ClawHub
Back to skill

Security audit

Windows CWD Launch Fix

Security checks for vulnerabilities and agentic risk

Overview

The repair approach is reasonable, but its launcher starts every executable in the application folder without clearly warning the user.

Before using the launcher, replace its wildcard loop with the exact intended application filename and check that file exists. Otherwise, unrelated executables in the same folder will also start with your permissions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The launcher runs every executable in its directory without warning that unrelated executables will also be started.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The documented launcher template starts every adjacent .exe, rather than selecting the intended application. An attacker able to place an executable in that directory could have it run with the user's privileges when the launcher is used; legitimate installers or utilities could also be started unintentionally. The CWD-repair context does not require this broad execution behavior, and calling the template hardened may encourage unsafe reuse.

Content

No source excerpt is available for this finding.

The launcher executes every adjacent .exe rather than only the intended application.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The wildcard loop executes all .exe files beside the launcher, including executables unrelated to DyberPet. If an attacker can introduce an executable into that directory, an ordinary launch will execute it with the launching user's privileges; the resource and _internal checks do not authenticate or restrict the executable set. Explicitly setting the working directory fixes resource resolution but does not mitigate this execution risk.

Content

No source excerpt is available for this finding.