ClawHub
Back to skill

Security audit

packet-audit

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent offline document-packet checker, with sensitive local file reads and report writes disclosed and aligned with its purpose.

Install only if you are comfortable letting it recursively read the packet folder you choose and write local reports containing extracted document details. Keep report output in a private location, and use a pinned runtime if PDF reproducibility matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about an end-user document-folder auditing tool for submitted applications. The supplied code does not inspect user documents at all. Its sole purpose is internal repository/release validation for a software package: checking versions, validating bundled profiles, scanning for network imports and absolute paths, ensuring pinned install instructions, compiling Python files, invoking the CLI, checking markdown comments, counting tests, and verifying SKILL.md scope text. While the script is offline and deterministic, that is only an incidental overlap, not the primary purpose. This is therefore a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is for a document-submission auditing tool used on user-provided document packets. The supplied code chunk does not implement that functionality. Instead, it contains unit tests for a maintenance/self-check script governing repository/package release hygiene: version extraction from frontmatter, detection of stale or floating package pins, and consistency across manifest, engine, and changelog files. While the code is offline and deterministic, its primary purpose is materially different from the declared skill behavior, and it lacks the core claimed capabilities such as checking folders of authority-submission documents, detecting missing/expired/mutually inconsistent documents, or producing page-level citations.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/packet_audit.py (reported line 255)May include surrounding context.

python
def classify(rel: str, ext: str, text: str | None, profile: dict) -> str:
    for rule in profile["classify"]:
        if rule_matches(rule, rel, ext, text):
            return rule["type"]
    return "unknown"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The tool promises deterministic, offline behavior, but PDF extraction changes depending on whether the optional pypdf package is installed. That means the same packet can produce different classifications, extracted fields, and findings across machines, which is a real integrity and reproducibility problem for a compliance/audit workflow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The docstring explicitly states that differing behavior based on installed packages is undesirable, yet the implementation imports and uses pypdf when present. This mismatch creates a trust boundary issue: operators may rely on documented deterministic behavior while the actual audit result varies by environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script writes Markdown and JSON reports containing extracted field values, document paths, hashes, and packet findings to disk by default without explicit consent or protective controls. Because this tool processes highly sensitive personal documents, those outputs can become a secondary data-exposure point through shared directories, backups, local compromise, or accidental disclosure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self_check.py (reported line 161)May include surrounding context.

python
def rule_cli() -> None:
    result = subprocess.run([sys.executable, str(ENGINE), "--list-profiles"],
                            capture_output=True, text=True, timeout=60, cwd=str(ROOT))
    ok = result.returncode == 0 and "rental-us" in result.stdout
    record("RC7 the CLI answers --list-profiles", ok,

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text
Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

No suspicious patterns detected.