ClawHub
Back to skill

Security audit

Bearing

Security checks for vulnerabilities and agentic risk

Overview

The skill claims to be a bearing calculator but is actually a persistent local data store with delete/export/config features and unsafe input handling.

Review before installing. Do not treat this as a bearing calculator in its current form; it behaves like a local note/database utility. Avoid storing sensitive data in it, avoid opening exported CSVs from untrusted entries in spreadsheet software, and do not run the config command with untrusted key or value input unless the script is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/script.sh:141
Finding

Arbitrary Command Execution Through GNU sed Configuration Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:141-142
Vulnerability Type: Command injection through dynamically constructed GNU sed expression
Risk Level: High

Vulnerable Code

bash
if [ -f "$cfg" ] && grep -q "^${key}=" "$cfg" 2>/dev/null; then
    sed -i "s|^${key}=.*|${key}=${val}|" "$cfg"
else
    echo "${key}=${val}" >> "$cfg"
fi

Technical Analysis

The config command inserts the user-controlled key and val arguments directly into a GNU sed program. Shell double-quoting prevents ordinary shell word splitting but does not prevent the arguments from altering the syntax interpreted by sed.

A crafted value can close the replacement section with the | delimiter and append GNU sed's e flag. When a substitution succeeds, this flag passes the replacement text to a shell for execution. The attacker can then use a semicolon and comment marker to suppress the remaining generated expression.

The key is also unsafe because it is embedded unescaped in both a regular expression and the sed expression. This can cause expression injection, incorrect matching, or denial of service. The command-execution path specifically depends on GNU sed or another implementation supporting the substitution e flag.

Attack Path

  1. Create a legitimate configuration entry so the vulnerable update branch is selected:

    bash
    scripts/script.sh config x safe

  2. Update that entry with a value that terminates the replacement and enables command execution:

    bash
    scripts/script.sh config x 'foo id|e;#'

  3. The script constructs an expression equivalent to:

    sed
    s|^x=.*|x=foo id|e;#|

  4. GNU sed executes the replacement text x=foo id through a shell when the matching configuration line is replaced. The id command can be replaced with another command available to the invoking account.

  5. No elevated ...[truncated 712 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not build a sed program by interpolating user-controlled strings.
  • Restrict configuration keys to a conservative allowlist, such as ^[A-Za-z_][A-Za-z0-9_]*$.
  • Rewrite the configuration file with a parser that treats keys and values strictly as data. A structured format such as JSON, processed by a trusted JSON utility, is preferable.
  • If an awk-based implementation is used, pass data separately with -v rather than concatenating it into source code, and write to a securely created temporary file before performing an atomic replacement.
  • Reject control characters and embedded newlines where configuration values are intended to remain single-line.
  • Set restrictive file permissions and verify that the configuration path is not a symbolic link before replacing it.
  • Add regression tests containing |, ;, #, backslashes, newlines, regular-expression metacharacters, and strings designed to trigger GNU sed flags.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:108
Finding

Spreadsheet Formula Injection and Malformed CSV Export

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:108-114
Related Input Storage Location: scripts/script.sh:15
Vulnerability Type: CSV formula injection and improper CSV encoding
Risk Level: Medium

Vulnerable Code

bash
echo "timestamp,command,value" > "$out"
while IFS= read -r line; do
    ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4)
    c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4)
    vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4)
    echo "$ts,$c2,$vl" >> "$out"
done < "$DATA_DIR/data.jsonl"

User-controlled values enter the data file through:

bash
printf '{"ts":"%s","cmd":"%s","val":"%s"}\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"

Technical Analysis

The add command stores attacker-controlled entry text, and the CSV exporter writes the extracted value directly into a CSV row. It does not quote fields, escape embedded double quotes, or neutralize values whose first significant character is =, +, -, or @.

Spreadsheet applications may interpret such values as formulas rather than text when the exported file is opened. Depending on the spreadsheet application and its security configuration, a formula can initiate external requests, expose data through attacker-controlled URLs, present misleading content, or invoke other dangerous spreadsheet functionality.

Independently of formula execution, commas and line breaks in input can create additional columns or records. Double quotes are also not encoded according to CSV rules. This allows an attacker to corrupt the exported structure or manipulate how records are presented to a reviewer.

The storage operation also constructs JSON text without JSON escaping. Quotes, backslashes, and control characters can therefore produce invalid JSONL records, although the exporter processes them using regular-expression extraction rather than a JSON parse ...[truncated 1532 chars]

Remediation
View remediation

Remediation Suggestions

  • Generate standards-compliant CSV rather than concatenating fields with commas.
  • Enclose every field in double quotes and replace each embedded double quote with two double quotes.
  • Normalize or reject embedded carriage returns and line feeds if multiline fields are not required.
  • Neutralize spreadsheet formulas in untrusted text fields. For values beginning with =, +, -, or @, prefix an apostrophe or use another mitigation documented for the spreadsheet products in scope.
  • Apply formula neutralization after removing or accounting for leading whitespace and control characters that some spreadsheet clients ignore.
  • Use a proper JSON encoder when storing records and a proper JSON parser when reading them; do not construct or parse JSON with printf, grep, and cut.
  • Add tests for commas, quotes, CR/LF characters, backslashes, Unicode, and all common spreadsheet formula prefixes.
  • Document that exported files contain untrusted data and should be imported with formula evaluation disabled where possible.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a bearing selection and life calculator, but the documented behavior is a generic persistent CRUD/data-store utility that writes to ~/.bearing and supports add/list/search/remove/export/config operations. This mismatch can mislead users and higher-level agents into granting trust or invoking the skill under false assumptions, increasing the chance of unintended data handling and unsafe automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The implementation materially diverges from the declared purpose: instead of performing bearing selection or life calculations, it acts as a persistent local data logger with CRUD, search, and export features. That mismatch is dangerous because users or higher-level agents may grant or trust the skill based on its benign description while it quietly collects and persists arbitrary user-provided data, expanding data exposure beyond the expected scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and description claim domain-specific industrial functionality, but the commands describe a generic local database tool. In an agent ecosystem, this kind of semantic deception is dangerous because it can bypass user expectations, cause inappropriate invocation, and enable unreviewed local data collection or manipulation under an innocuous label.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents a remove command that deletes an entry, but it provides no warning about data loss, confirmation behavior, or whether removal is reversible. For markdown files, user-facing descriptions should warn about behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Persistent storage, free-form config writing, search, and export are not justified by the stated bearing-calculator functionality and create unnecessary capability for retaining and exfiltrating local user data. In this context, the mismatch makes the behavior more suspicious because the skill can accumulate arbitrary entries in a hidden home-directory path and later export them, which exceeds normal expectations for a simple engineering calculator.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill advertises an export command that writes data to a file, but the documentation does not warn where the file is written, whether an existing file may be overwritten, or what data is included. Markdown descriptions should disclose behaviors that affect user data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.