ClawHub
Back to skill

Security audit

timeback-machine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local in-memory rollback helper with no evidence of hidden data access, persistence, exfiltration, or destructive behavior.

Before installing, verify the clawhub installer source/version and treat the default rollback as suitable only for JSON-serializable state unless you provide explicit onSaveState and onRestoreState handlers. Expect Chinese prompt text in the current version.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub install @Cortez_1/time-machine

Technical Analysis

The documented installation command invokes clawhub through npx without specifying an audited version or package integrity value. If the package is not already available locally, npx can retrieve and execute the version currently resolved by the configured package registry.

This means the code executed during installation is not fully constrained to the project content covered by this audit. A compromised upstream release, registry account, dependency chain, or unexpected future version could alter installation behavior after the skill has been reviewed.

Attack Path

  1. An attacker compromises the upstream clawhub package, its publisher account, or a dependency used by the resolved release.
  2. The attacker publishes a malicious version that is selected by the unpinned command.
  3. A user follows the installation command from SKILL.md.
  4. npx retrieves and runs the unaudited package version.
  5. Malicious installation code executes with the operating-system privileges of the user running the command.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the installing user's privileges. Depending on that user's permissions and environment, the malicious package could access user-readable files, credentials, project data, environment variables, or modify files and local configuration. The affected scope is the system or execution environment in which the installation command is run; this project itself does not contain the hypothetical upstream payload.

Remediation
View remediation

Remediation Suggestions

  • Pin the installer to a specifically reviewed version, for example by invoking clawhub with an explicit version.
  • Use a lockfile and package-manager integrity metadata where the installation workflow supports them.
  • Document the expected official registry and package publisher so users can verify the source.
  • Prefer a locally installed, locked development dependency over automatically downloading the latest CLI at execution time.
  • Verify package signatures, checksums, or provenance attestations before executing downloaded installation tooling.
  • Establish a release process that re-audits the installer and its dependency tree before updating the documented version.

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:108
Finding

Failed Snapshot Cloning Silently Retains Mutable Original State

Content
View full analysis

Vulnerability Details

File Location: index.js:108-114
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

js
_deepClone(obj) {
    try {
        return JSON.parse(JSON.stringify(obj));
    } catch(e) {
        console.warn("TimeMachine: 对象包含无法序列化的属性，可能无法完全备份。", e);
        return obj;
    }
}

Technical Analysis

The default snapshot mechanism serializes state with JSON.stringify and parses the result. Objects containing circular references or values that trigger serialization errors cause this operation to fail. The exception handler then returns the original object rather than rejecting snapshot creation.

As a result, savedState can refer to the same mutable object used by the active task. Any subsequent in-place mutation also changes the supposed snapshot. A later rollback passes this already-modified object to onRestoreState, while rollback() can still report success if that callback does not throw.

JSON serialization also has lossy behavior for several JavaScript value types. Although not every such case throws, values such as functions, symbols, undefined, and certain object types may be omitted or transformed, further weakening snapshot fidelity.

Attack Path

  1. A caller starts a task with state that cannot be serialized, such as an object containing a circular reference.
  2. JSON.stringify throws while _deepClone attempts to create the snapshot.
  3. The catch block returns the original object reference.
  4. startTask stores that reference as savedState and reports that the task started successfully.
  5. The active task mutates the original object in place.
  6. The user triggers rollback manually or through the timeout prompt.
  7. onRestoreState receives the mutated object instead of an independent pre-task snapshot.
  8. If the callback does not throw, the skill reports a successful rollback even though the ...[truncated 532 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not fall back to the original object when snapshot creation fails.
  • Make _deepClone propagate the error, and make startTask fail before setting isTaskActive or starting the timer.
  • Use structuredClone where supported to preserve a broader set of JavaScript types and correctly reject unsupported values.
  • Require callers with specialized state to provide an explicit onSaveState serializer and matching onRestoreState implementation.
  • Validate that the produced snapshot is independent of the source object before accepting it.
  • Return a clear failure result or throw a documented exception if a trustworthy snapshot cannot be created.
  • Add tests covering circular objects, nested mutable objects, dates, maps, sets, typed arrays, functions, symbols, undefined, and custom serialization failures.
  • Consider changing rollback() to return or apply the restored value explicitly and verify restoration before logging success.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation command uses npx clawhub without pinning a specific version, which allows whatever package version is current at execution time to be fetched and run. This creates a supply-chain risk: a malicious or compromised upstream release could execute arbitrary code during install or setup, and the skill context does not reduce that risk because users are explicitly instructed to run the command locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file contains multiple hard-coded Chinese user-facing strings, including modal button labels and later prompt/log messages, with no indication that the skill is intended only for Chinese-speaking users or that localization is optional. This can violate language/locale policy when users are not given a language choice or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.