ClawHub
Back to skill

Security audit

Bim Cost Estimation Cwicr

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed BIM cost-estimation workflow that uses local model files, OpenAI, Qdrant, a CAD converter, and Excel output in ways that fit its stated purpose.

Install only if you are comfortable sending BIM/QTO-derived project details to your configured OpenAI and Qdrant services. Before running the example workflow, confirm the local RvtExporter executable path is the trusted DDC converter and choose an output directory appropriate for potentially sensitive estimate files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill sends BIM/QTO-derived content to external services (OpenAI embeddings/chat and Qdrant) without any visible warning about data sharing, retention, or confidentiality risks. BIM models and quantity takeoff data can reveal sensitive building layouts, asset details, costs, and project metadata, so silent transmission to third parties can violate user expectations, policy, or contractual obligations.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill launches a hard-coded local executable via subprocess on a user-supplied BIM model path, creating an execution boundary outside the documented AI/vector-search behavior. Even without shell injection, invoking external binaries can expose users to unintended code execution, unsafe file handling, or abuse of a trusted local tool if the binary is replaced, trojanized, or behaves unexpectedly on crafted input files.

Description-Behavior Mismatch

Low
Confidence
79% confidence
Finding
The description emphasizes generating estimates from BIM data via AI classification and vector search for pricing, but the code additionally persists report files locally. While reporting may be related to estimation, disk output is still a materially broader behavior than the manifest description states.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The workflow omits clear user-facing notice that it invokes an external executable and writes Excel output files to disk. These side effects matter because they can execute local code paths, consume trusted tooling, and create potentially sensitive estimate artifacts on the filesystem without explicit acknowledgement or path review.