ClawHub
Back to skill

Security audit

exec-guard

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its HTTP mode exposes powerful command execution and shared process control without clear authentication, ownership, or sandbox boundaries.

Install only if you intend to run a host command-execution service. Keep HTTP mode bound to a trusted local interface or behind strong authentication, run it in a sandbox or dedicated low-privilege account, avoid inheriting sensitive environment variables, and do not let untrusted agents or users access process logs or termination endpoints.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:15
Finding

Documented HTTP API Exposes Arbitrary System Command Execution Without Access Controls

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/package-lock.json:20
Finding

Dependency Lockfile Uses a Third-Party npm Registry Mirror

Content
View full analysis
= 0.6" } } ``` Other direct dependencies are also downloaded from the mirror: ```json "node_modules/express": { "version": "4.22.1", "resolved": "https://registry.npmmirror.com/express/-/express-4.22.1.tgz", "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==", "license": "MIT", ``` ```json "node_modules/tree-kill": { "version": "1.2.2", "resolved": "https://registry.npmmirror.com/tree-kill/-/tree-kill-1.2.2.tgz", "integrity": "sha512-L0Orpi8qGpPQ4/DPAlKoNU0fOcfq8EVTu2VMG7V6O2nC53hfG50sI4xd/4YqRfbZkdcBRLiMMV2B9Qbe0j1A==", "license": "MIT", "bin": { ``` ### Technical Analysis The installation instructions prescribe `npm install`, while every locked package artifact is resolved through a third-party npm mirror. This adds another supply-chain intermediary whose availability, artifact synchronization, account security, and operational controls must be trusted. The lockfile contains SHA-512 integrity values, which materially reduce the risk of a mirror silently replacing an artifact after the lockfil ...[truncated 2128 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (43)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description describes a substantial command-execution and process-management capability set, but the provided code chunk is only an empty compiled types file with no operational logic. This is a material mismatch between the claimed purpose and the actual behavior visible in the supplied code.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Providing a process-termination endpoint identified only by PID creates a high-risk control surface that can be abused to kill legitimate workloads, disrupt services, or interfere with other agents sharing the same host or service state. In a multi-agent HTTP mode, this is especially dangerous if ownership, authentication, or PID scoping are not enforced.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
Get process output logs.

### DELETE /process/:pid

Terminate a process.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

The guide presents process termination by PID as a routine follow-up action without any mention of ownership, authorization, or confirmation requirements. In a shared multi-agent service, allowing arbitrary PID-based termination can let one agent kill another agent's jobs or disrupt critical services if the backend does not enforce access controls.

Content

Scanner excerpt · references/AGENT_GUIDE.md (reported line 83)May include surrounding context.

md
**后续操作**：
- 查询状态：`GET /process/12345`
- 获取日志：`GET /process/12345/logs`
- 终止进程：`DELETE /process/12345`

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

This example explicitly normalizes one agent terminating another agent's task in the multi-agent sharing model. That materially increases the risk of unauthorized cross-agent interference, denial of service, and accidental termination of important workloads.

Content

Scanner excerpt · references/AGENT_GUIDE.md (reported line 138)May include surrounding context.

获取训练进度

Agent B 终止训练任务

DELETE /process/12345

text

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Publishing a generic DELETE /process/:pid endpoint in an agent guide without describing access-control requirements encourages unsafe assumptions that any visible process can be terminated. In the context of an execution service, destructive PID-parameterized endpoints are highly sensitive because misuse can interrupt workloads or target arbitrary processes tracked by the service.

Content

Scanner excerpt · references/AGENT_GUIDE.md (reported line 199)May include surrounding context.

终止进程

text
DELETE /process/:pid

列出所有进程

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

Presenting DELETE /process/:pid as routine cleanup encourages agents to kill processes based on convenience rather than verified ownership or process identity. In a shared environment this can lead to accidental or unauthorized destruction of other agents' running tasks.

Content

Scanner excerpt · references/AGENT_GUIDE.md (reported line 276)May include surrounding context.

5. 任务完成后清理进程

text
DELETE /process/:pid

原因：释放资源，保持系统整洁。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The training example again frames process termination as a normal step without any safety boundary, reinforcing a dangerous pattern for autonomous agents. Repetition across examples increases the likelihood that downstream agents treat arbitrary process deletion as acceptable default behavior.

Content

Scanner excerpt · references/AGENT_GUIDE.md (reported line 349)May include surrounding context.

GET /process/12345/logs

// 训练完成后终止 DELETE /process/12345

text

### 场景 4：多 Agent 协作

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/dist/cli.js (reported line 101)May include surrounding context.

js
POST   /exec              Execute command
  GET    /process/:pid      Get process status
  GET    /process/:pid/logs Get process logs
  DELETE /process/:pid      Terminate process
  GET    /processes         List all processes
  GET    /health            Health check

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/dist/server.js (reported line 167)May include surrounding context.

js
POST   /exec              Execute command
  GET    /process/:pid      Get process status
  GET    /process/:pid/logs Get process logs
  DELETE /process/:pid      Terminate process
  GET    /processes         List all processes
  GET    /health            Health check

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/dist/platform.js (reported line 71)May include surrounding context.

js
shellArgs = ['-c', command];
    }
    // 合并环境变量（继承宿主机 + 自定义覆盖）
    const mergedEnv = { ...process.env, ...env };
    // 确定工作目录
    const cwd = workingDir || process.cwd();
    // 创建子进程

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises command execution with custom environment variables and process management, but the manifest provides no explicit tool scope or permissions boundaries. In an agent ecosystem, missing scope declarations can cause overly broad or implicit authorization, making it easier for downstream users or orchestrators to invoke sensitive execution behavior without clear policy review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation text is broad enough that an agent may select this skill for many ordinary command-related tasks, including cases where direct system execution is unnecessary or unsafe. Over-broad routing increases the chance of accidental execution of destructive commands, especially in autonomous or weakly supervised agent environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

bash
node scripts/dist/index.js --server --port 8080
curl -X POST http://localhost:8080/exec -H "Content-Type: application/json" -d '{"command": "ls -la"}'

Core Capabilities

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill exposes system-impacting abilities including arbitrary command execution, background process control, log retrieval, and process termination, yet the documentation lacks an explicit warning about host-side effects and trust boundaries. In practice, this can lead users or agents to treat the interface as routine utility rather than a dangerous execution surface, increasing misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide explicitly encourages command execution, background process control, and cross-agent visibility of processes, but does not warn that these actions can affect other users, expose process output, or terminate unrelated work. In an agent-facing skill, omission of user-impact and authorization boundaries increases the chance that an LLM agent will invoke powerful operations without confirming ownership or consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/AGENT_GUIDE.md (reported line 162)May include surrounding context.

md
|------|----------|
| 简单的文件读写 | 直接使用文件系统 API |
| 需要实时交互的命令 | 使用 PTY 终端模拟 |
| 需要 sudo 权限的命令 | 配置 sudoers 或使用其他方案 |

---

Session Persistence

Medium
Category
Rogue Agent
Confidence
70% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/README.md (reported line 25)May include surrounding context.

md
| Feature | Description |
|---------|-------------|
| Synchronous Execution | Execute commands and wait for results with timeout control |
| Background Execution | Start background processes with status query and log retrieval |
| Watch Window | Observe for N seconds after background startup to determine success |
| Dual-End Buffer | Head-Tail ring buffer, max 8KB, prevents OOM |
| Environment Variables | Inherits host environment variables with custom overrides |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README documents an unauthenticated HTTP interface that can execute arbitrary system commands and terminate processes, but it does not prominently warn that exposing this service beyond a trusted local boundary would grant remote code execution and process-control capability. In the context of an AI-agent skill specifically designed to run host commands, this omission is dangerous because adopters may deploy the server mode for multi-agent sharing without adding authentication, network restrictions, or sandboxing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/README.md (reported line 140)May include surrounding context.

Synchronous Execution

bash
curl -X POST http://localhost:8080/exec \
  -H "Content-Type: application/json" \
  -d '{"command": "ls -la", "timeoutSeconds": 10}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation states that child processes inherit the full host environment and may override variables, but it does not warn that this can leak secrets such as API keys, cloud credentials, tokens, and proxy settings into executed commands or their logs. For an agent-facing command execution module, inherited environment data materially increases the blast radius because arbitrary commands can exfiltrate or misuse sensitive credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill builds and executes an arbitrary command from req.command, which is a safety-relevant subprocess operation. While there are internal comments and status messages, there is no confirmation prompt or explicit user-facing warning in this file that commands will be executed on the host system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code launches a background process via buildCommand(...) and returns a running status, but this file does not provide a clear warning or confirmation that a command may persist after the initial request completes. Asynchronous host command execution is safety-relevant and should be disclosed to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function builds and launches shell commands via cmd.exe /c or bash -c, which is a safety-relevant operation because it executes arbitrary commands in a child process. While the code has internal comments describing platform behavior, it provides no confirmation prompt, user-facing log, or disclosure to the user about command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The killProcess function terminates a process tree using SIGKILL, which is destructive and irreversible for the running subprocesses. The code contains implementation comments but no visible warning, confirmation, or user-facing notice that processes may be forcibly killed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This declaration file contains natural-language comments exclusively in Chinese, including the top-level description and method documentation. That can violate a language/locale policy when the skill does not offer user opt-in or document that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.