ClawHub
Back to skill

Security audit

Harness Engineering

Security checks for vulnerabilities and agentic risk

Overview

The skill is a documentation/template package, but its runnable harness template gives an AI agent broad shell access without enough built-in containment.

Review this before installing if you plan to reuse the code templates directly. Treat the bash tool as unsafe until you add command allowlisting, workspace sandboxing, human approval for risky operations, path restrictions, and stronger secret redaction. The skill itself did not show hidden execution or exfiltration behavior.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Unvalidated Output Injection

High
Category
Output Handling
Content
async def execute(self, p: BashParams) -> str:
        try:
            r = subprocess.run(
                p.command, shell=True, capture_output=True, text=True, timeout=p.timeout
            )
        except subprocess.TimeoutExpired:
Confidence
99% confidence
Finding
The BashTool executes model-controlled input via subprocess.run with shell=True, allowing arbitrary shell metacharacters, chaining, redirection, expansion, and command substitution. In an agent harness, this is especially dangerous because LLM-generated tool arguments are inherently untrusted and can lead to command execution, data destruction, or host compromise.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
async def execute(self, p: BashParams) -> str:
        try:
            r = subprocess.run(
                p.command, shell=True, capture_output=True, text=True, timeout=p.timeout
            )
        except subprocess.TimeoutExpired:
Confidence
99% confidence
Finding
Allowing an LLM to pass arbitrary strings directly into a shell command parameter creates classic tool-parameter abuse. Because this skill is specifically a reusable harness template, downstream adopters may inherit a dangerous primitive that enables destructive commands, exfiltration, persistence, and lateral movement on the host.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/long-running-patterns.md:355