ClawHub
Back to skill

Security audit

Sms

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it needs review because its SMS features are misleading or broken and its export command can overwrite user-writable files.

Review before installing. This appears to be a small local template script, not an exfiltration or malware payload, but it is poorly scoped and unreliable: do not use it with sensitive SMS templates, do not run export to important paths, and expect the documented SMS sending/substitution behavior not to work as claimed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:86
Finding

Unescaped Template Values Permit Persistent JSONL Data Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:86-90
Vulnerability Type: Improper output encoding and persistent data injection
Risk Level: Medium

bash
cmd_create() {
    local name="${2:-}"
    local text="${3:-}"
    [ -z "$name" ] && die "Usage: $SCRIPT_NAME create <name text>"
    echo '{"name":"'$2'","text":"'$3'"}' >> $DATA_DIR/templates.jsonl && echo 'Created template: $2'
}

Technical Analysis

The template name and text are concatenated directly into a JSON object without JSON escaping. An input containing quotation marks, backslashes, control characters, or newlines can terminate the intended JSON string and inject additional properties or complete JSONL records.

The destination path is also unquoted. Although DATA_DIR is derived from HOME, whitespace or wildcard characters in that environment-provided path could cause word splitting or pathname expansion.

Because the generated data is retained in ~/.local/share/sms/templates.jsonl, the malformed or injected records persist across subsequent invocations of the Skill.

Attack Path

  1. An attacker supplies a crafted template value through the create command.
  2. The value contains JSON syntax or a newline, such as content that closes the text string and adds another record.
  3. The shell concatenates the value into the output without JSON encoding.
  4. The resulting malformed or attacker-structured data is appended to templates.jsonl.
  5. Later list, preview, or downstream consumers process or display the injected persistent content.

This does not provide direct shell-command execution in the current implementation because shell metacharacters introduced by parameter expansion are not reparsed as shell syntax.

Impact Assessment

Exploitation occurs with the privileges of the user running the Skill. An attacker who can influence command arguments can corrupt the SMS temp ...[truncated 261 chars]

Remediation
View remediation

Remediation Suggestions

  • Generate JSON with a proper encoder rather than string concatenation. For example:

    bash
    jq -nc --arg name "$name" --arg text "$text" \
  '{name: $name, text: $text}' >> "$DATA_DIR/templates.jsonl"

  • Quote the destination path in every operation:

    bash
    "$DATA_DIR/templates.jsonl"

  • Validate maximum field lengths and reject unexpected control characters if multiline template data is not required.

  • Consider writing through a securely created temporary file followed by an atomic rename when modifying structured data.

  • Correct the handler argument indexing after shift; cmd_create should consume its name and text from $1 and $2.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:94
Finding

Unquoted Arguments Allow Word Splitting, Globbing, and Option Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:94-120
Vulnerability Type: Unsafe shell argument handling
Risk Level: Medium

bash
cmd_list() {
    cat $DATA_DIR/templates.jsonl 2>/dev/null | tail -20
}

cmd_preview() {
    local name="${2:-}"
    [ -z "$name" ] && die "Usage: $SCRIPT_NAME preview <name>"
    grep $2 $DATA_DIR/templates.jsonl 2>/dev/null | tail -1
}

cmd_export() {
    local file="${2:-}"
    [ -z "$file" ] && die "Usage: $SCRIPT_NAME export <file>"
    cp $DATA_DIR/templates.jsonl $2 && echo Exported
}

Technical Analysis

User-controlled arguments and filesystem paths are expanded without double quotes. Bash therefore applies word splitting and pathname expansion before invoking cat, grep, or cp.

The grep and cp calls also omit the -- end-of-options marker. Values beginning with a hyphen can consequently be interpreted as command options rather than as a search pattern or destination. A crafted preview value can alter matching behavior, request recursive processing, select files through wildcard expansion, or cause denial of service. A crafted export value can be split into multiple arguments or interpreted as cp options.

The export operation additionally uses cp without protection against overwriting an existing destination. Exporting to an attacker-selected path can replace any writable file, although this remains within the invoking user's existing filesystem permissions.

Attack Path

  1. An attacker causes the Skill to invoke preview or export with attacker-controlled text.
  2. The supplied value starts with a command option, contains whitespace, or includes wildcard characters.
  3. Bash expands the value into one or more command arguments.
  4. grep or cp interprets the expanded values as options, patterns, source operands, or destination operands.
  5. The attacker can alter file-pro ...[truncated 753 chars]
Remediation
View remediation

Remediation Suggestions

  • Quote all variable expansions used as command arguments:

    bash
    cat "$DATA_DIR/templates.jsonl" 2>/dev/null | tail -20
grep -- "$name" "$DATA_DIR/templates.jsonl" 2>/dev/null | tail -1
cp -- "$DATA_DIR/templates.jsonl" "$file"

  • Prefer input redirection over an unnecessary cat pipeline:

    bash
    tail -20 "$DATA_DIR/templates.jsonl"

  • Add -- before attacker-influenced positional operands to prevent option injection.

  • Validate export destinations against an explicitly permitted directory if exports should not write to arbitrary user-accessible paths.

  • Refuse to overwrite existing destinations unless the caller explicitly requests replacement, and consider using cp --no-clobber.

  • Resolve the argument-indexing defect introduced by main calling shift; handlers should use $1 for their first argument and $2 for their second.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior materially overstates the skill's capabilities and omits risky behavior: it claims SMS template management with substitution/formatting and sending, while the documented commands indicate arbitrary file export and a placeholder send action. This mismatch can mislead users and higher-level agents into invoking the skill under false assumptions, increasing the chance of unintended data disclosure or unsafe file writes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

create

bash
scripts/script.sh create <name text>

list

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown describes a send command for SMS delivery, which inherently involves network transmission of message content and recipient phone numbers. The file does not include any warning about privacy impact, external transmission, possible costs, or confirmation expectations for this action.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · scripts/script.sh (reported line 9)May include surrounding context.

sh
DATA_DIR="$HOME/.local/share/sms"
mkdir -p "$DATA_DIR"

#
#
#
#

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This shell script appends user-provided data to a persistent file in the user's home directory, but provides no prior warning, confirmation, or descriptive comment about that write. For code files, persistent file writes should have some visible disclosure unless clearly covered elsewhere; here the script silently modifies stored data aside from a post-action success message.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest says the skill manages SMS templates with variable substitution and formatting, but both send and var merely echo fixed strings containing literal $2/$3 placeholders. This is an intent-level contradiction because the documented capability is not actually implemented in code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes a skill for managing SMS templates and preparing bulk messages, which reasonably covers local template storage and previewing. However, the explicit export command copies the template store to an arbitrary user-supplied path, expanding the skill from message preparation into file export behavior not stated in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The export command copies stored template data to an arbitrary user-supplied path with no validation, restriction, or warning. In an agent or automated environment, this can overwrite files accessible to the current user or place potentially sensitive template contents in unintended locations, increasing the risk of data exposure or file clobbering.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.