ClawHub
Back to skill

Security audit

Shadow

Security checks for vulnerabilities and agentic risk

Overview

This is a local CSS shadow generator with disclosed saving and export behavior, though generated HTML previews should be treated carefully because saved values are not escaped.

Install only if you are comfortable with a local CLI that creates ~/.shadow/data.jsonl and writes preview/export files. Do not save shadow names or color/CSS values from untrusted sources, and be cautious opening generated HTML previews in a browser until the preview output is escaped or validated.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:548
Finding

Stored HTML Injection in Generated Shadow Previews

Content
View full analysis
Shadow Preview: {rec['name']} body {{ display: flex; justify-content: center; align-items: center; min-height: 100vh; background: #f0f0f0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; margin: 0; flex-direction: column; gap: 24px; }} .preview-card {{ width: 280px; height: 180px; background: #ffffff; border-radius: 12px; {prop}: {val}; display: flex; align-items: center; justify-content: center; color: #666; font-size: 14px; }} .css-code {{ background: #1e1e1e; color: #d4d4d4; padding: 16px 24px; border-radius: 8px; font-family: 'Courier New', monospace; font-size: 13px; white-space: pre; }} h2 {{ color: #333; margin: 0; }}

{rec['name']}

Shadow Preview
{prop}: {val};
""" ``` ### Technical Analysis The generated HTML directly interpolates persisted record fields into multiple HTML and CSS contexts without output encoding or strict validation: - `rec['name']` is inserted into the document title and an `h2` element. - `rec['css_value']` is inserted into both a `style` element and an HTML text context. - `css_property` is also inserted into CSS and text contexts. The record name and CSS value can originate from command-line parameters suc ...[truncated 2258 chars]
Remediation
View remediation
`. - Reject sequences capable of terminating the stylesheet, including ``, script elements, and event-handler markup. Verify that generated previews display these inputs as inert text or reject them entirely. ]]>

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents persistent local storage in ~/.shadow/data.jsonl and output file generation such as HTML previews and exports, but it does not declare any tool scope or permissions boundaries. This creates an undeclared file read/write capability surface, making it harder for an agent runtime or reviewer to constrain filesystem access and increasing the risk of unintended writes, data exposure, or abuse if the underlying script handles paths unsafely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes a CLI for generating and previewing CSS shadow effects, which suggests transient output-oriented behavior. The code additionally creates a hidden per-user data directory and stores named shadow records in ~/.shadow/data.jsonl, enabling local stateful asset management beyond simple generation/preview.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest emphasizes generating and previewing CSS shadow effects, but this command exports saved records in CSS, JSON, and SCSS formats. Exporting a local library of saved shadows is a broader asset-management capability that is not clearly conveyed by the stated description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.