ClawHub
Back to skill

Security audit

stack-create

Security checks for vulnerabilities and agentic risk

Overview

This skill gives straightforward Git workflow instructions for creating stacked branches, with some caution needed around branch-name validation.

Before installing, treat this as a Git-mutating helper: use it only in repositories where creating branches is intended, confirm the planned branch list before execution, and require simple validated branch names such as letters, numbers, dots, underscores, and hyphens.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:70
Finding

Unvalidated Plan-Derived Branch Names Used in Shell Commands

Content
View full analysis
/` Return to the first slice branch to begin work: ```bash git checkout ${STACK}/add-schema ``` ``` The same unsafe expansion pattern is also used during topology verification at lines 116-124: ```bash git log --oneline --graph \ ${BASE}..${STACK}/add-ui ``` ### Technical Analysis The Skill directs the Agent to derive feature and slice identifiers from plan content and insert them into shell commands. It only states that a slice should have a “short name suitable for a branch suffix”; it does not define or enforce a character allowlist. The resulting variables are expanded without double quotes. In a POSIX-like shell, unquoted parameter expansion is subject to word splitting and pathname expansion. A crafted identifier containing whitespac ...[truncated 2606 chars]
Remediation
View remediation
&2 exit 1 ;; esac ``` 2. Require identifiers to begin with an alphanumeric character and reject: - Whitespace and control characters. - Shell metacharacters. - Command-substitution syntax. - Wildcard characters. - Leading hyphens. - Git-special reference forms such as `..`, `@{`, and repeated or trailing slashes. - Values rejected by `git check-ref-format --branch`. 3. Quote every variable expansion: ```bash git checkout -b "${STACK}/add-schema" "${BASE}" git checkout -b "${STACK}/add-api" "${STACK}/add-schema" git checkout -b "${STACK}/add-ui" "${STACK}/add-api" git checkout -- "${STACK}/add-schema" git log --oneline --graph "${BASE}..${STACK}/add-ui" ``` 4. Prefer modern, explicit branch operations where available: ```bash git switch -c "${STACK}/add-schema" "${BASE}" git switch -- "${STACK}/add-schema" ``` 5. Validate complete references before executing Git commands: ```bash git check-ref-format --branch "${STACK}/add-schema" >/dev/null || { echo "Invalid branch name" >&2; exit 1; } ``` 6. Explicitly instruct the Agent never to copy plan-derived text directly into executable shell source. Values should be passed as data through safely quoted variables or structured tool arguments. 7. Construct the full branch list, validate every entry, and display it for user confirmation before creating or checking out any branch. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
70% confidence
Finding

Overly Broad Trigger: 'pr' is too short and may match unintended inputs

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.