Security audit

doc-bridge-handoff

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent repository-routing purpose, but it can cause agents to run repository-provided commands and auto-execute a downloaded npm resolver without enough scoping or user control.

Review this skill before installing. It is not clearly malicious, but use it only in repositories you trust, inspect any returned checks before execution, and prefer a reviewed local Doc Bridge binary or pinned dependency installation instead of letting the skill run npx automatically.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/resolve-handoff.mjs:27
Finding: Automatic Download and Execution of an Unverified npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Repository-Controlled Check Strings Are Presented as Mandatory Commands
Content: View full analysis
/scripts/resolve-handoff.mjs ` from the repository. 2. Read every file in `readBeforeEditing`, beginning with `startHere`. 3. Keep changes inside `editRoots`. If the requested path is not covered, stop and report the missing route instead of guessing. 4. Make the smallest change that satisfies the request. 5. Run every command in `checks` before claiming completion. 6. If documentation changed, refresh the Doc Bridge index and run its gate. ``` The resolver only verifies that checks are non-empty strings: ```js if (!nonEmptyStrings(handoff.editRoots) || !handoff.editRoots.every(safeRelativePath)) { fail('editRoots is missing or unsafe') } if (!nonEmptyStrings(handoff.checks)) fail('checks are missing') ``` The bundled fixture is benign, but demonstrates that the command originates in repository routing configuration: ```json "checks": ["npm test -- payments"], ``` ### Technical Analysis The `checks` field crosses a trust boundary from repository or resolver-controlled data into an instruction that tells an agent to execute commands. Unlike file paths, check values receive no safety validation beyond being non-empty strings. There is no restriction on: - The executable that can be invoked. - Shell metacharacters or command chaining. - Absolute paths and traversal sequences. - Network utilities. - Commands that modify files outside the repository. - Access to environment variables, credentials, or user data. - Destructive or persist ...[truncated 1772 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
This directory follows the open Agent Skills layout: one `SKILL.md` plus optional scripts and fixtures. It can be loaded as a local skill by OpenClaw-compatible

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/resolve-handoff.mjs:34