ClawHub
Back to skill

Security audit

Architecture Research

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently helps research software architecture and produce docs and diagrams, with the main caution that it relies on a separately installed diagrams renderer.

Before installing, be aware that the skill may read the target codebase, search external sources, create a local research folder, and use a separately installed diagrams renderer. For best control, specify the exact repository, output directory, and use a trusted or pinned diagrams installation when rendering SVGs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:69
Finding
Unpinned Third-Party Skill Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 69–94 **Vulnerability Type**: Untrusted and unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown This skill uses the **diagrams** skill for rendering. Install it if you haven't: ```bash clawhub install diagrams ``` Then render ELK JSON → SVG using the diagrams skill's renderer: ```bash # Single file node <diagrams-skill-dir>/scripts/render-elk.mjs diagram.json output.svg # Batch: all .json files in a folder → svg/ subfolder node <diagrams-skill-dir>/scripts/render-elk.mjs --dir <folder> # Batch + PNG (macOS only) node <diagrams-skill-dir>/scripts/render-elk.mjs --dir <folder> --png ``` Replace `<diagrams-skill-dir>` with the path to the installed diagrams skill directory. > **Note:** elkjs must be installed locally where you run the script. See the diagrams skill's SKILL.md for full setup. **Workflow for each diagram:** 1. Write the ELK JSON to a `.json` file in the research folder 2. Render: `node <diagrams-skill-dir>/scripts/render-elk.mjs diagram.json diagram.svg` 3. Embed in the markdown doc: `![System Overview](system-overview.svg)` 4. Keep both the `.json` (source of truth) and `.svg` (rendered) in the research folder ``` ### Technical Analysis The workflow directs the user or agent to install the third-party `diagrams` skill by a mutable package name and then execute its JavaScript renderer with Node.js. No immutable version, commit digest, integrity hash, trusted publisher identity, or mandatory source review is specified. The `diagrams` dependency is not included in the audited project, so its implementation and behavior could not be inspected. If the package source, publisher account, registry entry, or dependency-resolution process is compromised, the installed `render-elk.mjs` file could contain attacker-controlled code. Node.js executes that code with the permissions and environmental access of the invoking user or agent. ...[truncated 1727 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the `diagrams` skill to an audited immutable release, commit digest, or equivalent content-addressed identifier. 2. Publish and verify a cryptographic integrity hash or signed provenance record before installation and execution. 3. Document the authoritative package source and expected publisher identity; reject dependencies obtained from unapproved sources. 4. Review the dependency's `SKILL.md`, renderer scripts, installation hooks, and transitive dependencies before use. 5. Disable or tightly control lifecycle and installation scripts where the package manager supports doing so. 6. Execute the renderer in a restricted sandbox or container with: - Read access limited to required diagram inputs. - Write access limited to a dedicated output directory. - No access to credential stores, SSH keys, or unrelated repositories. - No outbound network access unless rendering explicitly requires it. - A non-privileged operating-system account. 7. Pin and integrity-check transitive runtime packages, including `elkjs`. 8. Add a documented failure mode that stops rendering rather than automatically installing or executing an unverified dependency. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to create a new research folder and write multiple files to the local workspace, but it does not tell the agent to obtain user confirmation first or clearly warn that local filesystem modifications will occur. In an agent setting, even benign write operations can surprise users, overwrite existing content, or create artifacts in unintended locations if the output path is inferred loosely.