ClawHub
Back to skill

Security audit

color-filer

Security checks across malware telemetry and agentic risk

Overview

This skill is a file organizer with expected local file-changing behavior, but its optional config loading can execute arbitrary Python code without clearly warning users.

Review before installing. Use only the bundled scripts and configs you have inspected, run dry-run first, keep backups enabled, avoid --yes and --no-backup for real runs, and do not use --config with any untrusted or path-like value. The main concern is local Python code execution through config loading, not hidden network or credential behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

exec() call detected

High
Category
Dangerous Code Execution
Content
config_file = os.path.join(os.path.dirname(__file__), f'{args.config}_config.py')
        if os.path.exists(config_file):
            print(f'📋 加载配置: {args.config}_config.py\n')
            exec(open(config_file, encoding='utf-8').read(), globals())
        else:
            print(f'⚠️  配置文件不存在: {config_file}')
            print('⚠️  跳过目录重命名和文件归档步骤\n')
Confidence
99% confidence
Finding
The script reads a Python file selected via the --config argument and executes it with exec(..., globals()), which allows arbitrary code execution in the context of the script. In a workspace-organizing skill, config loading should be declarative; executing code is far more dangerous because a malicious or tampered config can run any filesystem or OS command, especially when the user invokes the tool on valuable directories.

Direct flow: open (file read) → exec (code execution)

High
Category
Data Flow
Content
config_file = os.path.join(os.path.dirname(__file__), f'{args.config}_config.py')
        if os.path.exists(config_file):
            print(f'📋 加载配置: {args.config}_config.py\n')
            exec(open(config_file, encoding='utf-8').read(), globals())
        else:
            print(f'⚠️  配置文件不存在: {config_file}')
            print('⚠️  跳过目录重命名和文件归档步骤\n')
Confidence
99% confidence
Finding
This is the same dangerous sink expressed as a dataflow finding: untrusted file contents flow directly from open() into exec(). That means any attacker who can influence the chosen config file or its contents can achieve arbitrary code execution, which is especially severe in a tool already authorized to rename, move, and back up many files.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Allowing a user-selected config file to contain and execute arbitrary Python exceeds the stated purpose of file coloring and organization and creates a broad code-execution surface. The skill context increases danger because users are likely to trust a utility script and run it locally with access to personal workspaces, enabling theft, destruction, or persistence if the config is malicious.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.