ClawHub
Back to skill

Security audit

Zip Tool

Security checks for vulnerabilities and agentic risk

Overview

This ZIP skill is not clearly malicious, but its documentation substantially overstates what the included script does and includes unsafe examples around passwords and overwriting files.

Review this before installing. It appears to be a small local ZIP creation helper rather than the full archive manager it claims to be, and you should avoid using command-line password examples or relying on the documented extract, delete, update, recursion, compression, or JSON features unless the package is corrected.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description presents a broad ZIP management tool with multiple archive operations and advanced options. The supplied code only implements basic archive creation: it opens a ZIP file in write mode and adds the provided files. It does not implement update, list, or extract functionality, nor does it expose compression-level configuration, password protection, or recursive directory handling. There is no evidence of unrelated or harmful undeclared behavior, but the description materially overstates the implemented capabilities, so this is a mismatch.

Self-Modification

High
Category
Rogue Agent
Content
-P, --password PASS  Protect archive with password
  -c, --compress N     Compression level (0-9, default: 6)
  -o, --output DIR     Extract destination directory
  --overwrite          Overwrite existing files when extracting
  --json               Output archive metadata as JSON
```
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents destructive operations such as delete, extract-to-output, update, and overwrite without any warning about data loss or clobbering existing files. In an agent or automation context, users may invoke these flags on important paths and unintentionally delete archive entries or overwrite local files, causing loss of data or corruption of working directories.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill recommends passing archive passwords directly on the command line with -P secret123, which exposes secrets through shell history, process listings, logs, and agent transcripts. This creates a realistic credential leakage path, especially in shared systems, CI environments, or observability pipelines.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest describes a full-featured ZIP management skill, but this script only opens a ZIP in write mode and adds the provided file paths. There is no implementation for updating existing archives, listing contents, extracting archives, compression-level configuration, password protection, or recursive directory handling.

Static analysis

No suspicious patterns detected.