ClawHub
Back to skill

Security audit

Animation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent animation-code helper, but it needs review because its script can write generated files to unrestricted paths and embeds stored animation content into HTML without sanitizing it.

Review before installing. Use this only with trusted animation names and values, open generated preview HTML cautiously, and avoid letting untrusted prompts or project content choose --output paths because exports/previews can overwrite writable files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:594
Finding

Stored HTML Injection in Generated Animation Previews

Content
View full analysis
Animation Preview body {{ font-family: sans-serif; padding: 40px; background: #1a1a2e; color: #eee; }} .preview-box {{ width: 120px; height: 120px; background: #e94560; margin: 30px auto; border-radius: 12px; }} {css_code}

Animation Preview

Animations: {', '.join(r.get('name', '?') for r in animations)}

""" with open(output, "w") as f: f.write(html) ``` ### Technical Analysis The `keyframe` command accepts attacker-controlled animation names and step values and stores the resulting code in `~/.animation/data.jsonl`. Th ...[truncated 2025 chars]
Remediation
View remediation
` element. 4. Avoid embedding untrusted generated CSS directly into the HTML document. Prefer a separately generated stylesheet containing validated CSS. 5. If inline CSS is required, explicitly reject sequences capable of terminating the element, including case-insensitive `

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:536
Finding

Unrestricted Output Path Allows Overwriting Arbitrary Writable Files

Content
View full analysis
\n\n' for rec in records: if rec.get("type") == "svg": content += rec.get("code", "") + "\n" else: content += f' \n' content += "" else: content = json.dumps(records, indent=2) if output: with open(output, "w") as f: f.write(content) print(json.dumps({"status": "exported", "file": output, "count": len(records)}, indent=2)) else: print(content) ``` The `preview` command has the same unrestricted write behavior: ```python name = params.get("name", "") output = params.get("output", "preview.html") animations = [] with open(data_file, "r") as f: for line in f: line = line.strip() if not line: continue rec = json.loads(line) if not name or rec.get("name") == name: animations.append(rec) css_code = "\n".join(rec.get("code", "") for rec in anima ...[truncated 2515 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
Run via: `bash scripts/script.sh <command> [options]`

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill describes capabilities that read environment data and read/write local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent or platform may grant broader execution than users expect, increasing the risk of unintended file access, persistence to disk, or exposure of sensitive local data during normal use of the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a code-generation skill for CSS/SVG animations, which suggests producing snippets as output. In addition to generation, the script creates a persistent data store under ~/.animation and multiple commands append to and rewrite that file, making this a local animation manager rather than just a snippet generator.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/script.sh (reported line 23)May include surrounding context.

sh
Usage: bash script.sh <command> [options]

Commands:
  create      Create a new CSS or SVG animation
  keyframe    Generate a @keyframes block
  transition  Generate a CSS transition snippet
  timing      Show or set timing-function

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The preview and export features write attacker-controlled content to arbitrary file paths, and preview embeds previously stored CSS directly into an HTML document without sanitization. In the context of a code-generation skill, this can create active content on disk that may execute in a browser or overwrite unintended user files if the caller supplies a sensitive output path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.