ClawHub
Back to skill

Security audit

NeuralDebug

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for debugging, but it asks users to install mutable external code and exposes powerful debugger and model-execution features without enough scoping or safety controls.

Install only in an isolated environment and treat the cloned repository as unaudited live code. Do not expose the TCP ports to untrusted networks, do not run debugger or exec_analysis commands on untrusted inputs, and get explicit approval before attaching to processes, writing memory, or fine-tuning models that persist across restarts.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:36
Finding

Mutable Remote Repository and Unpinned Dependencies Enable Supply-Chain Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–44
Vulnerability Type: Mutable remote payload retrieval and insecure dependency installation
Risk Level: High

Vulnerable Code

bash
# Clone the repo
git clone https://github.com/DennySun2020/DeepRhapsody.git
cd DeepRhapsody

# Install Python dependencies
pip install torch transformers

# For fine-tuning (optional)
pip install peft==0.7.1

Technical Analysis

The installation procedure clones and subsequently executes code from an external Git repository without pinning it to a reviewed commit hash, immutable tag, or cryptographically verified release artifact. The effective implementation can therefore change after the Skill package has been reviewed.

The procedure also installs torch and transformers without exact version or integrity constraints. Although peft has an exact version, no package hashes or trusted artifact verification are specified. Package installation may execute package build or installation logic, while later documented commands execute Python modules obtained from the mutable repository.

Because the supplied project contains documentation rather than the referenced implementation, the behavior of the remotely retrieved scripts cannot be validated as part of this audit.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, the selected default branch, or a dependency release channel.
  2. The attacker adds malicious code to the repository scripts or to an unconstrained dependency version.
  3. A user follows the documented installation procedure, retrieving the current repository state and dependency versions.
  4. Dependency installation executes malicious installation logic, or the user runs one of the documented python src/NeuralDebug/... commands.
  5. The malicious payload executes with the privileges of the user running the installation or debugging server.
  6. Th ...[truncated 813 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the external repository to a fully qualified, reviewed commit hash and explicitly check out that commit after cloning.
  2. Prefer a signed release artifact and verify its cryptographic signature or published checksum before execution.
  3. Include the implementation in the audited Skill package where feasible so that executable behavior is reviewed together with its documentation.
  4. Pin all Python dependencies, including transitive dependencies, through a lockfile generated from reviewed versions.
  5. Require package hashes, such as with pip install --require-hashes -r requirements.txt, and obtain packages only from an explicitly configured trusted index.
  6. Install dependencies in an isolated virtual environment or container under a non-privileged account.
  7. Disable unnecessary network access and restrict filesystem mounts while running the debugging server.
  8. Document the exact reviewed repository revision, dependency lockfile digest, and verification procedure in SKILL.md.
  9. Re-audit and test the referenced executable implementation whenever the pinned revision or dependency lockfile changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The custom analysis feature explicitly allows inline code and loading code from a file, yet the documentation does not adequately warn that this runs user-supplied code inside the debugging environment. Because this skill is built around a client-server architecture and live model introspection, the feature is more dangerous than generic plugin execution: it may expose model weights, prompts, activations, environment secrets, or the host itself if protections fail or are bypassed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation describes an exec_analysis command that accepts arbitrary code over a command channel while assuring users it is 'sandboxed' with no filesystem or network access. In a debugging skill that introspects live model objects and tensors, an inaccurate or unverifiable sandbox claim is dangerous because it can lead operators to execute untrusted analysis code against a long-lived server process, potentially resulting in code execution, model/data exfiltration, or sandbox escape if the implementation is weaker than implied.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells agents to use NeuralDebug for very broad requests such as 'debug a program,' 'diagnose a crash,' or 'analyze a core dump,' without narrowing scope or requiring confirmation before launching debugger workflows. Because this skill can start servers, attach debuggers, inspect memory, and alter execution state, ambiguous triggering could cause an agent to invoke invasive tooling for ordinary troubleshooting requests that only needed static analysis or explanation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The quick-start instructions expose TCP debug servers and provide state-changing fine-tuning commands, but the skill does not warn that these actions can open network listeners, inspect sensitive process/model memory, or permanently modify model behavior. In an agent setting, omission of these warnings increases the chance of unsafe autonomous execution on real systems, including exposing debug services or altering artifacts without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file instructs users to start a TCP server for model debugging without warning that prompts, hidden states, logits, and other internal data may be exposed over the network. In this skill's context, the server is specifically designed to inspect live model internals, so lack of guidance on binding scope, authentication, transport security, and trusted-network use materially increases the chance of inadvertent data exposure or unauthorized remote access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The evaluate <expr> command is documented as evaluating a PyTorch expression on live tensors, which implies dynamic execution against a privileged runtime. Without a clear warning or strict constraints, users may treat this as a harmless inspection feature, but in practice expression evaluation commonly enables arbitrary code execution paths, state manipulation, denial of service, or data extraction from the debugging session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation states that fine-tuned models are auto-saved to a user cache path and persist across restarts, but it does not clearly warn that using the feature modifies local disk state and may consume substantial storage. In an agent-operated context, this can lead to unexpected persistent changes, disk exhaustion, or later reuse of altered models without the operator realizing the model state has changed.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/llm-finetuning.md (reported line 144)May include surrounding context.

Reset to Base Model

Delete the fine-tuned directory:

bash
rm -rf ~/.cache/huggingface/hub/NeuralDebug-finetuned/gpt2-medium

Response Format

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/llm-finetuning.md (reported line 144)May include surrounding context.

Reset to Base Model

Delete the fine-tuned directory:

bash
rm -rf ~/.cache/huggingface/hub/NeuralDebug-finetuned/gpt2-medium

Response Format

Static analysis

No suspicious patterns detected.