ClawHub
Back to skill

Security audit

Code Searcher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local code-search helper, but unsafe shell argument handling can turn some commands into arbitrary local command execution.

Review this skill before installing. Its intended local code-search behavior is understandable, but it should not be used on arguments influenced by untrusted text until the shell quoting, positional-argument bugs, and input validation are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/script.sh:103
Finding

Arbitrary Command Execution Through Unquoted Directory Argument in the stats Command

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 103-107
Vulnerability Type: Shell argument injection into a find expression
Risk Level: High

Vulnerable Code

bash
cmd_stats() {
    local dir="${2:-}"
    [ -z "$dir" ] && die "Usage: $SCRIPT_NAME stats <dir>"
    echo 'Files:'; find ${2:-.} -type f -name '*.py' -o -name '*.js' -o -name '*.sh' | wc -l; echo 'Lines:'; find ${2:-.} -type f \( -name '*.py' -o -name '*.js' -o -name '*.sh' \) -exec cat {} + 2>/dev/null | wc -l
}

Technical Analysis

The user-controlled value ${2:-.} is expanded without quotation in two find invocations. Bash therefore applies word splitting and pathname expansion to its contents before starting find.

This does not cause shell control characters to be reparsed as shell syntax, but it allows one supplied argument to become multiple arguments in the resulting find command. Because find treats arguments such as -exec, -delete, and -fprint as executable actions, an attacker can inject additional find predicates and actions.

The command dispatcher shifts the command name before invoking cmd_stats, while cmd_stats incorrectly reads $2 rather than $1. As a result, the vulnerable value is reachable by supplying an additional argument, even though this differs from the documented interface. Storing the value in dir does not mitigate the issue because the command directly expands ${2:-.} without quotes.

Attack Path

  1. An attacker causes the Skill or user to invoke stats with an attacker-controlled extra argument.
  2. The dispatcher removes stats and passes the remaining arguments to cmd_stats.
  3. cmd_stats reads its second argument and expands it without quotes.
  4. Bash splits the value into multiple arguments.
  5. find interprets injected arguments as expression actions.
  6. An injected -exec action starts a command with the privileges of th ...[truncated 1036 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use the local dir variable and quote it in every command:

    bash
    cmd_stats() {
    local dir="${1:-}"
    [ -z "$dir" ] && die "Usage: $SCRIPT_NAME stats <dir>"

    echo 'Files:'
    find "$dir" -type f \( -name '*.py' -o -name '*.js' -o -name '*.sh' \) -print |
        wc -l

    echo 'Lines:'
    find "$dir" -type f \( -name '*.py' -o -name '*.js' -o -name '*.sh' \) \
        -exec cat -- {} + 2>/dev/null |
        wc -l
}

  2. Correct the positional parameter from $2 to $1, matching the dispatcher after shift.

  3. Add parentheses to the first find expression so -type f applies to every filename alternative.

  4. Reject unexpected extra arguments to prevent ambiguous command parsing.

  5. Add tests using paths containing spaces, wildcard characters, leading hyphens, and strings resembling find actions.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/script.sh:110
Finding

Arbitrary Command Execution Through Unquoted Arguments in the recent Command

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 110-114
Vulnerability Type: Shell argument injection into a find expression
Risk Level: High

Vulnerable Code

bash
cmd_recent() {
    local dir="${2:-}"
    local days="${3:-}"
    [ -z "$dir" ] && die "Usage: $SCRIPT_NAME recent <dir days>"
    find ${2:-.} -type f -mtime -${3:-7} \( -name '*.py' -o -name '*.js' -o -name '*.sh' \) | head -20
}

Technical Analysis

Both the directory expression ${2:-.} and the day expression ${3:-7} are expanded without quotes. The directory value is especially dangerous because word splitting can transform it into an arbitrary sequence of find expression arguments, including actions such as -exec and -delete.

The day value can also inject additional tokens into the find expression. Prefixing the unquoted expansion with - does not make it safe; a value containing whitespace is still split into multiple arguments after expansion. The command additionally performs no numeric validation to ensure that the number of days is a non-negative integer.

There is also a positional-parameter error. After the dispatcher removes the recent command name, the documented directory is $1 and the number of days is $2. The function instead treats $2 as the directory and $3 as the number of days. Consequently, the documented days argument reaches an unquoted position where find expects its starting path.

Attack Path

  1. An attacker controls or influences the second argument supplied to the recent command.
  2. The dispatcher shifts away the command name.
  3. Due to the positional-parameter error, the second user argument becomes ${2:-.}, which is used as the find starting-path expression.
  4. Bash performs word splitting on the unquoted value.
  5. find receives attacker-selected actions as separate arguments.
  6. An injected -exec action executes a local co ...[truncated 956 chars]
Remediation
View remediation

Remediation Suggestions

  1. Correct the function's positional parameters and quote both values:

    bash
    cmd_recent() {
    local dir="${1:-}"
    local days="${2:-7}"

    [ -z "$dir" ] && die "Usage: $SCRIPT_NAME recent <dir days>"
    [[ "$days" =~ ^[0-9]+$ ]] || die "days must be a non-negative integer"

    find "$dir" -type f -mtime "-$days" \
        \( -name '*.py' -o -name '*.js' -o -name '*.sh' \) |
        head -20
}

  2. Validate days using a strict numeric allowlist before incorporating it into -mtime.

  3. Reject excess arguments rather than silently accepting them.

  4. Quote every variable that represents a path, search term, or command-line value throughout the script.

  5. Add regression tests for whitespace, glob characters, leading hyphens, and injected find actions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says this skill searches codebases for patterns, symbols, and TODOs. However, the supplied code only implements a command dispatcher with help, info, status, and a run command that prints 'TODO: Implement main functionality.' There is no logic to read files, search repositories, parse symbols, or scan for TODOs. This is a material description-behavior mismatch because the primary promised capability is absent.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · scripts/script.sh (reported line 9)May include surrounding context.

sh
DATA_DIR="$HOME/.local/share/code-searcher"
mkdir -p "$DATA_DIR"

#
#
#
#

Static analysis

No suspicious patterns detected.