ClawHub
Back to skill

Security audit

safety-critical-patterns

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent guidance, but it gives unsafe validation advice for financial-style code and has overly broad activation triggers.

Review this skill carefully before installing for financial, medical, safety-critical, or production code work. Its general NASA-style checklist is transparent, but users should treat Python assert examples as internal invariant documentation only and require explicit validation for untrusted input, authorization, financial rules, and safety constraints.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:70
Finding

Security-Critical Validation Implemented with Removable Python Assertions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70–77
Vulnerability Type: Insecure validation guidance
Risk Level: Medium

Complete Code Snippet

python
### 5. Assertion Density
Include defensive assertions documenting expectations.

```python
def transfer_funds(from_acct, to_acct, amount):
    assert from_acct != to_acct, "Cannot transfer to same account"
    assert amount > 0, "Transfer amount must be positive"
    assert from_acct.balance >= amount, "Insufficient funds"
    # ... implementation

Technical Analysis

The skill recommends Python assert statements to enforce essential financial transaction rules, including positive transfer amounts, distinct source and destination accounts, and sufficient funds.

Python assertions are intended for debugging and internal consistency checks, not security controls or business-rule validation. They are removed when Python runs with optimization enabled, such as through python -O, python -OO, or an applicable PYTHONOPTIMIZE setting. Under those conditions, none of the displayed checks execute.

Because this guidance is explicitly presented for safety-critical and financial code, adopting the pattern could cause production behavior to differ from tested behavior and leave transaction-integrity constraints unenforced.

Attack Path

  1. A developer or coding agent follows the skill and implements financial validation using assert.
  2. The application is deployed with Python optimization enabled.
  3. Python removes the assertion statements from the executed bytecode.
  4. An attacker submits a prohibited transaction, such as a negative amount, an underfunded transfer, or a same-account transfer.
  5. If the omitted implementation performs no independent validation, processing continues and the intended financial invariants may be violated.

Impact Assessment

This issue does not directly grant operating-system privileges. Its scope is the application and data governed by ...[truncated 339 chars]

Remediation
View remediation

Remediation Suggestions

Replace security-sensitive and business-rule assertions with unconditional runtime validation:

python
def transfer_funds(from_acct, to_acct, amount):
    if from_acct == to_acct:
        raise ValueError("Source and destination accounts must differ")
    if amount <= 0:
        raise ValueError("Transfer amount must be positive")
    if from_acct.balance < amount:
        raise InsufficientFundsError("Insufficient funds")
    # ... implementation

Update the skill to clearly distinguish between:

  • Explicit validation for untrusted input, authorization decisions, financial rules, and safety constraints.
  • Assertions used only for internal invariants whose removal cannot change security or business correctness.

Also recommend centralized validation, domain-specific exceptions, atomic transaction handling, authorization checks, concurrency-safe balance verification, and tests executed both with and without Python optimization.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is overly broad and includes generic or fragmented terms such as "safety," "medical," and "or high-reliability system code," which can cause the skill to activate in contexts far beyond its intended scope. In an agent environment, overbroad activation can inappropriately bias reviews or inject prescriptive guidance into unrelated tasks, reducing reliability and potentially affecting sensitive workflows.

Content

No source excerpt is available for this finding.