ClawHub
Back to skill

Security audit

Xargs Tool

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local command runner, but it advertises safety options that the included script does not implement and includes destructive batch-command examples without adequate guardrails.

Review before installing. Use this only if you intentionally want an agent to run local batch commands, and do not rely on the documented dry-run or interactive options unless the implementation is fixed. Treat deletion or file-modifying examples as high risk and require explicit human review before running them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
lines = sys.stdin.read().strip().split('\n')
cmd = sys.argv[1:]
for line in lines:
    subprocess.run([c.replace('{}', line) for c in cmd])
Confidence
98% confidence
Finding
This code executes subprocesses using a command template from argv and untrusted data from stdin, directly substituting each input line into command arguments. Although shell metacharacter injection is reduced by passing a list to subprocess.run, this still enables arbitrary command/argument execution through the skill’s exposed interface and can be abused to run dangerous programs or unsafe flags at scale.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill explicitly describes building and executing shell command lines from stdin, which is a shell-capable behavior with meaningful security implications. If permissions are not declared, downstream systems or users may underestimate the risk and allow unsafe use of arbitrary command execution pipelines.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The quick-start example demonstrates `rm -f` without any warning about irreversible deletion or recommendation to preview targets first. In a skill whose core function mass-applies commands to stdin, this increases the chance of user error turning into large-scale accidental data loss.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This example again promotes a removal workflow without a clear data-loss warning, and because `xargs`-style batching can expand many inputs at once, a mistaken path or broad input source can delete numerous files quickly. The skill context makes this more dangerous than an isolated shell example because it is specifically designed for bulk execution.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill performs command execution without any warning, disclosure, or friction to indicate that arbitrary external programs will be run for each stdin line. In the context of an agent skill, this increases the likelihood of unsafe or surprising execution, especially because the tool is expressly designed to batch and amplify commands.

Static analysis

No suspicious patterns detected.