Security audit

Clay

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it checks PMU CSV data and writes a disclosed flagged-rows report, with some ordinary file-output safety cautions.

Install only if you want a local PMU CSV checker. Run it on files and output directories you trust, avoid elevated privileges, and treat generated flagged CSV reports as derived from the input data, especially before opening them in spreadsheet software.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pmu_quality_check.py:419
Finding: Spreadsheet Formula Injection in Exported Flagged-Row Reports
Content: View full analysis
pd.DataFrame: """Load CSV and rename columns to standard names.""" df = pd.read_csv(csv_path) ``` ```python # Export flagged rows flagged = build_flagged_df(df, all_results) if output_dir: os.makedirs(output_dir, exist_ok=True) out_path = Path(output_dir) / (Path(csv_path).stem + "_flagged.csv") else: out_path = Path(csv_path).with_name(Path(csv_path).stem + "_flagged.csv") if len(flagged) > 0: flagged.to_csv(out_path, index=False) ``` ### Technical Analysis The application reads attacker-controlled CSV fields and copies their original values into the generated flagged-row report. Before calling `DataFrame.to_csv`, it does not neutralize text beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@`. CSV itself does not execute code, but common spreadsheet applications can interpret such cells as formulas when a user opens the generated report. A malicious input value such as an external-reference or hyperlink formula could initiate network requests, disclose information through formula arguments, or deceive the report reviewer into taking an unsafe action. The exact behavior depends on the spreadsheet software and its security configuration. Only rows carrying at least one quality flag are exported, but an attacker can deliberately trigger a flag by including a missing or out-of-range measurement in the same row. ### Attack Path 1. An attacker supplies a PMU CSV containing a formula-like string in a field preserved by the checker. 2. The attacker ensures that the row is flagged, for example by leaving another field empty or providing an out-of-range frequency. 3. The operator runs `pmu_quality_check.py` against the malicious CSV. 4. `build_flagged_df ...[truncated 793 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pmu_quality_check.py:419
Finding: Predictable Report Path Allows File Overwrite Through Symbolic Links
Content: View full analysis
0: flagged.to_csv(out_path, index=False) print(f" Flagged rows exported to: {out_path}") print(f" Total flagged: {len(flagged)} / {len(df)} rows\n") ``` ### Technical Analysis The output name is deterministically derived from the input filename and is written using `DataFrame.to_csv` without checking whether the destination already exists or is a symbolic link. Existing destination files can therefore be silently truncated. On operating systems that support symbolic links, `to_csv` follows a destination symlink under ordinary file-opening semantics. If an attacker can write to the selected output directory, the attacker can pre-create the predictable `_flagged.csv` path as a symlink to another file. A later run writes through that link with the checker process's permissions. The code also creates a user-selected output directory with `exist_ok=True` but does not verify its ownership, permissions, or whether path components have been replaced with symbolic links. ### Attack Path 1. The checker is run with an input or output directory writable by another local user. 2. The attacker predicts the report name from the input stem, such as `measurements_flagged.csv`. 3. Before the checker writes its report, the attacker creates that path as a symbolic link to a file writable by the checker process. 4. The processed CSV contains at least one flagged row, causing the export branch to execute. 5. `flagged ...[truncated 652 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description includes broad trigger phrases such as 'data quality', 'check', 'audit', 'bad data', and 'security limit', which can cause the skill to activate in contexts that are only loosely related to PMU validation. Unintended invocation can lead to unnecessary file access or execution of local tooling, especially since the skill is allowed to use Bash, Read, Write, and Glob.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill states that it writes a flagged-rows CSV alongside the user's input file, but this side effect is not clearly disclosed in the top-level description or usage guidance. Undisclosed file creation can surprise users, overwrite expectations about working directories, and create privacy or integrity issues if sensitive datasets are stored in shared locations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest frames this skill as running data quality checks and auditing PMU measurements, which implies analysis of input data. The code additionally persists a derived CSV file of flagged rows to disk, introducing a file-writing side effect beyond straightforward validation/reporting.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The usage text and CLI flag advertise HTML report generation, but this script itself does not implement that behavior and only tries to import another module at runtime. That documentation overstates what this file actually does on its own, which can mislead reviewers about the implemented capability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.