ClawHub
Back to skill

Security audit

skill-lint

Security checks for vulnerabilities and agentic risk

Overview

This is a security and quality linting skill whose powerful behaviors are disclosed and mostly gated by explicit user action.

This skill is reasonable to install for skill quality review, but treat its dynamic verification as code execution: use it only on your own or reviewed candidate skills, or run third-party candidates in a disposable isolated environment. Avoid --online for private dependency lists unless OSV disclosure is acceptable, and keep evaluator private keys outside candidate workspaces and normal agent runs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
environment.update(
                {"HOME": temp_home, "TMPDIR": temp_home, "TEMP": temp_home, "TMP": temp_home}
            )
            completed = subprocess.run(
                command,
                cwd=candidate_root,
                env=environment,
Confidence
95% confidence
Finding
The script dynamically executes candidate-supplied checkers via subprocess.run after only validating that the checker path is inside the candidate tree and has an expected file suffix. That means verification of an ostensibly 'trusted' candidate still runs arbitrary Python/shell/Node code on the host with inherited environment values and without sandboxing, so a malicious or mistakenly unsafe checker can execute commands, access network/resources available to the user, or exfiltrate data. In this skill context, the danger is elevated because the tool is explicitly framed as a review/acceptance gate, which may encourage operators to run it on third-party skills despite the warning flag.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
environment.update(
                {"HOME": temp_home, "TMPDIR": temp_home, "TEMP": temp_home, "TMP": temp_home}
            )
            completed = subprocess.run(
                command,
                cwd=policy_root,
                env=environment,
Confidence
97% confidence
Finding
This code executes a Python script from policy_root via subprocess during verification. Although not shell-injected, it still runs local code and the surrounding workflow is a security-analysis skill, so invoking external code based on filesystem state creates a trust-boundary risk: a tampered policy tree or unexpected script can execute arbitrary code with the user's privileges.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
environment.update(
                {"HOME": temp_home, "TMPDIR": temp_home, "TEMP": temp_home, "TMP": temp_home}
            )
            completed = subprocess.run(
                command,
                cwd=candidate_root,
                env=environment,
Confidence
99% confidence
Finding
This path executes candidate-provided checker implementations from the analyzed skill directory. Even with shell=False, minimal environment variables, and a confirmation flag, this is arbitrary code execution on potentially adversarial content, which directly conflicts with the skill's role as a lint/security gate and can lead to full compromise of the host environment or tampering with analysis artifacts.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
environment.update(
                {"HOME": temp_home, "TMPDIR": temp_home, "TEMP": temp_home, "TMP": temp_home}
            )
            completed = subprocess.run(
                [checker["runtime"], str(implementation), *args],
                cwd=candidate_root,
                env=environment,
Confidence
99% confidence
Finding
This negative-case path also executes candidate-provided checker code from the skill directory. The same arbitrary-code-execution risk applies here, and because the skill is supposed to assess other skills, treating candidate code as runnable greatly increases the chance of malicious checkers escaping review and attacking the evaluator machine.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
]
        for command in commands:
            try:
                completed = subprocess.run(
                    command,
                    env=minimal_environment(),
                    stdin=subprocess.DEVNULL,
Confidence
79% confidence
Finding
This subprocess signs evaluator evidence using a private key supplied on disk. The command itself is not shell-injectable, but embedding private-key signing capability into the skill increases misuse risk and expands the blast radius if the host or workflow is compromised, especially because this skill is for review/gating rather than trusted signing operations.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
self.write_held_out_manifest()

    def run_gate(self, *args: str) -> subprocess.CompletedProcess[str]:
        return subprocess.run(
            ["python3", str(SCRIPT), *args],
            text=True,
            capture_output=True,
Confidence
68% confidence
Finding
The helper forwards arbitrary *args into execution of the target gate script, and it deliberately injects a sensitive environment variable, INSTRUCTION_STABILITY_SECRET, into every child process. In this test file, the candidate checker code is also attacker-influenced test content and explicitly demonstrates reading that secret, so propagating the full parent environment plus the secret increases exposure of sensitive data to untrusted subprocesses during dynamic verification flows.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill text instructs the operator to use local scripts that perform security scanning, harness auditing, and optional online vulnerability checks, which implies shell execution, file read/write, environment access, and network use. However, the skill does not declare these capabilities or require explicit user consent/boundary disclosure, creating a transparency and least-privilege problem that could lead users to run tooling with broader access than expected.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Including evaluator-evidence signing with a private key inside a lint/review skill mixes security assessment with privileged trust issuance. If this tool or host is abused, an attacker may obtain signed artifacts that appear authoritative, undermining the integrity of the surrounding evaluation pipeline.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The script offers an optional `--online` mode that performs live network access to OSV, which expands a local static scanner into a networked tool. In a lint/precheck skill, this is a real capability-scope increase because package names and versions from the scanned target can be transmitted to a third party, creating privacy and consent concerns even if the destination is legitimate.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This code implements the actual HTTP POST to `https://api.osv.dev/v1/query`, sending dependency identifiers and versions outside the local environment. That is a genuine external-transmission behavior and is more sensitive in this skill because the advertised purpose is deterministic static scanning rather than remote enrichment.

External Transmission

Medium
Category
Data Exfiltration
Content
{"package": {"ecosystem": ecosystem, "name": pkg_name}, "version": version}
        ).encode()
        req = urllib.request.Request(
            "https://api.osv.dev/v1/query",
            data=payload,
            headers={"Content-Type": "application/json"},
            method="POST",
Confidence
96% confidence
Finding
The hardcoded OSV endpoint confirms that the scanner can transmit information to an external service. Even though the destination is a known vulnerability database and the feature is optional, this still creates data egress from analyzed environments and may violate expectations for a local security lint tool.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/test_security_scan.py:139