ClawHub
Back to skill

Security audit

Contacts

Security checks for vulnerabilities and agentic risk

Overview

This contacts skill is mostly purpose-aligned, but it can automatically persist contact identifiers and includes an unvalidated lookup script that can read YAML files outside the intended contacts folder.

Review before installing. This skill is appropriate only if you want the agent to keep a persistent contacts memory, including messaging identifiers and preferences. Use explicit confirmation before adding or updating contacts, and restrict contact_id values to safe characters such as letters, numbers, underscores, and hyphens before using the helper scripts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/get.sh:12
Finding

Path Traversal Through an Unvalidated Contact Identifier

Content
View full analysis

Vulnerability Details

File Location: scripts/get.sh:12-13
Related Unsafe Guidance: SKILL.md:101
Vulnerability Type: Path traversal and unauthorized file disclosure
Risk Level: Medium

Vulnerable Code

bash
if [ -f "$CONTACTS_DIR/$1.yaml" ]; then
    cat "$CONTACTS_DIR/$1.yaml"

Technical Analysis

The script directly incorporates the first command-line argument into a filesystem path. Although the variable is quoted, quoting only prevents shell word splitting and command injection; it does not prevent directory traversal.

An identifier containing ../ components can cause the resolved path to escape memory/contacts/contacts.d/. The .yaml suffix limits targets to paths ending in that extension, while the -f check limits disclosure to existing regular files, but neither control ensures that the target remains inside the intended contacts directory.

The contact-creation workflow documented at SKILL.md:101 also instructs the Agent to use the contact identifier as a filename without specifying validation. If implemented literally, the same identifier weakness could permit creation or replacement of YAML files outside the contacts directory.

Attack Path

  1. An attacker supplies a crafted contact identifier containing parent-directory components, such as ../../../../target.

  2. The Agent or user invokes:

    bash
    scripts/get.sh '../../../../target'

  3. The script constructs a path equivalent to:

    text
    memory/contacts/contacts.d/../../../../target.yaml

  4. The operating system resolves the parent-directory components, causing the path to escape the intended contacts directory.

  5. If the resulting YAML file exists and is readable by the Agent process, the script outputs its complete contents.

  6. If the same malicious identifier is accepted during the documented contact-creation process, an Agent implementation may create or overwrite a ...[truncated 632 chars]

Remediation
View remediation

Remediation Suggestions

  1. Enforce a strict allowlist for contact identifiers before constructing any path. For example:

    bash
    contact_id="${1:-}"

case "$contact_id" in
    ""|*[!A-Za-z0-9_-]*)
        echo "Invalid contact ID" >&2
        exit 1
        ;;
esac

  2. Canonicalize the contacts directory and candidate file, then verify that the candidate remains beneath the intended directory before reading it.

  3. Apply identical identifier validation to every contact-creation or update workflow. Do not permit path separators, .., control characters, or empty identifiers.

  4. For contact creation, use exclusive file creation to avoid unintended overwrites and set restrictive permissions, such as owner-only read and write access.

  5. Add automated tests covering identifiers with absolute paths, repeated ../ components, backslashes, whitespace, control characters, and valid boundary-length identifiers.

  6. Update SKILL.md and memory/contacts/schema.md to define the permitted contact identifier format explicitly, such as ^[A-Za-z0-9_-]+$.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions are broad enough to activate on many ordinary communication tasks, which can cause the agent to read from or write to the contacts memory store in situations where the user did not clearly request contact-book operations. Because this skill handles identifiers like open_id, chat_id, and account_id, over-activation increases the chance of unnecessary exposure or persistence of contact data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The schema example hard-codes language: "中文", which can imply a default language expectation without documenting user choice or opt-in. Because policy violations can appear in natural-language examples and config-like content, a fixed locale should be optional or explicitly user-selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains user-facing natural-language documentation entirely in Chinese, including section headings and field descriptions. The file does not indicate that the skill is region-specific or provide any user opt-in for language, which can violate a language/locale policy requiring neutral or user-selectable language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.