Security audit

Cobra Claw - Strike First. Strike Hard

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a small themed CLI package, but its kata runner can be steered outside the intended kata folder to run other local shell scripts.

Review this before installing if an agent might run commands based on untrusted prompts. The kata command should be restricted to an allowlist of bundled kata names before use; otherwise it can potentially run unintended local shell scripts. I found no evidence of network exfiltration, credential access, persistence, or destructive behavior in the package itself.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: cobraclaw.sh:28
Finding: Path Traversal Permits Execution of Scripts Outside the Kata Directory
Content: View full analysis
Remediation: View remediation
&2 return 1 ;; esac } ``` Additional hardening measures: 1. Reject empty values, absolute paths, directory separators, and traversal components. 2. If dynamic discovery is required, canonicalize both the `katas` directory and candidate target, then verify that the canonical target is a direct child of the canonical directory. 3. Account for symbolic links when performing containment validation; lexical prefix checks alone are insufficient. 4. Run kata scripts with the minimum required operating-system privileges. 5. Add regression tests covering values such as `../`, `../../outside/payload`, absolute paths, embedded slashes, and symlink-based escapes. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description suggests a multi-function skill with CLI lookup capability, practice katas, and shell utilities. The supplied code chunk is only a minimal shell script that echoes two static lines. Its primary behavior is a simple status/banner printout, which does not accurately represent the broader declared functionality. There are no undeclared sensitive capabilities, but there is a material description-to-behavior mismatch because the implemented behavior is far narrower and different from the stated purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a broader dojo-themed skill with CLI lookups, katas, and shell tools. The actual code chunk is a minimal shell script that only echoes a trophies banner and usage for add/show operations. This is a materially different and much narrower purpose than the declared description, and the trophies-related functionality is not represented in the description.
Content: No source excerpt is available for this finding.