ClawHub
Back to skill

Security audit

Hmi

Security checks for vulnerabilities and agentic risk

Overview

This package is advertised as an HMI design tool, but the artifacts implement a local entry/log manager that persists, deletes, exports, and configures data under ~/.hmi.

Review before installing. This appears to be a local note/log manager, not an HMI design tool. Do not store sensitive data in it without improving JSON/CSV escaping, removal confirmation, config input validation, and overwrite/symlink protections; run it only as a normal user and in directories you control.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/script.sh:133
Finding

Configuration Injection Through Unescaped sed and Regular Expression Input

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 133-145
Vulnerability Type: Configuration command and regular-expression injection
Risk Level: High

Vulnerable Code

bash
cmd_config() {
    local key="${1:-}" val="${2:-}"
    local cfg="$DATA_DIR/config.txt"
    if [ -z "$key" ]; then
        echo "=== Config ==="
        if [ -f "$cfg" ]; then
            while IFS="=" read -r k v; do echo "  $k=$v"; done < "$cfg"
        else echo "  (empty — use config <key> <value>)"; fi
    elif [ -z "$val" ]; then
        grep "^${key}=" "$cfg" 2>/dev/null | cut -d= -f2- || echo "(not set)"
    else
        if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then
            sed -i "s|^${key}=.*|${key}=${val}|" "$cfg"
        else
            echo "${key}=${val}" >> "$cfg"
        fi
        echo "Set: $key=$val"
    fi
}

Technical Analysis

The key and val command-line arguments are inserted directly into grep regular expressions and a dynamically constructed sed program. Neither input is validated nor escaped for its syntactic context.

A key containing regular-expression metacharacters can match configuration entries other than the intended literal key. A value containing the | delimiter, replacement backreferences, newlines, or other sed syntax can alter or invalidate the generated substitution program. Newline-bearing arguments can potentially introduce additional sed commands. The exact escalation potential depends on the installed sed implementation and supported extensions, but unintended configuration modification and denial of service are directly reachable.

Attack Path

  1. An attacker gains the ability to invoke the Skill with attacker-controlled config arguments.
  2. The attacker supplies a key containing regular-expression syntax, causing grep to identify an unintended configuration entry ...[truncated 813 chars]
Remediation
View remediation

Remediation Suggestions

  • Enforce a strict configuration-key format, such as ^[A-Za-z_][A-Za-z0-9_]*$.
  • Do not construct grep or sed programs by interpolating untrusted input.
  • Replace the update operation with a structured implementation that compares keys literally.
  • If awk is used, pass values through -v variables and compare parsed fields rather than embedding input into source code.
  • Reject carriage returns, line feeds, NUL bytes, and other control characters in keys and values.
  • Write updates to a securely created temporary file in the same directory, set restrictive permissions, validate the result, and atomically rename it into place.
  • Add tests for keys and values containing regex metacharacters, sed delimiters, backslashes, ampersands, and newlines.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:10
Finding

Unescaped JSONL Storage and Spreadsheet Formula Injection in CSV Exports

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 10-15 and 103-121
Vulnerability Type: Improper output encoding and CSV formula injection
Risk Level: Medium

Vulnerable Code

bash
_save_entry() {
    _ensure_dirs
    local cmd="$1" val="$2"
    local ts=$(date '+%Y-%m-%d %H:%M:%S')
    printf '{"ts":"%s","cmd":"%s","val":"%s"}\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"
}
bash
cmd_export() {
    local fmt="${1:-json}"
    local out="hmi-export.$fmt"
    if [ ! -f "$DATA_DIR/data.jsonl" ]; then echo "No data."; return 0; fi
    case "$fmt" in
        json) cp "$DATA_DIR/data.jsonl" "$out" ;;
        csv)
            echo "timestamp,command,value" > "$out"
            while IFS= read -r line; do
                ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4)
                c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4)
                vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4)
                echo "$ts,$c2,$vl" >> "$out"
            done < "$DATA_DIR/data.jsonl"
            ;;
        *) echo "Formats: json, csv"; return 1 ;;
    esac
    echo "Exported: $out ($(wc -c < "$out") bytes)"
}

Technical Analysis

_save_entry places attacker-controlled entry text directly inside a JSON string without JSON encoding. Quotes, backslashes, carriage returns, and newlines therefore change the serialized structure. A newline can create additional physical JSONL records, while an unescaped quote can terminate the val field and produce malformed or forged content.

The CSV exporter extracts fields using regular expressions and writes them as raw comma-separated text. It does not quote fields, double embedded quotes, or protect spreadsheet-sensitive prefixes. Consequently, commas and line breaks can alter the CSV structure. Values beginning with =, +, -, or @ may be interpreted ...[truncated 1073 chars]

Remediation
View remediation

Remediation Suggestions

  • Use a real JSON serializer, such as jq -nc --arg, instead of formatting JSON with printf.
  • Reject or correctly encode all control characters, quotes, and backslashes.
  • Parse stored JSON with a JSON parser rather than grep and cut.
  • Generate RFC 4180-compliant CSV by surrounding every field with quotes and doubling embedded quotes.
  • Normalize or reject embedded carriage returns and newlines where multiline CSV fields are unnecessary.
  • For spreadsheet-facing exports, neutralize values beginning with =, +, -, @, tab, or carriage return, for example by prefixing an apostrophe after applying a documented policy.
  • Add tests for quotes, backslashes, commas, multiline values, Unicode, and formula-leading characters.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:7
Finding

Predictable Data and Export Paths Permit Symlink-Based File Modification

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 7-15, 103-121, and 133-145
Vulnerability Type: Symlink following and unsafe file creation
Risk Level: Medium

Vulnerable Code

bash
DATA_DIR="${HMI_DIR:-$HOME/.hmi}"

_ensure_dirs() { mkdir -p "$DATA_DIR"; }

_save_entry() {
    _ensure_dirs
    local cmd="$1" val="$2"
    local ts=$(date '+%Y-%m-%d %H:%M:%S')
    printf '{"ts":"%s","cmd":"%s","val":"%s"}\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"
}
bash
cmd_export() {
    local fmt="${1:-json}"
    local out="hmi-export.$fmt"
    if [ ! -f "$DATA_DIR/data.jsonl" ]; then echo "No data."; return 0; fi
    case "$fmt" in
        json) cp "$DATA_DIR/data.jsonl" "$out" ;;
        csv)
            echo "timestamp,command,value" > "$out"
            while IFS= read -r line; do
                ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4)
                c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4)
                vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4)
                echo "$ts,$c2,$vl" >> "$out"
            done < "$DATA_DIR/data.jsonl"
            ;;
        *) echo "Formats: json, csv"; return 1 ;;
    esac
    echo "Exported: $out ($(wc -c < "$out") bytes)"
}
bash
cmd_config() {
    local key="${1:-}" val="${2:-}"
    local cfg="$DATA_DIR/config.txt"
    ...
    else
        if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then
            sed -i "s|^${key}=.*|${key}=${val}|" "$cfg"
        else
            echo "${key}=${val}" >> "$cfg"
        fi
        echo "Set: $key=$val"
    fi
}

Technical Analysis

The Skill writes to predictable paths without checking whether the data directory or destination files are symbolic links. It also accepts HMI_DIR without validating ownership, permissions, or locat ...[truncated 1625 chars]

Remediation
View remediation

Remediation Suggestions

  • Create the data directory with mode 0700 and verify that it is owned by the invoking user.
  • Constrain HMI_DIR to an approved location or reject unsafe, shared, and symbolic-link paths.
  • Before opening a destination, reject symbolic links and non-regular files.
  • Create data and configuration files atomically with mode 0600.
  • Avoid check-then-open sequences where an attacker can replace a path between validation and use.
  • Write exports through securely created temporary files and atomically rename them to validated destinations.
  • Refuse to overwrite existing export files unless the user explicitly requests it.
  • Run the Skill with the least privileges necessary and never as a privileged account for routine data management.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code does not implement an HMI design tool or any interface-design functionality. Instead, it behaves like a small personal datastore or journal/CLI record manager. Its commands revolve around adding, listing, searching, removing, exporting, and configuring stored entries in local files under ~/.hmi. This is a materially different primary purpose from 'Human-machine interface design tool,' so the description does not accurately represent the behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and help text identify the skill as a 'Human-machine interface design tool', which implies functionality related to interface design. Instead, the code only stores, searches, deletes, exports, and configures timestamped local entries in JSONL/config files, with no HMI design, rendering, prototyping, or interface-related operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file documents a remove command that deletes an entry, but it provides no warning about the destructive nature of the operation or whether deletion is reversible. For markdown files, safety-affecting behaviors that could impact user data should be disclosed clearly to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script saves arbitrary user-provided values into a persistent file under ~/.hmi/data.jsonl, but this function has no accompanying comment, prompt, or other disclosure explaining that user input will be stored locally. Because the tool records entered content and retains it across runs, users may not realize their data is being persisted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The remove command irreversibly deletes a line from the persistent data file using sed -i, but there is no confirmation prompt or warning beyond the command name itself. This is a destructive file-modifying action, and the help text does not disclose that deletion is permanent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The export command is described only as exporting data to a file, without any warning that it creates or overwrites files and may expose stored data outside the tool's normal directory. For markdown files, file-affecting or privacy-relevant behaviors should be called out explicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The documentation says users can "View or set config" and use config <key> <value> to set preferences, but it does not warn that this changes persistent configuration affecting later behavior. In markdown skill descriptions, persistent modifications to tool behavior should be disclosed so users understand the impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The export command copies or transforms stored entries into hmi-export. in the current directory, which is a file write affecting user data. While the command is named export, there is no explicit warning in the help text or comments about where the file is created or that existing files may be overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.