ClawHub
Back to skill

Security audit

Rm Safety

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only deletion-safety skill that is coherent with its purpose, though users should still verify paths before approving any delete action.

Install this only if you want your agent to add a confirmation layer around file deletion. Before approving, check the absolute target path, file counts, and whether the target is in an important user folder. Prefer the trash option for recoverability, and remember that choosing backup can place a temporary local copy under /tmp.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill documents safe read-only inspection with quoted paths, but its execution path later says to run the original `rm` command after confirmation rather than reconstructing a sanitized command from validated arguments. If an attacker can influence the original command string, confirmation becomes a thin wrapper around potentially unsafe shell input, enabling metacharacter, globbing, or option-injection issues despite the earlier safety guidance.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The README states that the skill 'automatically activates' whenever a user attempts deletion, but does not clearly bound when interception occurs or how false triggers are avoided. In an agent/tooling context, broad automatic interception can unexpectedly alter command handling or create opportunities for overreach if the trigger matches more than intended.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Exceptions | 例外情况

**Can execute without asking | 无需询问可直接执行:**
- User explicitly says "execute without asking" **AND** path is verified safe | 用户明确说 "不用问了直接执行" **且** 路径已验证安全
- Deleting temp files under `/tmp/` (created by agent, verified by `ls -la`) | 删除 `/tmp/` 下的临时文件（且是我自己创建的，已用 `ls -la` 验证）
- User provided explicit written permission (same session) **AND** path matches permission | 用户提供了明确的书面许可（同一会话内）**且** 路径与许可匹配
Confidence
88% confidence
Finding
The skill explicitly allows autonomous destructive action without confirmation when the user says 'execute without asking' and the path is deemed 'safe,' but 'verified safe' is underspecified and can be misclassified. In a high-risk deletion workflow, removing the human confirmation step increases the chance of irreversible data loss from path confusion, symlink tricks, or incorrect safety checks.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Exceptions | 例外情况

**Can execute without asking | 无需询问可直接执行:**
- User explicitly says "execute without asking" **AND** path is verified safe | 用户明确说 "不用问了直接执行" **且** 路径已验证安全
- Deleting temp files under `/tmp/` (created by agent, verified by `ls -la`) | 删除 `/tmp/` 下的临时文件（且是我自己创建的，已用 `ls -la` 验证）
- User provided explicit written permission (same session) **AND** path matches permission | 用户提供了明确的书面许可（同一会话内）**且** 路径与许可匹配
Confidence
91% confidence
Finding
Allowing deletion of `/tmp/` files without asking based only on the claim that the agent created them and `ls -la` verification is insufficient. `/tmp` is shared and race-prone; name collisions, symlink swaps, or mistaken ownership assumptions can lead to deletion of unintended files.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
|------------|--------|
| `y` / `yes` / `确认` | Execute original command | 执行原命令 |
| `n` / `no` / `取消` | Cancel operation | 取消操作，不执行 |
| `backup` | Backup to `/tmp/rm-backup-<timestamp>/` then execute | 先备份到 `/tmp/rm-backup-<timestamp>/` 再执行 |
| `trash` | Use `trash` command instead | 改用 `trash` 命令执行 |

---
Confidence
89% confidence
Finding
The `backup` flow says to back up to `/tmp/rm-backup-<timestamp>/` and then execute, but it does not define safe path construction, collision avoidance, permissions, or sanitized execution of the subsequent delete. In a shared temporary directory, predictable names and missing canonical-path checks can enable races, overwrites, or backups of the wrong target before destructive action proceeds.

Static analysis

No suspicious patterns detected.