ClawHub
Back to skill

Security audit

ClawBB

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a macOS voice-to-text app, but it asks users to optionally run an unpinned remote install script and uses sensitive macOS microphone/accessibility permissions.

Prefer the verified DMG path and check the documented SHA-256 before opening it. Treat the optional build-from-source instructions as higher risk unless you first pin and inspect a specific commit. Only grant Microphone and Accessibility permissions if you are comfortable with a dictation app capturing audio and inserting text into the active cursor location.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:43
Finding

Execution of Unpinned Code Retrieved from a Remote Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-47
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

bash
git clone https://github.com/dyz2102/xiabb.git /tmp/xiabb-build
cd /tmp/xiabb-build
# Review install.sh and native/main.swift before running
cat install.sh
bash install.sh

Technical Analysis

The build instructions clone the mutable default branch of a remote GitHub repository and then direct the user to execute its install.sh script. The repository is not pinned to a reviewed commit, immutable release tag, or cryptographically verified source archive. Consequently, the code executed by the user may differ from the code that existed when this Skill was audited.

Displaying the script with cat does not provide a reliable security boundary. A user may not fully inspect the script or its transitive behavior, and the script can retrieve and execute additional mutable content. Although the repository is fetched over HTTPS, transport security does not protect against compromise of the upstream repository, maintainer account, or release process.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or the repository's default branch.
  2. The attacker modifies install.sh, or another resource invoked by it, to contain malicious commands.
  3. A user follows the documented build-from-source procedure and clones the mutable default branch.
  4. The user runs bash install.sh as instructed.
  5. The attacker-controlled commands execute with the privileges and environment of the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution in the invoking user's security context. The payload could read or alter files accessible to that user, access environment variables such as GEMINI_API_KEY if present, make network requests, install user-level persistence, or download further payloads.

...[truncated 252 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the source to a specific reviewed commit hash rather than cloning the mutable default branch.
  • Publish the expected commit identifier or archive SHA-256 checksum in SKILL.md and require verification before execution.
  • Prefer downloading a source archive from an immutable release and validating its checksum and release signature.
  • If a Git tag is used, require a signed tag and verify its signature; a tag name alone may be moved.
  • Replace the generic installation script with explicit, reviewable build commands where practical.
  • Audit install.sh, native/main.swift, and every script or remote resource they invoke before recommending execution.
  • Fail closed if the checked-out commit, checksum, or signature does not match the documented trusted value.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The phrase 'Hold Globe key. Speak. Text appears.' describes invocation only as pressing a common keyboard key, without clarifying whether the skill activates globally, in which apps it should or should not be used, or any negative examples. In a markdown skill description, this can be read as an overly broad trigger condition that may cause unintended invocation or user confusion about scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
Or configure via the app's menu bar → "Configure Gemini API Key...".

The key is stored locally at `~/Tools/xiabb/.api-key` (chmod 600 recommended).

### Permissions

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The description markets the skill as 'Bilingual — Mixed Chinese + English, perfect punctuation for AI prompts,' which suggests a specific language/locale behavior but does not mention any user choice or opt-in for language handling. Under the policy, forcing or assuming a language/locale without offering a choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
15% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Download the Apple Notarized DMG (app release v1.1.3): from GitHub Releases:

bash
curl -L -o /tmp/XiaBB.dmg "https://github.com/dyz2102/xiabb/releases/download/v1.1.3/XiaBB-v1.1.3-macOS-arm64.dmg"

Verify checksum before opening: