ClawHub
Back to skill

Security audit

Sui Auto Test

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Sui Move coverage helper that runs local coverage tools and may guide the agent to write tests, with no evidence of hidden exfiltration, persistence, or destructive behavior.

Install only if you want an agent to run Sui coverage commands and potentially edit repository test files. Review generated diffs before accepting changes, and do not let it stage or commit files unless you explicitly approve the final diff and commit message.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code clearly matches the coverage-analysis portion of the description: it parses LCOV, finds uncovered code, generates suggestions, and produces reports. However, it does not write or generate actual test files, nor does it perform any security auditing logic. Those are materially stronger capabilities than simple reporting/suggestion generation and are not implemented in this chunk. There are no signs of unrelated triggers, hidden network/file exfiltration, or inconsistent resource access beyond reading LCOV/source files and printing results. Therefore this is a partial but meaningful description-to-behavior mismatch due to overstated capabilities.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · analyze_source.py (reported line 41)May include surrounding context.

python
os.dup2(slave, 2)
        os.close(slave)
        os.chdir(package_path)
        os.execvp('sui', ['sui', 'move', 'coverage', 'source', '--module', module_name])
    else:
        # Parent process
        os.close(slave)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill clearly directs the agent to read files, write tests, and execute shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may exercise broader capabilities than a user expects, increasing the chance of unintended repository modification or command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the user or agent to write missing tests as part of an automatic workflow without an explicit warning that repository files will be changed. In an agentic setting, this can lead to silent source-tree modification, accidental overwrites, or changes being made in the wrong project context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill unconditionally recommends running git add and git commit after test improvements, with no requirement for user review or consent. Automatic commits can permanently record unintended, low-quality, or sensitive changes and make rollback or auditing harder in shared repositories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.