLs, customer data, or confidential discussion.
  • An absolute or $HOME-based path can disclose usernames, workstation directory layouts, internal project names, or mounted resources.
  • Branch names can reveal unreleased features, incident identifiers, customer names, or internal ticket references.
  • Session identifiers can expose operational metadata and facilitate correlation across logs or systems.

This is a specification-level insecure coding practice. The repository contains documentat ...[truncated 1684 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not publish $CLAUDE_SESSION_ID by default. Use a newly generated non-sensitive correlation identifier where tracking is necessary.
  2. Replace absolute and $HOME-based paths with repository-relative paths or basenames. Reject paths outside the repository root unless the user explicitly approves them.
  3. Add secret scanning and redaction for common API keys, tokens, private keys, credentials, connection strings, and sensitive URL parameters.
  4. Sanitize branch names and all user-controlled fields, including control characters and unexpected markup.
  5. Present the complete, sanitized issue title and body for review before remote submission.
  6. Require explicit confirmation for non-dry-run creation, especially when the target repository is public.
  7. Document that context must not contain secrets, personal data, customer information, or confidential discussion.
  8. Add automated tests confirming that sensitive values and absolute paths are blocked or redacted.
  9. Prefer an allowlist of necessary metadata rather than transmitting all available contextual information.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The CLI interface explicitly says --source must be one of the enumerated labels on L038-L039, but the compliance example invokes the wrapper with --source test on L118. This is an active documentation-level contradiction about the contract the skill claims to define.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.