T08 · Insecure Dependencies
Warning
- Location
scripts/config-helper.py:9- Finding
Runtime Installation of an Unpinned Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
Mediator
Security checks for vulnerabilities and agentic risk
Overview
This skill is aimed at communication mediation, but it handles very sensitive messages with under-scoped defaults, persistent plaintext records, and unsafe runtime dependency installation.
Review carefully before installing. Only use this with accounts and contacts you explicitly configure, avoid cron or heartbeat until you understand what will be scanned, remove the hardcoded Gmail and notification defaults, install dependencies yourself from trusted pinned sources, and treat AI summaries as untrusted aids rather than substitutes for reviewing important original messages.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/summarize.py:62- Finding
Untrusted Message Content Is Submitted to an LLM Without Adequate Prompt-Injection Isolation
- Content
View full analysis
dict: """Call LLM to summarize content.""" prompt = PROMPTS.get(mode, PROMPTS["facts-only"]) full_prompt = f"""{prompt} MESSAGE TO PROCESS: \"\"\" {content} \"\"\" Respond with ONLY valid JSON, no other text.""" # Try using the llm CLI if available try: result = subprocess.run( ["llm", "-m", "gpt-4o-mini", prompt, "--no-stream"], input=content, capture_output=True, text=True, timeout=60 ) ``` `scripts/process-email.py:208-209`: ```python body = full_email.get("body", full_email.get("snippet", "")) summary = summarize_content(contact, body) ``` `scripts/process-imessage.py:181-184`: ```python combined_text = "\n".join(m.get("text", "") for m in new_messages) # Summarize summary = summarize_content(contact, combined_text) ``` ### Technical Analysis Email and iMessage bodies are controlled by message senders. These bodies are passed directly to the LLM as standard input. Although the code constructs a `full_prompt` that labels and delimits the message, that variable is never supplied to the `llm` process. Instead, the base prompt is passed as a command argument and the untrusted message is supplied separately without a demonstrated system/user trust boundary. A malicious sender can place model instructions inside a message, such as directions to ignore the summarization policy, hide deadlines, invent requests, or produce a misleading suggested response. Delimiters alone would not eliminate prompt injection, but the cu ...[truncated 2055 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/config-helper.py:26- Finding
Contact PII Is Persisted and Logged Without Enforced Restrictive Permissions
- Content
View full analysis
> "$LOG_FILE" } ``` `scripts/mediator.sh:109-110`: ```bash log "Added contact: $name (email=$email, phone=$phone, channels=$channels)" echo "Added contact: $name" ``` ### Technical Analysis The Skill stores contact names, email addresses, and phone numbers in a plaintext YAML configuration file. It also duplicates these identifiers in a plaintext log when contacts are added. Neither the Python configuration writer nor the shell logger explicitly sets file permissions. The resulting permissions therefore depend on the user's current umask and any pre-existing file or directory modes. On a system with a permissive umask or improperly shared home-directory permissions, other local users or processes may be able to read the files. The log unnecessarily increases exposure by duplicating complete identifiers in another location. Repeated writes may also retain personal information after a contact is removed from the active configuration. ### Attack Path 1. The Skill runs under a user account with a permissive umask or pre-existing broadly readable `.clawdbot` files. 2. The user adds a mediated contact. 3. The contact's name, email address, and phone number are written to `~/.clawdbot/mediator.yaml`. 4. The same identifying information is appended to ...[truncated 703 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The stated purpose emphasizes neutral mediation, but the documented behavior also includes persistent monitoring, contact management, local logging, and external message processing without fully exposing the underlying implementation. That mismatch can cause users to authorize a seemingly simple summarization skill that actually performs broader surveillance and retention functions on sensitive communications.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes sending message content through an LLM and forwarding summaries to Telegram, Slack, or iMessage, but it does not present a clear privacy warning or consent model for transmitting sensitive interpersonal communications to third parties. Given that messages may include legal, financial, family, or emotionally sensitive content, users may unknowingly expose highly confidential data.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The script executes a shell command to install PyYAML at runtime when the import fails. Even though the command string is not directly user-controlled, invoking pip from a helper script introduces unexpected code execution, network access, and supply-chain risk, which is especially inappropriate for a local configuration utility.
- Content
python import yaml except ImportError: print("Installing PyYAML...") os.system(f"{sys.executable} -m pip install -q pyyaml") import yaml CONFIG_FILE = Path.home() / ".clawdbot" / "mediator.yaml"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The add command logs contact names, email addresses, phone numbers, and channel selections to a persistent log file without explicit disclosure or minimization. Persistent plaintext logging of PII creates a durable privacy risk: other local users, backups, or compromised processes can recover sensitive relationship and contact data unrelated to normal operation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The check command processes email and iMessage content without any visible consent prompt or warning that private communications will be accessed and handled. In this skill's context, the data is likely highly personal and emotionally sensitive, so silent processing materially increases privacy harm and the chance of unauthorized monitoring beyond the user's informed expectations.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The script executes a shell command to install a Python package at runtime using os.system, which is unnecessary for normal email mediation and expands the attack surface. Runtime package installation can pull unpinned code from the network, behave differently across environments, and be influenced by compromised package indexes or local environment manipulation.
- Content
python try: import yaml except ImportError: os.system(f"{sys.executable} -m pip install -q pyyaml") import yaml CONFIG_FILE = Path.home() / ".clawdbot" / "mediator.yaml"
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The script installs a package at runtime by invoking a shell command through os.system, which executes in the current environment and trusts PATH, pip configuration, and package index state at execution time. This expands the attack surface to supply-chain and environment manipulation risks, and doing it automatically inside a message-processing tool makes compromise easier to trigger during normal use.
- Content
python try: import yaml except ImportError: os.system(f"{sys.executable} -m pip install -q pyyaml") import yaml CONFIG_FILE = Path.home() / ".clawdbot" / "mediator.yaml"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents shell commands, config creation, logging, and message-processing integrations, but it declares no explicit tool scope or permissions boundaries. In a skill that handles private communications and invokes external processors, missing scope declarations increase the chance of unintended file, shell, or network access beyond what users expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough that the skill may activate on ordinary conversation about difficult contacts or filtering messages, even when the user did not intend to start interception behavior. Because this skill can process private communications and potentially hide originals or draft replies, accidental activation carries meaningful privacy and workflow risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 72% confidence
- Finding
The skill is designed to archive originals, log actions, and preserve or rewrite message content, which creates ongoing storage of sensitive communications and derived summaries. Even if persistence is operationally useful, retaining emotionally charged or family-related messages increases exposure in the event of local compromise, over-retention, or unauthorized access.
- Content
md ### Summarize Options - **facts-only**: Extract only actionable items, requests, deadlines. No emotion. - **neutral**: Rewrite the message in neutral tone, preserving all content. - **full**: Show everything but flag emotional/manipulative language. ### Respond Options
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The file uses normative language such as removing emotional content, rewriting in a professional tone, and focusing only on actionable items, which effectively forces a specific communication style by default. Because no opt-in warning or alternative preservation guidance is provided here, this can be read as a policy-style constraint on language/tone without explicit user choice.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The docstring claims the helper 'safely manages YAML config,' but the file also performs a shell-based dependency installation path. That mismatch can mislead reviewers and users into trusting the script more than warranted, reducing scrutiny of behavior that enables code execution and network activity.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
A configuration helper should only read and write local config, but this script silently installs a package at runtime via a shell command. That behavior expands the attack surface beyond its stated purpose and can cause unreviewed external code to be fetched and executed on the user's machine.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script installs PyYAML automatically without explicit user consent or prior confirmation. Silent package installation is risky because it surprises the user, performs network and code-execution actions outside the script's apparent function, and can normalize unsafe trust in helper tools.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script writes a local config containing real-looking Gmail addresses and contact-monitoring settings without warning the user about storage of sensitive account information. Even if intended as sample data, realistic identifiers in a generated config can expose personal data, confuse users into monitoring the wrong accounts, and normalize unsafe handling of private account details.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The initialization routine seeds the config with hard-coded Gmail accounts and a Telegram notification channel that extend beyond the stated role of filtering communications from specified difficult contacts. In a mediation skill, preconfiguring unrelated monitored accounts and outbound notification behavior creates unnecessary data-access and data-sharing scope, increasing the chance of silent overcollection or exfiltration of private communications.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The config enables Telegram as a notification channel even though the skill description focuses on local interception, fact extraction, and draft responses. Introducing an external messaging sink creates a path for sensitive message summaries or metadata to leave the expected environment, which is especially risky for emotionally sensitive or private communications.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The check command unconditionally invokes email and iMessage processors, which can scan all accessible sources instead of only channels associated with configured mediated contacts. In this skill context, that broadens collection from targeted filtering to general inbox/message surveillance, exposing unrelated private communications to processing.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module documentation states that originals are archived, but the implementation does not actually archive them. This mismatch can create a dangerous false sense of safety: users may believe intercepted emails are being handled and marked read when they are not, leading to unexpected exposure, duplicate processing, or failure of the promised mediation workflow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Installing packages at runtime is unrelated to the core mediation function and introduces supply-chain and execution risk into a script that processes private email. Even if intended as convenience, silently modifying the environment and fetching code during execution is unsafe and can be exploited through dependency compromise or hostile network/package sources.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["--json", "--limit", "10"]) try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode != 0: log(f"Email search failed: {result.stderr}") return []
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["--json", "--limit", "10"]) try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode != 0: log(f"Email search failed: {result.stderr}") return []
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The archive_email function explicitly does not archive anything, despite comments and surrounding logic implying that intercept mode will handle originals. In a mediation tool, that discrepancy is contextually important because users may rely on interception to prevent direct exposure to messages, but the originals remain unmodified and available.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sends email content to a separate summarization program without any visible consent, warning, or transparency to the user. Because this skill specifically processes communications from difficult contacts, the content may include sensitive personal, financial, workplace, or legal information, increasing the privacy impact of undisclosed secondary processing.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
This code forwards raw email body content to another script for summarization, creating a privacy and data-handling risk because potentially sensitive communications are disclosed to an additional processing component without clear user consent or minimization. In the context of a mediation skill handling difficult-contact emails, messages may contain highly personal or legal content, making secondary processing more sensitive.
- Content
python def summarize_content(contact: dict, content: str) -> dict: """Use LLM to summarize/neutralize content.""" try: result = subprocess.run( [sys.executable, str(SUMMARIZE_SCRIPT), "--mode", contact.get("summarize", "facts-only"), "--content", content],
Static analysis
No suspicious patterns detected.