ClawHub
Back to skill

Security audit

Head Tool

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple local file preview tool with a resource-use bug, but no evidence of hidden access, persistence, exfiltration, or deceptive behavior.

This appears safe to install for simple local previews, but avoid using it on very large files or unbounded streams until the implementation is fixed to read only the requested number of lines. Also note that some documented options are not actually implemented.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/head.py:14
Finding

Unbounded Memory Consumption When Previewing Input

Content
View full analysis

Vulnerability Details

File Location: scripts/head.py, lines 14–22
Vulnerability Type: Unbounded input buffering leading to denial of service
Risk Level: Medium

Vulnerable Code:

python
if args.file:
    try:
        lines = open(args.file).readlines()
    except FileNotFoundError:
        print(f"Error: File not found: {args.file}", file=sys.stderr)
        sys.exit(1)
else:
    lines = sys.stdin.readlines()

Technical Analysis

Both input paths use readlines() without a size limit. This loads the entire file or standard-input stream into memory before the requested line limit is applied at line 24:

python
for line in lines[:args.lines]:
    print(line.rstrip())

Consequently, the --lines argument limits only the output and does not limit input consumption. A very large file can cause excessive memory allocation, while an unbounded or long-running standard-input stream can delay output indefinitely and continually consume resources. This also contradicts the documented purpose of previewing large files without loading them entirely.

Attack Path

  1. An attacker or untrusted workflow provides a very large file path to the tool, or pipes a large or continuous stream into standard input.
  2. The tool invokes readlines() and attempts to buffer the complete input.
  3. Memory usage grows according to total input size rather than the requested number of lines.
  4. The process may be terminated by the operating system, become unresponsive, or cause resource pressure affecting the hosting agent or adjacent workloads.
  5. The requested prefix is produced only after the entire input reaches end-of-file and has been buffered.

Impact Assessment

Exploitation does not grant additional privileges, arbitrary code execution, or unauthorized data access. Its primary effect is availability loss within the privileges and resource limits of the invoking process. Depending on ...[truncated 166 chars]

Remediation
View remediation

Remediation Suggestions

Process input incrementally and stop reading once the requested number of lines has been obtained. Use a context manager for files and apply the same bounded iteration to standard input. For example:

python
from itertools import islice

if args.lines < 0:
    parser.error("--lines must be non-negative")

if args.file:
    try:
        with open(args.file, encoding="utf-8", errors="replace") as stream:
            for line in islice(stream, args.lines):
                print(line.rstrip("\n"))
    except FileNotFoundError:
        print(f"Error: File not found: {args.file}", file=sys.stderr)
        sys.exit(1)
else:
    for line in islice(sys.stdin, args.lines):
        print(line.rstrip("\n"))

Additional hardening should include validating numeric limits, handling other expected I/O errors cleanly, and implementing the documented byte mode with bounded read(N) operations rather than whole-input buffering. Resource limits may provide defense in depth when processing attacker-controlled inputs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.