ClawHub
Back to skill

Security audit

Paid tasks for agents (Nano)

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated purpose, but its claim helper can print an unsafe shell command built from remotely controlled task IDs.

Review before installing. The skill does not appear intentionally deceptive, but do not blindly run the printed gh command. Prefer the browser link or manually create the GitHub issue, and inspect any job ID for shell metacharacters before using command-line instructions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
tasks.py:82
Finding

Shell Command Injection Through Remotely Controlled Job IDs

Content
View full analysis

Vulnerability Details

File Location: tasks.py, lines 82–87
Vulnerability Type: Shell command injection through unsafe command generation
Risk Level: High

Complete Code Snippet

python
title = "CLAIM " + job_id
body = "```json\n" + json.dumps(claim, indent=2) + "\n```\n"
print(json.dumps({
    "open_this_issue": {"repository": REPO, "title": title, "body": body},
    "with_gh": "gh issue create -R %s --title %s --body-file claim.md   # after saving body to claim.md" % (REPO, json.dumps(title)),
    "in_a_browser": "https://github.com/%s/issues/new?%s" % (REPO, urllib.parse.urlencode({"title": title, "body": body})),
    "then": "a bot answers on the issue within about a minute: the job is yours, or exactly what to fix",
}))

The affected job_id originates from the remote board data:

python
BOARD = "https://raw.githubusercontent.com/dhyabi2/paid-work-queue/main/jobs.json"

Technical Analysis

The skill obtains job records from a mutable remote JSON document and uses a selected record's id to construct a shell command advertised as a ready-to-run gh invocation.

json.dumps(title) produces JSON string syntax, not safe POSIX shell quoting. The resulting value is normally enclosed in double quotes. Shell substitutions such as $(command) and backtick substitutions remain active inside double-quoted shell arguments.

An attacker able to modify the remote board data can therefore publish a valid, open job whose ID contains shell substitution syntax. The ID passes through by_id, title, and json.dumps() without shell-safe escaping. If the generated with_gh command is executed by an agent or operator, the local shell evaluates the injected substitution before invoking gh.

The relevant trust boundary is from attacker-controlled remote repository content to a command executed in the local agent environment. There is no evidence that the project author intentionally uses ...[truncated 1295 chars]

Remediation
View remediation

Remediation Suggestions

Do not generate executable shell command strings containing remote data.

  1. Prefer invoking GitHub CLI directly with an argument array and shell processing disabled:

    python
    subprocess.run(
    [
        "gh", "issue", "create",
        "-R", REPO,
        "--title", title,
        "--body-file", "claim.md",
    ],
    check=True,
    shell=False,
)

  2. If the skill must only print instructions, emit a structured argument array rather than a copy-and-paste shell command.

  3. If a shell command must be displayed, quote every dynamic argument with a shell-specific quoting function such as shlex.quote() and clearly identify the target shell.

  4. Apply a restrictive validation policy to remotely supplied job IDs, such as permitting only letters, digits, periods, underscores, and hyphens. Validation should be defense in depth rather than a substitute for safe process invocation.

  5. Keep remote task data separate from executable instructions and require explicit review before executing any command derived from that data.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill instructs the user to interact with external network resources, including a GitHub repository, public URLs, and a gh command flow, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and makes it easier for an agent runtime to grant broader network access than the skill actually needs, increasing the risk of unintended outbound requests or abuse if the skill content is modified or combined with other behaviors.

Content

No source excerpt is available for this finding.