ClawHub
Back to skill

Security audit

Erp

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local ERP-style logging tool that stores user-entered business notes in plaintext files, with practical privacy and export-safety cautions but no evidence of deception, exfiltration, or destructive behavior.

Install only if a simple offline plaintext business log is what you want. Do not store passwords, regulated records, or highly sensitive business data unless you are comfortable with files and exports being kept under ~/.local/share/erp; check local file permissions and be careful opening CSV exports in spreadsheet software.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:6
Finding

ERP records are created without restrictive access permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 6-8; representative record write at lines 151-155
Vulnerability Type: Plaintext sensitive-data exposure through insecure filesystem permissions
Risk Level: Medium

Vulnerable Code

bash
DATA_DIR="${HOME}/.local/share/erp"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Representative data write:

bash
echo "$ts|$input" >> "$DATA_DIR/add.log"
local total=$(wc -l < "$DATA_DIR/add.log")
echo "  [Erp] add: $input"
echo "  Saved. Total add entries: $total"
_log "add" "$input"

Technical Analysis

The application stores ERP records and generated exports under ~/.local/share/erp but does not establish a restrictive umask or explicitly assign secure modes to the directory and files. Consequently, access permissions are inherited from the invoking process.

With a permissive environment configuration, the directory or files may be readable by other local users. The stored content may include inventory information, supplier details, employee reviews, resource plans, reminders, KPIs, and other confidential business records. The same weakness applies to history.log, command-specific logs, and generated export files.

Symbolic-link protections are also absent. If an attacker can manipulate the data-directory contents under the affected account, output redirection follows existing symbolic links.

Attack Path

  1. A user runs the Skill in an environment with a permissive umask.
  2. The script creates ~/.local/share/erp and its files without explicitly restrictive permissions.
  3. The user records confidential operational or business information.
  4. Another local account enumerates and reads accessible files such as history.log, plan.log, review.log, or export.csv.
  5. The attacker obtains the ERP records available under the inherited filesystem permissi ...[truncated 603 chars]
Remediation
View remediation

Remediation Suggestions

  • Set a restrictive process mask before creating or writing any records:

    bash
    umask 077

  • Create the data directory with an explicit owner-only mode:

    bash
    install -d -m 700 -- "$DATA_DIR"

  • Ensure existing log and export files are restricted to mode 0600.

  • Before writing, verify that destination files are regular files owned by the current user and are not symbolic links.

  • Where supported, use no-follow and atomic file-creation mechanisms rather than ordinary shell redirection.

  • Document that the files contain plaintext business data and should not be used for secrets unless encryption and suitable access controls are added.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:53
Finding

Unescaped user-controlled values allow JSON corruption and CSV formula injection

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 53-81
Vulnerability Type: Unsafe serialization and spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

bash
json)
    echo "[" > "$out"
    local first=1
    for f in "$DATA_DIR"/*.log; do
        [ -f "$f" ] || continue
        local name=$(basename "$f" .log)
        while IFS='|' read -r ts val; do
            [ $first -eq 1 ] && first=0 || echo "," >> "$out"
            printf '  {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out"
        done < "$f"
    done
    echo "" >> "$out"
    echo "]" >> "$out"
    ;;
csv)
    echo "type,time,value" > "$out"
    for f in "$DATA_DIR"/*.log; do
        [ -f "$f" ] || continue
        local name=$(basename "$f" .log)
        while IFS='|' read -r ts val; do
            echo "$name,$ts,$val" >> "$out"
        done < "$f"
    done
    ;;

Technical Analysis

Record values originate from command-line input and are written to logs without serialization-aware encoding. During JSON export, values are inserted directly into quoted JSON strings. Embedded quotation marks, backslashes, control characters, or line breaks can terminate or alter the JSON structure, producing invalid output or injecting additional properties and objects.

During CSV export, fields are concatenated with commas without RFC 4180 quoting. Commas, quotation marks, and line breaks can therefore create additional cells or rows. In addition, values beginning with spreadsheet formula markers such as =, +, -, or @ are exported unchanged. Spreadsheet applications may interpret such cells as formulas when an operator opens the generated CSV.

The precise effects of formula execution depend on the spreadsheet product and its security settings. Potential effects include misleading calculations, external network re ...[truncated 1600 chars]

Remediation
View remediation

Remediation Suggestions

  • Generate JSON using a serializer that correctly escapes quotation marks, backslashes, control characters, Unicode, and line breaks.
  • Do not construct JSON through direct printf interpolation of untrusted values.
  • Encode every CSV field according to RFC 4180:
    • Enclose fields in double quotes.
    • Replace every embedded double quote with two double quotes.
    • Preserve commas and line breaks only inside properly quoted fields.
  • If CSV files may be opened in spreadsheet applications, neutralize cells beginning with =, +, -, or @, for example by applying a documented text-prefix policy.
  • Add regression tests covering embedded quotes, commas, backslashes, pipes, line breaks, Unicode, and spreadsheet formula prefixes.
  • Clearly distinguish machine-safe CSV output from spreadsheet-safe output if preserving the exact original value is required.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is presented as an ERP/resource-management tool, but the documented behavior is primarily generic local logging, search, and export of timestamped entries. This mismatch is dangerous because users may enter sensitive operational, inventory, personnel, or KPI data under the assumption of ERP-like controls, while the skill instead stores plaintext data locally and exposes broader persistence/export behavior than the top-level purpose suggests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says this skill should plan resources, track inventory, coordinate departments, and report KPIs. In contrast, the exposed commands and storage model implement a free-form note/logging toolkit with commands like add, streak, remind, prioritize, tag, and weekly-review, which are oriented toward personal productivity rather than ERP operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description does not prominently warn that commands write timestamped business data to local log files and generate export files on disk. In this context, users are likely to input sensitive business information such as inventory levels, planning decisions, reviews, and KPI notes, so undisclosed plaintext persistence increases the risk of accidental data exposure, local disclosure, and over-retention.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Commands such as streak, remind, prioritize, tag, timeline, and weekly-review are not obviously required to allocate resources, manage stock, or track department KPIs. They materially expand the skill into a general self-management tool without manifest justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest's reporting claim implies reports derived from ERP domain data, but the export function simply serializes every local .log file in the data directory into json/csv/txt. That behavior is consistent with a generic log exporter, not with structured ERP reporting over resources, inventory, or departmental metrics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The export feature silently copies all previously logged entries into new files, increasing the number of at-rest copies of potentially sensitive data and broadening accidental disclosure risk. JSON and CSV exports also preserve raw user content, which can then be shared, backed up, or opened by other tools without the user realizing the sensitivity of the aggregated output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persistently stores arbitrary user-provided content under ~/.local/share/erp without meaningful notice, consent, retention policy, or access controls. In an agent-skill context, users may enter sensitive operational notes, credentials, inventory details, or internal plans assuming ephemeral processing, creating avoidable local data exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.