ClawHub
Back to skill

Security audit

Tdd Helper

Security checks across malware telemetry and agentic risk

Overview

This TDD helper has a coherent purpose, but it can run raw shell commands from arguments and environment variables, so it needs review before use.

Install only if you are comfortable with this skill running local shell commands under your user account. Review every --run value and any TEST_CMD, LINT_CMD, WARN_AS_ERROR, and --tests inputs before use, and avoid using it in shared, CI, or agent environments where environment variables or command arguments may be influenced by untrusted content.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
TEST_CMD = os.getenv('TEST_CMD') or f"pytest {args.tests}" if os.path.isdir(args.tests) else f"pytest {args.tests}"

print(f"Running tests: {TEST_CMD}")
res = subprocess.run(TEST_CMD, shell=True)
if res.returncode != 0:
    print("Tests failed or missing. Aborting run.")
    sys.exit(res.returncode or 1)
Confidence
98% confidence
Finding
The code executes TEST_CMD via subprocess.run(..., shell=True), and TEST_CMD can come directly from the TEST_CMD environment variable. Using a shell with environment-controlled input enables arbitrary command execution, which is broader than simply running a fixed test command and is dangerous in agent or CI contexts where environment values may be influenced externally.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
sys.exit(lint_res.returncode or 1)

print("Tests green. Running target...")
run_res = subprocess.run(args.run, shell=True)
sys.exit(run_res.returncode)
Confidence
99% confidence
Finding
The script executes args.run with shell=True after tests pass, which allows any caller-provided string to be interpreted as a shell command. In a skill context, this turns the helper into a general-purpose command runner gated only by test success, enabling command injection or abuse beyond the stated lightweight TDD purpose.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if os.getenv('WARN_AS_ERROR') == '1':
    lint = os.getenv('LINT_CMD') or "ruff ."
    print(f"Running lint: {lint}")
    lint_res = subprocess.run(lint, shell=True)
    if lint_res.returncode != 0:
        print("Lint/warnings failed. Aborting run.")
        sys.exit(lint_res.returncode or 1)
Confidence
97% confidence
Finding
The lint command is executed with shell=True and can be sourced from the LINT_CMD environment variable. This creates arbitrary command execution through environment manipulation, especially risky in shared automation, CI, or agent environments where env vars may be inherited unexpectedly.

Tainted flow: 'TEST_CMD' from os.getenv (line 8, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
TEST_CMD = os.getenv('TEST_CMD') or f"pytest {args.tests}" if os.path.isdir(args.tests) else f"pytest {args.tests}"

print(f"Running tests: {TEST_CMD}")
res = subprocess.run(TEST_CMD, shell=True)
if res.returncode != 0:
    print("Tests failed or missing. Aborting run.")
    sys.exit(res.returncode or 1)
Confidence
99% confidence
Finding
This is a real tainted-data-to-code-execution flow: TEST_CMD originates from os.getenv and is passed directly into subprocess.run with shell=True. Because environment variables are external inputs, an attacker who can influence process environment can execute arbitrary shell commands under the agent's privileges.

Tainted flow: 'lint' from os.getenv (line 17, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
if os.getenv('WARN_AS_ERROR') == '1':
    lint = os.getenv('LINT_CMD') or "ruff ."
    print(f"Running lint: {lint}")
    lint_res = subprocess.run(lint, shell=True)
    if lint_res.returncode != 0:
        print("Lint/warnings failed. Aborting run.")
        sys.exit(lint_res.returncode or 1)
Confidence
98% confidence
Finding
The lint variable is derived from LINT_CMD in the environment and then executed through the shell. That creates a direct external-input-to-command-execution path, allowing malicious env values to run arbitrary commands when WARN_AS_ERROR is enabled.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises executable capabilities through shell commands and environment-based configuration, but it does not declare corresponding permissions. This creates a trust and policy gap: consumers or enforcement systems may treat the skill as lower risk than it actually is, allowing command execution paths without explicit review or consent.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The helper's behavior exceeds its stated purpose by executing arbitrary shell commands for tests, linting, and the post-test run step. In agent settings, such broad execution capability materially increases the attack surface because the skill can be repurposed as a generic shell launcher rather than a constrained TDD loop helper.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.