ClawHub
Back to skill

Security audit

recover

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Git cleanup helper, but its command templates handle repository-controlled paths and branch names unsafely enough to require review before use.

Install only if you are comfortable supervising every generated Git command. Before running commands, ensure paths and branch names are treated as literal arguments, validate refs and commit hashes, and be especially cautious in repositories or worktrees you did not create yourself.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:48
Finding

Command Injection Through Unquoted Worktree Paths and Git References

Content
View full analysis
status --short git -C branch --show-current git -C log --oneline -3 git log "$DEFAULT".. --oneline ``` ```markdown - Remove orphaned worktree (CLEAN): `git worktree remove ` - Merge unmerged commits: `git merge --no-ff` - Cherry-pick specific commits: `git cherry-pick ` - Delete merged branches: `git branch -d ` - Delete stale branches (confirmed discard): `git branch -D ` ``` ### Technical Analysis The Skill instructs the Agent to substitute repository-derived worktree paths, branch names, and commit identifiers directly into shell command templates. These dynamic arguments are not quoted, validated, or separated from command options with `--`. Worktree paths can contain whitespace and shell metacharacters. If the Agent performs direct textual substitution and executes the resulting command through a shell, metacharacters in a maliciously crafted path can terminate or modify the intended Git command and introduce an additional command. This makes command execution possible during the inspection phase, despite the Skill's assertion that scanning is read-only. Git references also require defensive validation and argument handling. Crafted names may cause parsing ambiguity or unexpected option interpretation in commands that do not use `--`. The destructive cleanup commands increase the potential consequences by operating on branches and worktrees selected from repository-controlled state. ### Attack Path 1. An attacker prepares or influences a Git repository containing a worktree whose path includes shell-significant characters, or supplies crafted repository reference data. 2. A user invokes `/recover` against that repository. 3. The Skill e ...[truncated 1309 chars]
Remediation
View remediation
^{commit}'` and use the resolved object ID for subsequent operations. 6. Use `--` to terminate option parsing wherever the relevant Git command supports it. 7. Reject values containing control characters and avoid generating executable cleanup commands by concatenating repository-derived text. 8. Keep inspection and cleanup separate. Display validated targets first, obtain explicit approval for each destructive action, and then execute only the previously validated structured arguments. 9. Add hostile-input tests covering paths with spaces, quotes, command substitutions, semicolons, newlines, and option-like prefixes. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep