ClawHub
Back to skill

Security audit

local-skill-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill manages local skill folders as advertised, with disclosed local file reads, scaffold creation, and guarded deletion behavior.

Install this only if you want an agent to manage your local skills directory. Review delete operations carefully, prefer the documented --dry-run first, avoid --force unless you are certain, and pin PyYAML in a controlled environment if you need reproducible installs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1 (installation instruction at SKILL.md:39)
Vulnerability Type: Unpinned package dependency
Risk Level: Medium

Complete Code Snippet:

text
pyyaml

The project instructs users to install this dependency as follows:

bash
pip install -r requirements.txt

Technical Analysis

The PyYAML dependency has no exact version constraint or package-integrity hash. Consequently, each installation resolves whichever release the configured package index currently considers suitable. The installed code can therefore change after this Skill has been reviewed, without any corresponding change to the repository.

This creates supply-chain exposure if a future PyYAML release is compromised, malicious content is served by a configured or compromised package index, or a newly published release contains a security regression. The evidence does not establish that the legitimate pyyaml package is currently malicious; the issue is the lack of reproducible, integrity-verified dependency resolution.

Attack Path

  1. An attacker compromises a future dependency release or the package-index path used by the victim.
  2. A user follows the documented prerequisite and runs pip install -r requirements.txt.
  3. Because pyyaml is unpinned and has no hash, pip resolves and downloads the attacker-influenced artifact.
  4. Malicious package installation logic may execute during installation, or malicious runtime code may execute when the scripts import yaml.
  5. The payload runs with the permissions of the user performing installation or invoking the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing or invoking user's privileges. Depending on that account's permissions, the affected scope could include files, credentials, environment variables, and other resources accessible to the user. No p ...[truncated 71 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin PyYAML to a specifically reviewed release, for example PyYAML==X.Y.Z.
  • Generate and enforce cryptographic hashes, such as by using a locked requirements file and installing with pip install --require-hashes -r requirements.txt.
  • Obtain packages only from an explicitly trusted index and prevent fallback to untrusted package sources.
  • Automate dependency vulnerability and provenance checks before updating the lock file.
  • Review and test dependency updates before deployment.
  • Install the project in an isolated virtual environment under a least-privileged account.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description promises a multi-function 'Skill manager' covering discovery, version inspection, creation, and deletion of local skills. The actual code chunk is narrowly scoped to creating a new skill scaffold under a local skills directory. This is a materially narrower behavior than the declared purpose. There is no evidence in this code of querying installed skills, checking versions, or removing skills. While 'create skill' is one declared function and is accurately represented, the overall description overstates the code chunk’s capabilities and primary purpose.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
使用标准目录结构（`scripts/`、`references/`、`assets/`）和 `SKILL.md` 模板快速脚手架一个新 Skill。

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/delete_skill.py (reported line 17)May include surrounding context.

python
"""
    Validate skill name: only allow lowercase letters, numbers, and hyphens.
    Reject any path separators, '..', or absolute paths to prevent
    path traversal attacks (e.g., '../other-dir' or '/etc/passwd').
    """
    return bool(re.match(r'^[a-z0-9-]+$', skill_name))

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
85% confidence
Finding

The trigger 'list skills' is close to a generic built-in action and may shadow or hijack user intent, causing the platform to invoke this skill instead of a safer or expected native command. In a skill that can enumerate local assets and later drive create/delete workflows, ambiguous routing increases the chance of unintended data exposure or unsafe actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and many trigger phrases are written in Chinese, and the file presents the skill as if it should be invoked in that language, but it does not offer users a language/locale option or explain that the skill is intentionally region-specific. This creates a natural-language policy concern because it implicitly constrains usage to a specific language without opt-in.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
89% confidence
Finding

The trigger 'create skill' conflicts with a generic creation command and can intercept broad user requests, potentially causing filesystem writes when the user intended a different create operation. Because this skill is explicitly designed to scaffold local directories and files, accidental invocation could modify the local environment in ways the user did not intend.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
92% confidence
Finding

The trigger 'delete skill' overlaps with the generic built-in 'delete' action, creating a real risk that ordinary deletion requests are routed into a filesystem-destructive skill. In this context, the skill includes removal functionality, so trigger ambiguity materially raises the danger of unintended local deletion.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency is specified as just pyyaml without any version pin or range constraint, which makes builds non-reproducible and allows different environments to resolve to different releases. This increases supply-chain risk and can accidentally pull in vulnerable or behavior-changing versions over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
pyyaml

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

PyYAML has a history of security advisories, and because no version is pinned, there is no way to verify from this manifest whether a safe or vulnerable release will be installed. In a skill manager context, YAML may plausibly be used for local configuration or metadata parsing, which makes use of a vulnerable PyYAML version more relevant, especially if any untrusted YAML is ever processed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.