ClawHub
Back to skill

Security audit

Audio Rename

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward audio-file renaming helper, but users should review paths carefully because it can rename batches of local files.

Install only if you want a local helper that renames audio files. Confirm the exact file or directory before batch mode, avoid passing slashes or '..' in custom names, and prefer audio-specific prompts such as "rename audio" rather than the generic "fix filename" trigger.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
audio-rename.py:41
Finding

Path Traversal Through Unrestricted Python Rename Destination

Content
View full analysis

Vulnerability Details

File Location: audio-rename.py, lines 41-51
Vulnerability Type: Unrestricted destination path / path traversal
Risk Level: Medium

python
# Ensure ext starts with dot
if ext and not ext.startswith('.'):
    ext = '.' + ext
elif not ext:
    ext = '.m4a'  # default extension

new_filename = f"{new_name}{ext}"
new_path = os.path.join(dir_path, new_filename)
new_path = get_unique_path(new_path)

os.rename(file_path, new_path)

Technical Analysis

The new_name argument is incorporated into the destination path without validating that it is a simple filename. Values containing ../ can escape the source directory. If new_name is absolute, os.path.join(dir_path, new_filename) discards dir_path and uses the attacker-supplied absolute destination.

The extension added by the implementation limits the final filename but does not prevent relocation into another writable directory. The code also checks destination availability with os.path.exists() in get_unique_path() before separately calling os.rename(). This creates a time-of-check-to-time-of-use window: another process can create the selected destination after the check, and os.rename() can replace it on platforms where replacement is permitted.

Exploitation requires control over the second command-line argument and access to a source file that the process can rename.

Attack Path

  1. An attacker or untrusted workflow invokes the script with a valid source audio file.
  2. The attacker supplies a destination name containing traversal components, such as ../../target/location/audio, or an absolute destination such as /tmp/target.
  3. The script appends the source extension and passes the resulting path to os.path.join().
  4. The computed destination resolves outside the source file's directory.
  5. os.rename() moves the source file into the unintended location, provided the process has filesyst ...[truncated 850 chars]
Remediation
View remediation

Remediation Suggestions

  • Require new_name to be a filename rather than a path.
  • Reject absolute paths, directory separators, . and .. path components, and embedded null or control characters.
  • Verify that os.path.basename(new_name) == new_name.
  • Construct the destination from the validated basename, resolve its parent directory, and verify that the resolved parent is exactly the resolved source directory.
  • If the stated purpose requires ASCII-only names, enforce an allowlist such as [A-Za-z0-9_-]+.
  • Replace the check-then-rename sequence with a no-clobber operation or another atomic destination-reservation strategy.
  • Catch filesystem exceptions and return a nonzero exit status without leaving ambiguous workflow state.

T09 · Insecure Skill Coding Practices

Warning
Location
audio-rename.sh:61
Finding

Path Traversal Through Unrestricted Shell Rename Destination

Content
View full analysis

Vulnerability Details

File Location: audio-rename.sh, lines 61-84
Vulnerability Type: Unrestricted destination path / path traversal
Risk Level: Medium

bash
# Get directory and extension
dir=$(dirname "$input")
filename=$(basename "$input")
ext="${filename##*.}"

# Generate output filename
output_file="$dir/${output_name}.${ext}"

# Handle name conflicts
if [ -e "$output_file" ]; then
    counter=1
    while [ -e "$dir/${output_name}_${counter}.${ext}" ]; do
        ((counter++))
    done
    output_file="$dir/${output_name}_${counter}.${ext}"
fi

# Rename
mv "$input" "$output_file"
echo "✅ Renamed: $filename → $(basename "$output_file")"
echo "📁 Location: $output_file"

Technical Analysis

The user-controlled output_name is inserted directly into a filesystem path. Shell quoting prevents command injection and word splitting, but it does not prevent pathname traversal. An argument containing ../ can cause the resulting destination to resolve outside the source directory.

The existence check and subsequent mv operation are also separate. A concurrent process can create or replace the destination between these operations. Because ordinary mv behavior may overwrite an existing destination, this creates a time-of-check-to-time-of-use risk.

Exploitation requires control over the optional output-name argument and sufficient filesystem permission to rename the selected source file and write to the destination directory.

Attack Path

  1. An attacker or untrusted caller selects a valid source audio file.
  2. The caller supplies an output name containing traversal components, such as ../../other-directory/target.
  3. The script concatenates the source directory, attacker-controlled output name, and source extension.
  4. Filesystem path resolution processes the .. components and produces a destination outside the source directory.
  5. mv relocates the sourc ...[truncated 794 chars]
Remediation
View remediation

Remediation Suggestions

  • Validate output_name against a strict filename allowlist, such as ^[A-Za-z0-9_-]+$.
  • Reject /, traversal components, control characters, and empty names.
  • Canonicalize the destination and verify that its parent is identical to the canonical source directory.
  • Use mv --no-clobber -- "$input" "$output_file" where supported, or implement an atomic no-clobber operation using a suitable platform-specific tool.
  • Prefix path operands with -- when invoking filesystem utilities to prevent option interpretation.
  • Report rename failures explicitly and return a nonzero status.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill invokes a Python script to rename files and batch-process directories, which clearly requires file read/write capability, but the manifest declares no tool scope or permissions. Without explicit scoping, an agent framework may grant broader-than-expected filesystem access or fail to constrain execution, increasing the chance of unintended file modification.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
82% confidence
Finding

The trigger "fix filename" overlaps with a built-in command namespace around "fix", creating a shadow-command condition where the skill may intercept requests intended for another command. In a skill that modifies files, such routing ambiguity can produce unintended renames or confusion about which action the agent will execute.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrase "fix filename" is generic and can match many unrelated user requests, causing this skill to activate outside its narrow purpose of audio-file renaming. Overbroad activation can lead to unintended file operations on the wrong targets, especially because the skill performs write actions by renaming files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.