ClawHub
Back to skill

Security audit

Personal Knowledge Base Lite

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local knowledge-base tool, but it needs review because it can recursively process private documents and uses unsafe shell path templates.

Install only if you are comfortable making the chosen folder searchable by the agent and having document text processed for summaries and answers. Avoid pointing it at broad home, cloud-sync, financial, legal, or credential-heavy folders. Prefer a sandboxed test folder until the author adds path-safe file handling, size limits, explicit privacy prompts, exclusions, and pinned dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:64
Finding

Shell Command Injection Through Interpolated User-Controlled Paths

Content
View full analysis
" > /dev/null 2>&1 && echo "ok" || echo "not_found" ``` ```bash find "" -type f \( -name "*.txt" -o -name "*.md" -o -name "*.docx" -o -name "*.pdf" -o -name "*.xlsx" -o -name "*.csv" \) -not -name ".kb-meta.json" -print ``` ```bash stat -f "%m" "" # macOS stat -c "%Y" "" # Linux ``` ```bash KB_FILE="/" python3 -c " import docx, os doc = docx.Document(os.environ['KB_FILE']) text = '\n'.join(p.text for p in doc.paragraphs if p.text.strip()) limit = int(os.environ.get('KB_MAX_CHARS', '0')) print(text[:limit] if limit else text) " ``` ```bash KB_FILE="/" python3 -c " import pdfplumber, os with pdfplumber.open(os.environ['KB_FILE']) as pdf: text = '\n'.join(p.extract_text() or '' for p in pdf.pages) limit = int(os.environ.get('KB_MAX_CHARS', '0')) print(text[:limit] if limit else text) " ``` ```bash KB_FILE="/" python3 -c " import openpyxl, os wb = openpyxl.load_workbook(os.environ['KB_FILE'], data_only=True) rows = [] for ws in wb.worksheets: for row in ws.iter_rows(values_only=True): line = '\t'.join(str(v) for v in row if v is not None) if line.strip(): rows.append(line) text = '\n'.join(rows) limit = int(os.environ.get('KB_MAX_CHARS', '0')) print(text[:limit] if limit else text) " ``` ### Technical Analysis The Skill directs the Agent to obtain `WATCH_DIR` from user input and then substitute it into Bash command templates. Filenames are likewise obtained by scanning a potentially attacker-controlled directory and are subsequently substituted into commands through the `` or `` placeholders. Placing substituted data ...[truncated 2271 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Document-Parsing Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is explicitly designed to scan and summarize local documents, including potentially sensitive files such as contracts, spreadsheets, and PDFs, and to use the LLM to extract summaries, tags, and table-of-contents data. There is no privacy warning, consent checkpoint, or guidance about what data may be sent to or processed by the model, so users may unknowingly expose confidential local content during indexing and Q&A.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
89% confidence
Finding

The Q&A workflow instructs the agent to read full content from every matched file with no truncation, which can cause excessive memory/token consumption or very large outputs when files are large or numerous. In a document-retrieval skill, semantic matching may over-select files, making denial-of-service, cost spikes, or accidental overexposure of sensitive content more likely.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md
### Step 4: Read Full Content of Relevant Files

For each filename in `MATCHED_FILES`, read the file using the method described in **Appendix: File Reading Methods** below (no truncation, omit `MAX_CHARS`).

If a file fails to read, skip it and continue with the remaining files.

Static analysis

No suspicious patterns detected.