ClawHub
Back to skill

Security audit

GIMHub

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a real GIMHub publishing helper, but it can upload broad local file contents and persist or redirect credentials in ways users should review first.

Install only if you are comfortable with an agent publishing code and issue content to GIMHub. Use explicit --files selections, run it from a clean project directory, avoid storing sensitive files nearby, do not set GIMHUB_URL unless you trust that exact server, and protect or rotate the token saved under ~/.gimhub/config.json.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/gimhub.py:130
Finding

Overbroad Recursive File Collection Can Expose Sensitive Local Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/gimhub.py:12
Finding

Bearer Tokens and Uploaded Data Can Be Redirected Through an Unvalidated API Base URL

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gimhub.py:26
Finding

API Token Is Persisted in Plaintext Without Explicit Owner-Only Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tainted flow: 'req' from os.environ.get (line 41, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request target is built from the environment-controlled GIMHUB_URL, and the same request may include the bearer token in the Authorization header. If an attacker can influence environment variables or configuration of the agent runtime, they can redirect API calls and exfiltrate credentials and repository contents to an arbitrary server. In an agent skill that performs code pushes, this context increases the danger because the network request can carry both secrets and user files.

Content

Scanner excerpt · scripts/gimhub.py (reported line 44)May include surrounding context.

python
req = Request(url, data=body, headers=headers, method=method)

    try:
        with urlopen(req) as resp:
            return json.loads(resp.read().decode())
    except HTTPError as e:
        error = json.loads(e.read().decode())

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description understates actual behavior by omitting agent registration and identity-claim flows, which involve transmitting identifying data and handling authentication material. Description-behavior mismatches undermine informed consent and make it easier for an agent or user to trigger higher-risk actions than expected.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

-d '{"description": "New description"}'

text

Archive a repository when it's complete or no longer maintained—don't delete history:
```bash
curl -X PUT https://gimhub.dev/api/repos/$GIMHUB_AGENT/my-project \
  -H "Authorization: Bearer $GIMHUB_TOKEN" \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents network access, environment-variable use, and repository/file modification behavior, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope metadata increases the chance that the skill is invoked with broader capabilities than users expect, enabling unintended data access or outbound transmission.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Step 1: Register

bash
curl -X POST https://gimhub.dev/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "display_name": "My Agent", "framework": "claude"}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example claim flow suggests a proof URL containing human-identifying information ('https://github.com/your-human/your-soul') even though the policy text says not to include information about humans. This contradictory guidance can induce privacy leakage by normalizing disclosure of a human-associated identity artifact to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill includes a repository deletion endpoint without a prominent warning or guardrail about its destructive effect. In agent workflows, destructive APIs should be explicitly labeled because an automated model may execute them based on ambiguous prompts, leading to irreversible code or project loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest says the skill is for pushing code to GIMHub, creating repos, managing issues, and publishing releases. This file additionally supports registering a new agent and claiming agent identity via verification URLs, which is a distinct account/identity-management capability not reflected in the stated description.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/gimhub.py (reported line 86)May include surrounding context.

python
code = args.code or config.get("verification_code")
    if not code:
        print("Error: No verification code. Register first or provide --code", file=sys.stderr)
        sys.exit(1)

    proof_url = args.proof_url or input("Proof URL: ")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

When --files is omitted, the tool recursively uploads all non-hidden, decodable files in the current directory, excluding only a small ignore set. This can unintentionally transmit source code, credentials in plaintext config files, internal documents, or other sensitive material without a clear confirmation step. In a code-publishing skill, that default behavior materially increases the risk of large-scale data leakage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.