ClawHub
Back to skill

Security audit

Build

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Aomi app-building skill, but it needs review because its install and build workflow can run mutable Rust code with broader access than the skill clearly scopes.

Review this before installing. Prefer a pinned aomi-sdk release or commit instead of the current Git branch, inspect generated files before running Cargo builds, and treat generated trading or wallet tools as high-impact code that needs explicit confirmation, limits, and sandbox/testnet defaults.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Git Repository Used to Build and Install an Executable CLI

Content
View full analysis
. Designed for claude-code; also works with Cursor, Codex CLI, Gemini, and any agent runtime that supports the Anthropic skill spec.' ``` ### Technical Analysis The recommended installation command builds and installs executable code directly from a Git repository without selecting a reviewed commit or immutable release: ```bash cargo install --git https://github.com/aomi-labs/aomi-sdk --features cli aomi-sdk ``` Without `--rev`, `--tag`, or another immutable source constraint, Cargo resolves the repository's current default branch. The effective code installed by this instruction can therefore change after the Skill has been reviewed. Cargo compilation can execute build scripts and procedural macros supplied by dependencies. Consequently, the exposure is not limited to the installed CLI's later runtime behavior: compromised upstream source or dependencies may execute during installation. This is unnecessary because the Skill explicitly identifies a compatible SDK version and could pin a corresponding reviewed release or commit. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or an upstream dependency. 2. The attacker adds malicious source, a build script, or a malicious dependency to the mutable branch used by the installation command. 3. A user follows the installation instruction in `SKILL.md`. 4. ...[truncated 863 chars]
Remediation
View remediation
\ --features cli \ aomi-sdk ``` 2. Prefer a versioned registry release with a committed `Cargo.lock`, where supported. 3. Publish signed release tags and Sigstore or GitHub attestations. 4. Document how users can verify the selected commit and release provenance. 5. Use dependency auditing and reproducible-build controls in the release pipeline. 6. Avoid wording such as “current CLI” when security depends on a specific reviewed version. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:27
Finding

Cargo and Git Shell Permissions Exceed the Documented Operational Scope

Content
View full analysis
Remediation
View remediation
` 3. Restrict Cargo to reviewed forms: - `cargo build --manifest-path ` - `cargo test --manifest-path ` - The specific `cargo run` invocation required for `aomi-build` 4. Require explicit user approval for any Cargo or Git command outside the allowlist. 5. Constrain working directories and path arguments to the selected workspace. 6. Explicitly deny destructive Git operations and Git configuration changes. 7. Do not rely on the executable prefix alone as a least-privilege boundary. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
templates/quick-scaffold.sh:77
Finding

Scaffold Wrapper Executes Cargo Builds Before Generated Files Are Reviewed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 153)May include surrounding context.

md
**Notes on findings**:

- The 2 pors WARN findings match documentation patterns:
  - `prompt/(delete|remove|rm)...` matches a row in `references/examples.md` table where one of the example tools is `binance_cancel_order` mapped to a `DELETE /order` HTTP endpoint. The match is on the literal string `DELETE` inside the reference table, not on a destructive instruction — the skill itself never deletes files.
  - `prompt/(read|access|get|ext...)` matches `references/spec-to-tools.md` describing the canonical tool naming pattern (`get_*`, `read_*`, `list_*`). Documentation about the convention, not an instruction to access sensitive data.
- Snyk requires an API token for the SaaS-backed analysis. Token-gated runs are tracked as a maintainer task; the W-code analysis approach used for `aomi-transact` (see [`aomi-transact/SECURITY.md`](../aomi-transact/SECURITY.md) Snyk W-code table) will apply if any HIGH-class characterizations come back. For `aomi-build` specifically, the only Snyk W-codes that could plausibly apply are W007 (insecure credential handling) — already mitigated by the no-credential-embedding rule and the auth resolution pattern documented in `references/examples.md`. The skill does not move funds (no W009), does not depend on third-party content (no W011), and does not invoke `npx` or other unpinned external URLs (no W012).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The example encourages exposing high-risk state-changing tools such as order placement and cancellation as model-callable operations, but it does not require strong authorization boundaries, confirmation gates, or transaction-policy constraints. In an agent environment, parameterized trading tools can be abused by prompt injection, ambiguous user requests, or model mistakes to place or cancel real orders with financial impact.

Content

Scanner excerpt · references/examples.md (reported line 45)May include surrounding context.

md
| `binance_get_klines` | "give me OHLC for technical analysis" | `GET /klines` |
| `binance_get_24hr_stats` | "rolling 24h stats" | `GET /ticker/24hr` |
| `binance_place_order` | "submit a buy/sell order" | `POST /order` (signed) |
| `binance_cancel_order` | "cancel my order" | `DELETE /order` (signed) |
| `binance_get_account` | "what's my balance?" | `GET /account` (signed) |
| `binance_get_trades` | "my fill history" | `GET /myTrades` (signed) |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 89)May include surrounding context.

If missing:

xcode-select --install

If keychain is locked:

security unlock-keychain login.keychain

text

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 90)May include surrounding context.

If missing:

xcode-select --install

If keychain is locked:

security unlock-keychain login.keychain

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 11)May include surrounding context.

md
`aomi-build` is a procedure for an AI agent to scaffold new Aomi app crates from API docs, OpenAPI/Swagger specs, SDK docs, repository examples, endpoint notes, runtime interfaces, or product requirements. The skill writes Rust source files (`lib.rs`, `client.rs`, `tool.rs`, `Cargo.toml`) inside an `aomi-sdk`-shaped workspace and runs `cargo` + `git` commands to compile and track the new crate. It does not move funds, sign transactions, custody secrets, or make network calls of its own. It is correctly classified as **risk_tier: L1** (low) under the OWASP universal manifest schema.

The principal harm path the skill must guard against is **scaffolding code that, when later compiled and run by the user, exfiltrates data or executes attacker-controlled logic**. The OWASP `permissions:` manifest, the explicit `build.rs` deny-write entry, the no-network policy, and the documented "do not embed credentials in scaffolded source" rule all target this path.

## Controls by AST risk

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

cd ../aomi-sdk cargo run -p aomi-sdk --features cli --bin aomi-build -- init my-integration cargo run -p aomi-sdk --features cli --bin aomi-build -- compile --app my-integration cargo run -p aomi-sdk --features cli --bin aomi-build -- new-app geckoterminal --from-url https://api.geckoterminal.com/docs/v2/swagger.json

text

## Instructions

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/aomi-sdk-patterns.md (reported line 209)May include surrounding context.

cd ../aomi-sdk cargo run -p aomi-sdk --features cli --bin aomi-build -- init my-integration cargo run -p aomi-sdk --features cli --bin aomi-build -- compile --app my-integration cargo run -p aomi-sdk --features cli --bin aomi-build -- new-app geckoterminal --from-url https://api.geckoterminal.com/docs/v2/swagger.json

text

## Instructions

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/aomi-sdk-patterns.md (reported line 212)May include surrounding context.

cd ../aomi-sdk cargo run -p aomi-sdk --features cli --bin aomi-build -- init my-integration cargo run -p aomi-sdk --features cli --bin aomi-build -- compile --app my-integration cargo run -p aomi-sdk --features cli --bin aomi-build -- new-app geckoterminal --from-url https://api.geckoterminal.com/docs/v2/swagger.json

text

## Instructions

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The example explicitly guides building signed trading tools and resolving API credentials from arguments or environment variables, but it does not pair that with strong warnings, consent requirements, or safe-handling guidance for secrets and live order execution. In an agent-skill context, this increases the chance of accidental trading, misuse of privileged exchange keys, or unsafe prompting that normalizes high-risk financial actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 113)May include surrounding context.

md
Ok(hex_encode(&mac.finalize().into_bytes()))
}

pub(crate) const SPOT_BASE_URL: &str = "https://api.binance.com/api/v3";

pub(crate) struct BinanceClient {
    pub(crate) http: reqwest::blocking::Client,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 215)May include surrounding context.

md
### What NOT to do

- Don't invent endpoints like `https://api.protocol.com/swap/quote` if the docs don't publish one.
- Don't claim the app can submit transactions when it can't.
- Don't generate tools named `place_order` or `submit_swap` against a service that doesn't exist.

Static analysis

No suspicious patterns detected.