ClawHub
Back to skill

Security audit

Md5 Tool

Security checks for vulnerabilities and agentic risk

Overview

This is a small local MD5 checksum helper with no hidden access or persistence, but users should not rely on it for security-sensitive integrity or authenticity checks.

Install only if you specifically need MD5 for legacy checksum compatibility or non-security fingerprinting. Do not use this skill to decide whether software, scripts, packages, or other security-sensitive files are authentic or untampered; prefer SHA-256, HMAC, or signature verification for those workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/md5.py:2
Finding

Collision-Broken MD5 Used for Integrity Validation

Content
View full analysis

Vulnerability Details

File Location: scripts/md5.py, lines 2–4
Vulnerability Type: Use of a weak cryptographic hash for security-sensitive integrity validation
Risk Level: Medium

Technical Analysis

The script calculates an MD5 digest for a file or standard input:

python
import hashlib, sys
data = open(sys.argv[1], 'rb').read() if sys.argv[1:] else sys.stdin.buffer.read()
print(hashlib.md5(data).hexdigest())

MD5 is cryptographically broken with respect to collision resistance. It is practical to construct distinct inputs with the same MD5 digest, including chosen-prefix collisions under relevant attacker-controlled conditions.

This is security-relevant because SKILL.md explicitly presents the tool as suitable for “file integrity verification and checksum validation.” Although MD5 may still detect accidental corruption, it must not be relied upon to establish integrity against a malicious party.

Attack Path

  1. An attacker prepares two different files whose contents produce the same MD5 digest, with one file appearing benign and the other containing attacker-selected malicious content.
  2. The benign file is used to establish or publish an expected MD5 checksum.
  3. The attacker substitutes the colliding malicious file through a compromised or attacker-controlled distribution channel.
  4. A user calculates the substituted file's digest with this tool.
  5. The generated MD5 value matches the expected checksum, so an integrity workflow relying solely on that value may incorrectly accept the malicious file.

Exploitation requires the attacker to control or suitably influence the compared content and the delivery path. This issue does not by itself grant code execution or system privileges.

Impact Assessment

An attacker could bypass MD5-based integrity checks and cause modified content to be accepted as authentic. The resulting impact depends on the type and subsequent use of the ver ...[truncated 395 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace MD5 with SHA-256 or a stronger approved digest for ordinary integrity verification:

    python
    print(hashlib.sha256(data).hexdigest())

  2. Process files and standard input incrementally in fixed-size chunks rather than loading the complete input into memory.

  3. For authenticity against an active attacker, use a keyed MAC such as HMAC-SHA-256 or verify a trusted digital signature. An unkeyed hash alone cannot prove who produced a file.

  4. If MD5 must remain available for compatibility with legacy checksum files, label it explicitly as non-security functionality and require an opt-in option such as --algorithm md5.

  5. Update SKILL.md so it does not recommend MD5 for adversarial integrity or authenticity decisions.

  6. Implement or remove the documented --check option. The current script interprets --check as a file path rather than providing the documented checksum-verification behavior.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep