ClawHub
Back to skill

Security audit

Skill 1

Security checks for vulnerabilities and agentic risk

Overview

This QR-code skill does what it claims, but it automatically installs an unpinned Python package at runtime and gives unsafe guidance for WiFi passwords.

Review before installing. Use only in an isolated or disposable environment unless the dependency is preinstalled or the auto-install behavior is removed and pinned. Avoid putting real WiFi passwords on the command line, and treat generated WiFi QR files as secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
scripts/generate_qr.py:9
Finding

Automatic Installation of an Unpinned Python Dependency

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_qr.py, lines 9-17
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: High

Vulnerable Code

python
def ensure_qrcode():
    try:
        import qrcode
        return qrcode
    except ImportError:
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "qrcode[pil]", "-q"])
        import qrcode
        return qrcode

The automatic installation behavior is also explicitly documented in SKILL.md, lines 56-59:

markdown
## Dependencies

The script auto-installs `qrcode[pil]` via pip if missing. No manual setup needed.

Technical Analysis

When the qrcode module is unavailable, the script invokes pip at runtime to install qrcode[pil]. The dependency has no pinned version, package hash, lockfile, or verified source repository. Pip therefore resolves a mutable package version using the environment's configured package indexes.

This creates a supply-chain trust boundary during ordinary skill execution. If the package release, configured package index, DNS/network path, or local pip configuration is compromised, an attacker-controlled distribution could be installed. Python packages can execute code during installation or when imported immediately afterward.

The subprocess call does not use a shell, so the package string itself does not create shell-command injection. The vulnerability is the uncontrolled acquisition and execution of mutable third-party code.

Attack Path

  1. An attacker compromises the relevant package distribution channel, a configured private package index, or the victim's pip configuration.
  2. The skill runs in an environment where qrcode is not already installed.
  3. import qrcode raises ImportError.
  4. The exception handler invokes pip and resolves qrcode[pil] without a version or hash constraint.
  5. The malicious o ...[truncated 710 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove automatic package installation from application runtime. If qrcode is unavailable, exit with a clear dependency error.
  2. Declare the dependency in controlled project metadata such as requirements.txt or pyproject.toml.
  3. Pin the package to a reviewed version and lock all transitive dependencies.
  4. Use hash verification, such as pip's --require-hashes, for reproducible installations.
  5. Install dependencies during a dedicated build or deployment phase rather than while processing user requests.
  6. Restrict package indexes to explicitly trusted HTTPS repositories and disable unexpected fallback indexes.
  7. Run the skill in a least-privileged, isolated environment without unnecessary credentials or filesystem access.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_qr.py:45
Finding

WiFi Password Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_qr.py, line 45
Vulnerability Type: Sensitive information exposed through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--wifi-pass", help="Generate WiFi QR: password")

The documented usage in SKILL.md, lines 22-26, encourages supplying the password directly on the command line:

markdown
### WiFi network (scannable by phones)
```bash
python3 scripts/generate_qr.py "wifi" --wifi-ssid "MyNetwork" --wifi-pass "secret123" -o wifi.png
text

### Technical Analysis

The script accepts WiFi credentials through the `--wifi-pass` command-line option. Command-line arguments are not an appropriate secret-input mechanism because they can be recorded in interactive shell history, terminal logs, process-monitoring systems, audit logs, debugging output, and automation logs.

On operating systems where process arguments are visible to other local users or monitoring tools, the password may also be observable while the QR generation process is running. The example in the skill documentation normalizes this unsafe invocation pattern.

This issue does not transmit the credential to a remote service. Exposure occurs through local operating-system and shell facilities and through any generated QR image that intentionally contains the credential.

### Attack Path

1. A user follows the documented example and supplies a real WiFi password through `--wifi-pass`.
2. The shell records the complete command in its history, or a local monitoring facility captures the process arguments.
3. A local user, administrator, support tool, backup process, or log reader obtains access to that history or telemetry.
4. The observer extracts the plaintext WiFi password from the recorded command.
5. If the network is reachable and no additional access control is required, the exposed credential can be used to authe
...[truncated 587 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add an interactive password-input mode using Python's getpass.getpass() so the secret is not echoed or included in process arguments.
  2. Support reading the password from standard input or a dedicated file descriptor for non-interactive automation.
  3. Avoid environment variables as the primary replacement because they can also leak through process inspection, diagnostics, and logs.
  4. Retain --wifi-pass only if backward compatibility is necessary, mark it as insecure and deprecated, and emit a clear warning when used.
  5. Replace the documentation example with a secure interactive or standard-input workflow.
  6. Document that the generated QR image contains the WiFi credential and should be stored with access controls appropriate for a password.
  7. Ensure error messages and diagnostic logging never print the constructed WiFi payload.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented behavior does not fully match the operational behavior: auto-installing qrcode[pil] via pip introduces undeclared network/package-execution side effects beyond simple QR generation. Behavior mismatches are dangerous because they undermine user trust and policy enforcement, and runtime pip installation can pull code from external sources at execution time.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documentation indicates it invokes a Python script, writes output files, and may execute shell-level package installation, but it declares no tool scope or permissions. This creates a capability-transparency problem: users or orchestrators cannot accurately constrain or review what the skill is allowed to do, increasing the chance of unexpected file writes or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use the skill when the user wants to create a QR code from 'any data' or 'produce any scannable barcode image,' which is very broad and lacks clear trigger boundaries. There are no exclusion conditions or negative examples to distinguish intended QR-generation requests from more general image, barcode, or data-handling tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation encourages passing WiFi passwords directly on the command line without warning that secrets may be exposed in shell history, process listings, logs, or saved output artifacts. Because the skill is specifically designed to encode sensitive credentials into scannable files, the lack of handling guidance materially increases the risk of credential disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Auto-installing Python packages is not necessary for the stated QR-generation purpose and introduces a supply-chain risk: a simple content-generation tool should not modify the environment or fetch executable code at runtime. In an agent/skill context, this is more dangerous because execution may happen in unattended environments where users do not expect package installation side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The package installation happens without prior warning or consent, so running the script for a benign task can unexpectedly alter the system and trigger network activity. This violates least surprise and can be abused in restricted or production environments where dependency changes are controlled, audited, or prohibited.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

The script invokes pip at runtime to install a dependency automatically, which causes network access and code installation/execution outside the user's explicit request to generate a QR code. Even though the package name is hardcoded and shell injection is not present, automatic dependency installation expands the trust boundary and can execute unreviewed code from package indexes or altered environments.

Content

Scanner excerpt · scripts/generate_qr.py (reported line 14)May include surrounding context.

python
return qrcode
    except ImportError:
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "qrcode[pil]", "-q"])
        import qrcode
        return qrcode

Static analysis

No suspicious patterns detected.