ClawHub
Back to skill

Security audit

diff4

Security checks for vulnerabilities and agentic risk

Overview

The skill is for encrypted sharing, but it can upload diffs or arbitrary files after broad “preview” requests and exposes sensitive passphrase handling risks.

Install only if you intend to send encrypted copies of diffs or files to a diff4 server. Before use, require explicit confirmation for every upload, verify the exact file list or diff scope and server URL, avoid sensitive or regulated content unless policy permits, and do not let the agent print or pass your passphrase in visible command output or shell arguments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

markdown
- `diff4` must be installed and available on PATH. Use `npm i -g @diff4/cli` to install.

Technical Analysis

The documented installation command retrieves the current version of @diff4/cli from the npm registry without pinning an audited version or verifying package integrity. The -g option installs the package globally and may execute npm lifecycle scripts during installation.

Because the CLI implementation is not included in this project, its encryption, file-handling, and network behavior cannot be verified from the audited artifact. The effective code can also change after this Skill has been reviewed if a new package version is published.

This creates a software supply-chain risk. If the npm package, a maintainer account, or a newly published release is compromised, following the documented prerequisite may install and execute attacker-controlled code.

Attack Path

  1. An attacker compromises the package publisher, npm account, package distribution process, or a future package release.
  2. The attacker publishes a malicious version under the existing @diff4/cli package name.
  3. A user or Agent follows the Skill instruction and runs npm i -g @diff4/cli.
  4. npm downloads the latest malicious release because no exact version or integrity value is specified.
  5. Malicious lifecycle scripts may execute during installation, or malicious behavior may execute when the Agent later invokes diff4.
  6. The compromised CLI can access data available to the installing user, including source files passed to it, environment variables, Git content, and network resources.

Impact Assessment

Successful exploitation would execute code with the privileges of the user running npm or the CLI. The potential scope includ ...[truncated 471 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specifically audited version, such as @diff4/cli@x.y.z.
  • Verify the package against an expected integrity hash or trusted signed release.
  • Avoid global installation. Prefer a project-local, lockfile-controlled dependency or a verified standalone binary.
  • Disable npm lifecycle scripts during installation when they are not required.
  • Document the canonical package source, publisher identity, and release-verification process.
  • Review the CLI source and network behavior before instructing an Agent to provide it with sensitive files.
  • Run the CLI in a restricted environment with only the minimum filesystem and network access required.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:42
Finding

Encryption Passphrase Exposed Through Command Output and Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-43, 49-51, and 66-68
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

markdown
### Key management

- `diff4 key-gen [key]` - Generate or set the encryption passphrase
- `diff4 key-get` - Print the current passphrase

## Options

All upload commands (`git-latest`, `git-staged`, `files`) accept:

| Flag | Description |
|------|-------------|
| `-s, --server <url>` | Override the diff4 server URL. Default: `https://diff4.com` (or `DIFF4_SERVER` env var) |
| `-p, --passphrase <key>` | Override the passphrase for this command only. Default: `DIFF4_PASSPHRASE` env var |

## Typical workflow

1. User asks to see a diff or files
2. Verify setup: run `diff4 key-get` (if it fails, run `diff4 key-gen` and tell user to source their rc file)
3. Run the appropriate command (`git-latest`, `git-staged`, or `files <paths>`)
4. Return the URL from the response to the user
5. Remind the user that recipients need the passphrase to decrypt

Technical Analysis

The recommended setup check invokes diff4 key-get, whose documented purpose is to print the current encryption passphrase. Running this command through an Agent or auditable tool interface can place the secret in tool output, conversation transcripts, execution logs, terminal scrollback, or monitoring systems.

The supported --passphrase <key> command-line option introduces another disclosure channel. Command-line arguments may be retained in shell history and can be visible to local process-inspection mechanisms while the command is running. The optional key-gen [key] form can cause similar exposure when a key is supplied directly.

The passphrase protects uploaded diffs and files. Disclosure therefore undermines the confidentiality provided by AES-256-GCM regardless of the strength of the encryption algorithm.

Attac

...[truncated 1247 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace key-get in the setup workflow with a status operation that reports only whether a key is configured.
  • Explicitly prohibit Agents from retrieving, displaying, logging, or returning passphrases.
  • Remove command-line passphrase parameters where possible.
  • Accept passphrases through protected interactive input, a restricted credential store, or an operating-system secret-management facility.
  • Ensure secret input disables terminal echo and is excluded from telemetry, traces, and error messages.
  • Avoid storing passphrases in broadly readable shell configuration files.
  • Use unique passphrases for different sharing contexts and provide a documented rotation and revocation procedure.
  • If a passphrase has appeared in Agent output, logs, shell history, or process telemetry, rotate it and treat all associated upload URLs as potentially compromised.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is described as a secure way to preview diffs and files, but its actual behavior is to transmit code or file contents to a remote server and return a share URL. Even with client-side encryption, this changes the trust boundary, creates exfiltration risk, and can mislead users into authorizing data sharing when they expected local-only preview behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation emphasizes encryption but does not clearly warn users that code and file contents are still being uploaded to a remote server. This can create a false sense of safety, leading users to share sensitive materials without understanding metadata exposure, server trust assumptions, passphrase handling risk, or organizational restrictions on off-device transfer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Broad invocation phrases like ordinary requests to preview or send changes increase the chance the skill is triggered in situations where the user did not intend remote upload. Because this skill can transmit repository diffs or arbitrary files, accidental activation materially raises the risk of exposing sensitive code, secrets, or internal documents.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow says to use the skill when a user wants to see a diff or files, but the implemented steps actually share those contents externally and return a URL. This mismatch can cause unintended disclosure of source code or sensitive files because a normal viewing request is silently converted into an upload action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.