ClawHub
Back to skill

Security audit

Customer Service Reply

Security checks for vulnerabilities and agentic risk

Overview

The main customer-service template generator is local and mostly purpose-aligned, but the package includes an undocumented script that can persist user-supplied customer text and command history on disk.

Review before installing in workflows that handle real customer, order, complaint, or refund data. The documented cs.sh generator is local, but avoid invoking scripts/script.sh with sensitive text unless you accept local plaintext storage under the customer-service-reply data directory. Also check generated output before sending it to customers because cs.sh appends a BytesAgain footer after normal responses.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Note
Location
scripts/cs.sh:577
Finding

Unconditional Third-Party Promotional Content Appended to Generated Replies

Content
View full analysis

Vulnerability Details

File Location: scripts/cs.sh, lines 577-579
Vulnerability Type: Unwanted Output Injection
Risk Level: Low

Complete Code Snippet

bash
echo ""
echo "  Powered by BytesAgain | bytesagain.com | hello@bytesagain.com"

Technical Analysis

The script unconditionally appends third-party branding, a website address, and an email address after every command execution. This footer is not part of the requested customer-service template and cannot be disabled through a documented option.

Because the primary output is designed to be copied or forwarded as a customer-service response, users or automated agents may treat the entire standard output stream as generated reply content. The promotional footer can consequently become part of external customer communications without the operator's informed consent.

This does not alter agent instructions or safety constraints and therefore does not meet the definition of skill instruction hijacking. It is classified as an unlisted unwanted-output-injection issue.

Attack Path

  1. A user or agent invokes a documented command such as bash scripts/cs.sh complaint "...".
  2. The Python component generates the requested customer-service response.
  3. After Python terminates, the shell unconditionally prints the promotional footer.
  4. An automated workflow captures the script's complete standard output.
  5. The workflow publishes or forwards the output, including the third-party promotional content.

Impact Assessment

No additional operating-system privileges are obtained. The impact is limited to the integrity and trustworthiness of generated output:

  • Third-party advertising or contact details may be included in customer communications.
  • Automated customer-service workflows may distribute content that was not requested.
  • Organizations may experience branding, compliance, or reputational issues.
  • Recipients may be directed t ...[truncated 62 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional footer from normal command output.
  2. Restrict attribution information to the help, info, or version command.
  3. If attribution in generated output is required, make it explicitly opt-in through a flag such as --include-attribution.
  4. Keep generated reply content and diagnostic or attribution content on separate output channels.
  5. Add automated tests verifying that normal generation commands return only the requested customer-service content.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:5
Finding

Undocumented Persistent Plaintext Logging of User-Supplied Data

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 5-54
Vulnerability Type: Plaintext Sensitive Data Storage
Risk Level: Medium

Complete Code Snippet

bash
DATA_DIR="${CUSTOMER_SERVICE_REPLY_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/customer-service-reply}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"

show_help() {
    cat << EOF
customer-service-reply v$VERSION

Multi-purpose utility tool

Usage: customer-service-reply <command> [args]

Commands:
  run                  Execute main function
  config               Configuration
  status               Show status
  init                 Initialize
  list                 List items
  add                  Add entry
  remove               Remove entry
  search               Search
  export               Export data
  info                 Show info
  help                 Show this help
  version              Show version

Data: \$DATA_DIR
EOF
}

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

cmd_run() {
    echo "  Running: $1"
    _log "run" "${1:-}"
}

cmd_config() {
    echo "  Config: $DATA_DIR/config.json"
    _log "config" "${1:-}"
}

cmd_status() {
    echo "  Status: ready"
    _log "status" "${1:-}"
}

cmd_init() {
    echo "  Initialized in $DATA_DIR"
    _log "init" "${1:-}"
}

cmd_list() {
    [ -f "$DB" ] && cat "$DB" || echo "  (empty)"
    _log "list" "${1:-}"
}

cmd_add() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo "  Added: $*"
    _log "add" "${1:-}"
}

Technical Analysis

The script creates a persistent data directory under the current user's home directory immediately upon execution. The _log function writes command names and supplied arguments to history.log, while cmd_add writes all supplied arguments to data.log.

Customer-service data may contain names, order ide ...[truncated 2012 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove scripts/script.sh if it is unrelated to the documented skill functionality.
  2. If the utility is intentional, document its storage behavior, purpose, retention policy, and deletion procedure in SKILL.md.
  3. Do not log raw command arguments. Record only non-sensitive event metadata or apply strict field-level redaction.
  4. Require explicit user consent before persisting customer-service content.
  5. Set restrictive permissions before creating files:
    bash
    umask 077
mkdir -p -- "$DATA_DIR"
chmod 700 -- "$DATA_DIR"
  6. Create log files with permissions limited to the owner and verify existing files before use.
  7. Add configurable retention limits, secure deletion controls, and a command that removes all stored data.
  8. Validate the configured data directory and prevent unsafe locations, symbolic-link redirection, or unintended shared directories.
  9. Add tests confirming that sensitive command arguments are never written to persistent storage.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger text uses broad natural-language activation cues such as customer service reply capabilities and responding to customer inquiries, which can cause the skill to activate in many ordinary conversations without clear scope boundaries. Overbroad triggering can lead to unintended invocation, context leakage into the skill, or the model generating templated business responses when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code presents the skill name and all generated customer-service scripts entirely in Chinese, indicating the skill is effectively restricted to a single language. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The name/comment at L002 says "customer-service-reply," which implies a tool for producing customer-service responses. However, the help text and command set at L013-L027 describe a generic "Multi-purpose utility tool," and the implemented functions mainly log actions and manage local entries rather than create or send replies. This is an intent-level contradiction in the file's own documentation and behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill metadata and body present output guidance in both Chinese and English, but do not state whether the user can choose the response language. This may implicitly bias usage toward a fixed locale/language experience without explicit opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This shell script writes to history.log on every command via the _log helper, creating persistent local records of user arguments. While the behavior is visible in code, there is no user-facing warning, prompt, or explanatory comment near the logging to disclose that command inputs are stored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The add command appends arbitrary user input to $DB, which is a file write affecting user data storage. Although 'Added' is printed after the write, there is no prior warning in help text or comments that entries are being permanently stored under the data directory.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This file is otherwise a prose guide about e-commerce customer service practices, but the final line instructs the user to run cs.sh help, implying the existence of a command-line skill interface. With no manifest available and no code present to justify that operational capability, the command reference appears contextually unrelated to the document's instructional content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.