ClawHub
Back to skill

Security audit

job-status

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its stated job-status purpose, but it should be reviewed because it sends job IDs and receives detailed job metadata over plaintext HTTP and its documentation overstates some safety controls.

Review this skill before installing in any sensitive HPC or business environment. It may expose job IDs and returned job details over unencrypted HTTP, and its scripts do not enforce the numeric jobId validation promised in metadata. Prefer an HTTPS endpoint, executable-side input validation, and clarified docs before relying on it for automation or confidential workloads.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/get_job_status.py:18
Finding

Plaintext HTTP Allows Interception and Tampering of Job Status Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/get_job_status.py:36
Finding

Executable Scripts Do Not Enforce Declared Job ID Validation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
install.sh:42
Finding

Installer Retrieves an Unpinned Python Dependency

Content
View full analysis
/dev/null; then log_success "Python requests library already installed" else log_warning "Python requests library not installed" read -p "Install requests library? (y/n): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then pip3 install requests if [ $? -eq 0 ]; then log_success "requests library installed successfully" else log_error "requests library installation failed" return 1 fi else log_warning "Skipping requests library installation" fi fi return 0 } ``` The documentation recommends the same unconstrained installation: ```bash # Python dependencies pip install requests ``` ### Technical Analysis The installer requests the latest version of `requests` and its resolved dependency set without a lock file, version constraint, or artifact hashes. The result can change over time and can also be influenced by the caller's pip configuration, configured package index, extra indexes, mirrors, or network environment. If a package source, release, mirror, or dependency-resolution path is compromised, pip may install attacker-controlled content. Depending on the selected artifact and build path, package installation can process package build metadata or code with the privileges of the user running the installer. The package name itself is correctly spelled, and the audit found no evidence that this project intentionally references a malicious package. The risk is conditional supply-chain exposure caused by mutable, unverifiable dependency resolution. ...[truncated 1336 chars]
Remediation
View remediation
--hash=sha256: ``` 3. Install using hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Use `python3 -m pip` rather than a standalone `pip3` command so that installation targets the same interpreter used by the skill. 5. Install dependencies into a dedicated virtual environment rather than the user's global Python environment. 6. Use an explicitly trusted package index and avoid uncontrolled `--extra-index-url` settings. 7. Document the reviewed dependency update process and regenerate hashes only after inspecting release provenance and security advisories. 8. Avoid running the installer with elevated privileges unless strictly necessary. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script hardcodes a plain HTTP API endpoint, so job identifiers and returned job metadata are transmitted without transport-layer protection. This enables man-in-the-middle interception or tampering, which is especially risky for HPC/AI job monitoring because an attacker could observe sensitive job activity or falsify reported status.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes outbound network access to a hardcoded external HTTP endpoint and effectively implies executable behavior, but it does not declare any explicit tool scope such as allowed network destinations or permitted tools. This weakens sandboxing and review controls, making it easier for an agent runtime to grant broader-than-necessary network or shell capabilities and increasing the risk of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill fetches job status by jobId from a specific API endpoint and parses the jobState field, but this documentation presents additional supported inputs such as timeout, verbose, and format, plus text/table rendering modes. That is not merely incomplete documentation; it actively describes the skill as having richer formatting and control features than its stated purpose and behavior indicate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file explicitly states at L244 that the skill itself only supports single job query, yet later sections present scheduled tasks, monitoring loops, cache advice, alerting, history recording, and runtime log files as part of the skill's usage and behavior. These sections blur the boundary between external orchestration examples and the skill itself, contradicting the manifest's narrow status-query purpose and overstating what the skill does.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · install.sh (reported line 72)May include surrounding context.

sh
check_bash_deps() {
    log_info "Checking Bash dependencies..."
    
    check_command curl
    check_command jq
    
    return 0

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends the user-supplied job ID to a remote third-party service but does not clearly disclose that network transmission will occur. In an HPC/AI context, job identifiers can be sensitive operational metadata and could reveal workload existence or be intercepted/logged by external infrastructure, especially since the configured endpoint uses insecure transport.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test/test_skill.py (reported line 195)May include surrounding context.

python
def test_help_command(self):
        """Test help command"""
        import subprocess
        result = subprocess.run(
            ['python', 'scripts/get_job_status.py', '--help'],
            capture_output=True, text=True
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test/test_skill.py (reported line 205)May include surrounding context.

python
def test_missing_job_id(self):
        """Test missing jobId parameter"""
        import subprocess
        result = subprocess.run(
            ['python', 'scripts/get_job_status.py'],
            capture_output=True, text=True
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest forces LANG=en_US.UTF-8 for script execution without user opt-in, which can alter parsing, formatting, error messages, or downstream behavior in ways the user did not request. In this skill the risk is limited because the function is a simple status lookup, but locale pinning can still create subtle reliability and interpretation issues, especially if scripts parse localized command or date output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README encourages use of an external API but does not clearly warn users that job identifiers and associated request metadata are transmitted off-host to a third-party service. In an HPC/AI context, job IDs can be operationally sensitive, and silent external transmission may create privacy, confidentiality, or policy-compliance issues for users in regulated or multi-tenant environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The security section states 'Log Sanitization: Don't record sensitive information', implying sanitized logging behavior. However, elsewhere the README promotes verbose logging and direct API inspection, and this file provides no supporting implementation showing sanitization, creating a documentation-level contradiction about what logging reveals.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The documentation instructs users to query an external service directly and references transmitting job identifiers to a third-party host without any explicit privacy or data-handling warning. Even though job IDs may seem low sensitivity, they can reveal workload existence, timing, infrastructure identifiers, and operational metadata when sent off-system or logged during troubleshooting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest describes a skill for querying HPC/AI job status by jobId, but this test module invokes the skill via subprocess in order to test its CLI behavior. Spawning subprocesses is not part of the stated end-user purpose of fetching job status, so this represents an additional capability in the codebase beyond the manifest's functional scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description 'Query HPC/AI computing job status' describes the tool's purpose but does not specify concrete trigger phrases, scope limits, or exclusion conditions. In a manifest file, this can be interpreted broadly enough to match many generic status-checking requests without clear boundaries on when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.