T09 · Insecure Skill Coding Practices
Error
- Location
scanner.py:790- Finding
Default scanning omits and suppresses security findings in Skill instruction files
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawhub Publish V621
Security checks for vulnerabilities and agentic risk
Overview
The package appears to be a security scanner rather than malware, but it has serious review-worthy gaps that can understate risk and may expose scanned source in optional LLM use.
Install only after reviewing the scanner limitations. Use it as a heuristic aid, not as a final security gate; explicitly include SKILL.md and other instruction files in scans, avoid relying on context-based downgrades, and do not enable or import LLM analysis on private code unless you accept third-party disclosure of scanned snippets.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
context_aware_filter.py:46- Finding
Attacker-controlled context can downgrade confirmed malicious behavior
- Content
View full analysis
= 0.3, 'is_dev_tool': any(re.search(p, content_lower, re.IGNORECASE) for p in self.DEV_TOOL_PATTERNS), } def should_downgrade_risk(self, context: Dict[str, Any], original_risk: str) -> Tuple[str, str]: context_score = context.get('context_score', 0.0) if context_s ...[truncated 2981 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scanner.py:174- Finding
Broken optional LLM integration converts analysis errors into undetected results
- Content
View full analysis
0: if layer2_result.get('risk_level') == 'CRITICAL': layer3_result = scanner['layer3'].scan(content, layer1_result, layer2_result) ``` ```python # src/engines/llm_engine.py:20-25 class LLMEngine: def __init__(self, model: str = "minimax", api_key: Optional[str] = None): self.model = model self.api_key = api_key or os.environ.get('LLM_API_KEY', '') self.stats = {'total_analyses': 0, 'malicious_detected': 0} def analyze(self, code: str, context: Dict = None) -> LLMAnalysisResult: ``` ```python # scanner.py file-level exception behavior except Exception as e: return { 'file': str(file_path), 'error': str(e), 'detected': False } ``` ### Technical Analysis The scanner passes a configuration dictionary as the positional `model` argument even though `LLMEngine.__init__()` expects a string. More critically, the scanner calls `LLMEngine.scan()`, but the class exposes `analyze()` and has no `scan()` method. The invalid method call is reached only for files already classified as `CRITICAL`. The resulting `AttributeError` propagates to the broad file-level exception handler, which replaces the existing Layer 1 and Layer 2 findings with a result containing `detected: False`. A failure in an optional enrichment layer ...[truncated 857 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/engines/llm_engine.py:42- Finding
LLM engine can transmit scanned source code and embedded secrets to a third party without adequate safeguards
- Content
View full analysis
str: return f"""分析以下 YAML 是否恶意： ```yaml {yaml_content[:2000]} ``` 输出 JSON: {{"is_malicious": bool, "confidence": 0-1, "risk_level": "CRITICAL/HIGH/MEDIUM/LOW/NONE", "reasoning": "string"}}""" def _build_generic_prompt(self, code: str, context: Dict = None) -> str: return f"""分析以下代码是否恶意： ```python {code[:2000]} ``` 输出 JSON: {{"is_malicious": bool, "confidence": 0-1, "risk_level": "SAFE/HIGH", "reason": "string"}}""" def _call_llm(self, prompt: str) -> str: if self.model == 'minimax': try: import requests resp = requests.post('https://api.minimax.chat/v1/text/chatcompletion_v2', headers={'Authorization': f'Bearer {self.api_key}'}, json={'model': 'MiniMax-M2.7', 'messages': [{'role': 'user', 'content': prompt}]}) return resp.json()['choices'][0]['message']['content'] except Exception as e: print(f"MiniMax API 失败：{e}") return self._mock_response(prompt) return self._mock_response(prompt) ``` ### Technical Analysis When `LLMEngine` is instantiated correctly with `model='minimax'`, it embeds the first 2,000 characters of the scanned file in an HTTP request to MiniMax. Security scans commonly process source code containing API keys, access tokens, private endpoints, credentials, or proprietary implementation details. The content is transferred without secret detection or redaction. The documentation reviewed during the audit describes an optional LLM layer but does not clearly state that source content is uploaded to a third-party endpoint. The request also lacks an explicit timeout, which can indefinitely delay worker completion under advers ...[truncated 1221 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (94)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The scanner is presented as broad protection for prompt injection, credential theft, exfiltration, and attack chains, but the indicated behavior primarily suppresses or filters detections with only narrow heuristics. This creates a false sense of assurance in a security context, which is more dangerous than an ordinary product-description mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 敏感路径/文件 (高风险) SENSITIVE_PATHS = [ # SSH 凭据 r'\.ssh/id_rsa', r'\.ssh/id_ed25519', r'\.ssh/authorized_keys', r'\.ssh/known_hosts', # 云凭据 r'\.aws/credentials', r'\.aws/config', r'aws_access_key', r'aws_secret',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 敏感路径/文件 (高风险) SENSITIVE_PATHS = [ # SSH 凭据 r'\.ssh/id_rsa', r'\.ssh/id_ed25519', r'\.ssh/authorized_keys', r'\.ssh/known_hosts', # 云凭据 r'\.aws/credentials', r'\.aws/config', r'aws_access_key', r'aws_secret',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 敏感路径/文件 (高风险) SENSITIVE_PATHS = [ # SSH 凭据 r'\.ssh/id_rsa', r'\.ssh/id_ed25519', r'\.ssh/authorized_keys', r'\.ssh/known_hosts', # 云凭据 r'\.aws/credentials', r'\.aws/config', r'aws_access_key', r'aws_secret',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python SENSITIVE_PATHS = [ # SSH 凭据 r'\.ssh/id_rsa', r'\.ssh/id_ed25519', r'\.ssh/authorized_keys', r'\.ssh/known_hosts', # 云凭据 r'\.aws/credentials', r'\.aws/config', r'aws_access_key', r'aws_secret', r'\.azure/', r'azure_credentials',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.ssh/id_rsa', r'\.ssh/id_ed25519', r'\.ssh/authorized_keys', r'\.ssh/known_hosts', # 云凭据 r'\.aws/credentials', r'\.aws/config', r'aws_access_key', r'aws_secret', r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.ssh/id_rsa', r'\.ssh/id_ed25519', r'\.ssh/authorized_keys', r'\.ssh/known_hosts', # 云凭据 r'\.aws/credentials', r'\.aws/config', r'aws_access_key', r'aws_secret', r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.ssh/known_hosts', # 云凭据 r'\.aws/credentials', r'\.aws/config', r'aws_access_key', r'aws_secret', r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据 r'\.git-credentials', r'\.netrc', r'\.docker/config.json',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据 r'\.git-credentials', r'\.netrc', r'\.docker/config.json', # 配置文件中的凭据 r'\.env', r'\.env\.\w+', r'config.*\.json', r'credentials\.json', r'apikey', r'api_key', r'secret', r'token',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据 r'\.git-credentials', r'\.netrc', r'\.docker/config.json', # 配置文件中的凭据 r'\.env', r'\.env\.\w+', r'config.*\.json', r'credentials\.json', r'apikey', r'api_key', r'secret', r'token',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据 r'\.git-credentials', r'\.netrc', r'\.docker/config.json', # 配置文件中的凭据 r'\.env', r'\.env\.\w+', r'config.*\.json', r'credentials\.json', r'apikey', r'api_key', r'secret', r'token',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据 r'\.git-credentials', r'\.netrc', r'\.docker/config.json', # 配置文件中的凭据 r'\.env', r'\.env\.\w+', r'config.*\.json', r'credentials\.json', r'apikey', r'api_key', r'secret', r'token',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据 r'\.git-credentials', r'\.netrc', r'\.docker/config.json', # 配置文件中的凭据 r'\.env', r'\.env\.\w+', r'config.*\.json', r'credentials\.json', r'apikey', r'api_key', r'secret', r'token',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python r'\.azure/', r'azure_credentials', r'\.gcloud/', r'google_credentials', # Git/Docker 凭据 r'\.git-credentials', r'\.netrc', r'\.docker/config.json', # 配置文件中的凭据 r'\.env', r'\.env\.\w+', r'config.*\.json', r'credentials\.json', r'apikey', r'api_key', r'secret', r'token',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python (r'cat\s+.*\.(json|env|yaml|yml|cfg|conf)', '读取配置文件'), (r'cat\s+.*\$HOME', '读取用户目录文件'), (r'getenv\(|os\.environ', '读取环境变量'), (r'keyring\.|keyring\.get_password', '读取系统密钥环'), (r'passlib|pysftp|paramiko', '凭据使用库'), ]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python (r'cat\s+.*\.(json|env|yaml|yml|cfg|conf)', '读取配置文件'), (r'cat\s+.*\$HOME', '读取用户目录文件'), (r'getenv\(|os\.environ', '读取环境变量'), (r'keyring\.|keyring\.get_password', '读取系统密钥环'), (r'passlib|pysftp|paramiko', '凭据使用库'), ]
Static analysis
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/engines/pattern_engine.py:269
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- config_detector.py:231
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- whitelist_filter.py:268