ClawHub
Back to skill

Security audit

Desktop Sandbox

Security checks for vulnerabilities and agentic risk

Overview

This skill is a native installer that mostly does what it says, but it downloads and runs mutable GitHub release installers with weak safeguards, so users should review it carefully before use.

Only install this if you trust the AtlasCore GitHub release process and are comfortable running a native installer on your machine. Prefer a pinned version, verify the downloaded installer through an independent checksum or platform signature, and review the repository/release before allowing the skill to execute it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/run_installer.js:296
Finding

Remote Installer Is Downloaded and Executed Without Integrity or Authenticity Verification

Content
View full analysis
{ writeLog(`Running installer with open -W...`); const proc = spawn('open', ['-n', '-W', installerPath], { stdio: 'inherit' }); proc.on('error', err => { resolve({ success: false, exitCode: -1, message: `Failed to execute installer: ${err.message}` }); }); proc.on('close', code => { const duration = (Date.now() - startTime) / 1000; const success = code === 0; resolve({ success, exitCode: code, message: success ? 'Installation completed successfully' : `Installer exited with code: ${code}`, duration }); }); })().catch(err => { resolve({ success: false, exitCode: -1, message: `Installer flow failed: ${err.message}` }); }); } else { const psScript = `Start-Process -FilePath '${installerPath}' -ArgumentList '/S', '/D=C:\\Program Files\\' -WindowStyle Hidden -Wait`; const proc = spawn('po ...[truncated 2652 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/run_installer.js:107
Finding

Unrestricted Redirect Handling Permits Host Changes and HTTPS Downgrade

Content
View full analysis
{ if (response.statusCode === 302 || response.statusCode === 301) { file.close(); downloadFile(response.headers.location, dest).then(resolve).catch(reject); return; } ``` ### Technical Analysis The downloader recursively follows HTTP 301 and 302 responses without validating the redirect destination. The protocol is selected from the redirected URL, and both `https` and `http` are supported. Therefore, an initially trusted HTTPS request may be redirected to: - An untrusted external hostname. - A plain HTTP URL. - An internal or otherwise unintended endpoint. - Another redirect, with no maximum redirect count. TLS protects only each HTTPS connection; it does not establish that an unrestricted redirect destination is authorized to provide the executable. If the flow is downgraded to HTTP, an on-path attacker can alter the installer bytes. Because the downloaded file is subsequently executed without digest or signature verification, payload substitution becomes code execution. The lack of a redirect limit also allows an attacker-controlled endpoint to create an unbounded recursive redirect chain, consuming resources or causing the installer operation to fail. ### Attack Path 1. An attacker gains control of a release asset URL, redirect response, or destination in the download chain. 2. The server returns a 301 or 302 response whose `Location` header points to an attacker-controlled host or an HTTP URL. 3. `d ...[truncated 963 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/run_installer.js:253
Finding

Remote Asset Name Is Interpolated into a PowerShell Command

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to install software from GitHub releases via a Node-based installer that invokes platform-native package installation mechanisms, but it does not warn the user that this performs system-level changes. Because the described behavior includes executing .exe and .pkg installers into privileged locations, users may be exposed to unexpected software installation, privilege prompts, or persistence risks without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The conversation triggers are very broad and generic, especially phrases like 'Install desktop sandbox' and 'Download and install AtlasCore sandbox'. In an agent environment, broad activation phrases can cause this skill to be selected for ordinary install-related requests and lead to unexpected execution of a system-level installer, increasing the chance of unintended software installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_installer.js (reported line 175)May include surrounding context.

js
async function fetchGitHubRelease(owner, repo, specificVersion = '') {
    const apiUrl = specificVersion
        ? `https://api.github.com/repos/${owner}/${repo}/releases/tags/${specificVersion}`
        : `https://api.github.com/repos/${owner}/${repo}/releases/latest`;

    writeLog(`Fetching from: ${apiUrl}`);

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run_installer.js (reported line 176)May include surrounding context.

js
async function fetchGitHubRelease(owner, repo, specificVersion = '') {
    const apiUrl = specificVersion
        ? `https://api.github.com/repos/${owner}/${repo}/releases/tags/${specificVersion}`
        : `https://api.github.com/repos/${owner}/${repo}/releases/latest`;

    writeLog(`Fetching from: ${apiUrl}`);

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/run_installer.js:53