ClawHub
Back to skill

Security audit

Etl

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local ETL activity logger that stores user-entered notes in plaintext, with no evidence of exfiltration, privilege escalation, or hidden automatic behavior.

Install this only if you want a local plaintext ETL activity journal, not an ETL executor. Do not log passwords, API keys, private connection strings, raw sensitive records, or confidential production SQL, and check permissions on ~/.local/share/etl if the machine is shared or backed up.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:6
Finding

Plaintext Operational Data Is Stored Without Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:6-9, 143-301
Vulnerability Type: Plaintext sensitive-data storage with ambient filesystem permissions
Risk Level: Medium

Vulnerable Code

bash
DATA_DIR="${HOME}/.local/share/etl"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Representative logging code used by the data commands:

bash
local input="$*"
local ts=$(date '+%Y-%m-%d %H:%M')
echo "$ts|$input" >> "$DATA_DIR/query.log"
local total=$(wc -l < "$DATA_DIR/query.log")
echo "  [Etl] query: $input"
echo "  Saved. Total query entries: $total"
_log "query" "$input"

Equivalent verbatim logging is performed for ingest, transform, filter, aggregate, visualize, export, sample, schema, validate, pipeline, and profile entries.

Technical Analysis

The Skill stores caller-controlled operational information in plaintext under ~/.local/share/etl/. This information may include SQL statements, source and destination identifiers, schemas, validation results, storage locations, and pipeline configurations.

The script creates its data directory with mkdir -p and creates log files through shell redirection, but it does not establish a restrictive umask or explicitly set directory and file permissions. As a result, permissions depend on the invoking process's environment. Under a common umask of 022, newly created files are typically mode 0644 and the directory is typically mode 0755. If the user's home directory and its parent components permit traversal, other local users may be able to read the logs.

The code does not introduce command execution through the logged values because the input is quoted when written. The security concern is local confidentiality rather than command injection.

Attack Path

  1. A user invokes an ETL logging command with sensitive operational content, such as a SQL query, interna ...[truncated 1216 chars]
Remediation
View remediation

Remediation Suggestions

  1. Establish a restrictive file-creation mask before creating any persistent data:

    bash
    umask 077

  2. Create and enforce a user-only directory:

    bash
    mkdir -p -m 700 "$DATA_DIR"
chmod 700 "$DATA_DIR"

  3. Create log files with mode 0600, or enforce that mode after creation:

    bash
    touch "$DATA_DIR/history.log"
chmod 600 "$DATA_DIR/history.log"

    Apply the same protection to every command-specific log and generated export file.

  4. Validate existing storage at startup and reject unsafe conditions, including a data directory owned by another user or implemented as an unexpected symbolic link.

  5. Document that users must not record passwords, access tokens, private keys, or other secrets. Where feasible, redact common credential patterns before persistence.

  6. Consider an optional encrypted storage mechanism when logs are expected to contain confidential operational data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as an ETL pipeline builder, but the documented behavior is primarily a local plaintext logging utility for user-supplied ETL notes and metadata. This mismatch can mislead users into entering real queries, schema details, source locations, and operational data under the assumption that the tool performs or manages ETL safely, when it instead persistently stores potentially sensitive information without actual execution or controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The commands are presented as ETL operations but actually persist arbitrary user-supplied input into local logs, creating undisclosed data retention and potential leakage of sensitive pipeline inputs, queries, credentials, or business data. In an agent skill context, users may provide secrets or proprietary data expecting processing, not storage, so the deceptive behavior meaningfully increases privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly stores ETL activity, queries, schema definitions, validation results, and pipeline metadata as plaintext under ~/.local/share/etl/ and supports export/search over that data. In ETL contexts, these entries often contain secrets, internal table names, PII references, connection details, or business-sensitive logic, so silent persistent logging materially increases data exposure risk on shared or compromised systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest promises data ingestion, cleaning, validation, and scheduling loads, which suggests actual ETL operations on datasets. Instead, the script exposes many non-ETL commands and most commands simply append user input to per-command log files rather than performing pipeline construction, transformation, or validation logic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation says the export command produces json/csv/txt output, and an _export implementation exists for that purpose. However, the case statement defines an earlier export branch that only records input to export.log, making the documented exporter branch unreachable and contradicting the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The export function aggregates all stored log data into new files, increasing the blast radius of any previously retained sensitive content and making exfiltration or accidental sharing easier. Because the skill context suggests data handling, users may already be working with sensitive records, so creating bulk exports without warnings or controls is materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Arbitrary user input is persistently written to local files without notice, retention limits, or sensitivity handling. In an ETL context, inputs may include connection strings, SQL, API tokens, sample records, or regulated data, so silent storage creates a real confidentiality and compliance risk if the host is shared, backed up, or later inspected.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The generic search and recent-history features enable browsing and retrieval of previously stored inputs across the tool's logs, which can expose sensitive past data unrelated to the current task. In a purported ETL skill, this broad inspection capability is harder to justify and increases the chance of unintended disclosure through agent use or shoulder-surfed terminal output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.