ClawHub
Back to skill

Security audit

Wander Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent CI watcher, but it tells agents to automatically run background shell scripts, including repository-selected wrappers, after pushes.

Review before installing. Use Wander only when you explicitly want CI monitoring, avoid automatic post-push starts, inspect any scripts/watch-*.sh wrapper before running it, and pin or verify the Wander repository version before chmodding or executing its shell scripts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding

Mandatory Automatic Execution of Repository-Controlled Wrapper Scripts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-19
Vulnerability Type: Mandatory agent behavior leading to untrusted command execution
Risk Level: High

Vulnerable Code

markdown
## Agent auto-trigger (mandatory)

**After every `git push` that triggers GitHub Actions, start Wander in background mode** unless the user opts out.

1. If `.workflows.yml` exists in the repo root: prefer a project wrapper (`scripts/watch-*.sh`) when present.
2. Otherwise: `"$WANDER_HOME/watch-workflow-bg.sh" <workflow.yml>` (or pass the workflow file the project uses).
3. Run in the background so the session stays responsive.
4. After ~8s, check terminal output and report initial status.

If there is no `.workflows.yml` but `.github/workflows/` exists, offer monitoring but do not auto-start without confirmation.

Technical Analysis

The skill changes the agent's default behavior by requiring it to start a monitoring process after every qualifying git push, unless the user explicitly opts out. More critically, it tells the agent to prefer an arbitrary project-local script matching the broad scripts/watch-*.sh pattern.

Project-local scripts are controlled by the repository being processed and are not necessarily part of this audited skill. The instructions do not require the agent to inspect the selected script, verify its integrity, restrict its permissions, or obtain affirmative user approval before execution. The presence of .workflows.yml is treated as sufficient reason to execute such a wrapper, even though that file also remains under repository control.

This permits a repository to influence the agent's session goals and induce execution of attacker-supplied commands under the appearance of routine CI monitoring.

Attack Path

  1. An attacker creates or modifies a repository containing a .workflows.yml file.
  2. The attacker adds a malicious script with a matching name, such as `scri ...[truncated 1284 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory automatic trigger and require explicit, affirmative user confirmation before starting any monitoring command.
  2. Do not select executable scripts using a wildcard such as scripts/watch-*.sh.
  3. Require an exact wrapper path from trusted configuration rather than inferring one from repository contents.
  4. Inspect and present the wrapper's contents before execution when the wrapper comes from the current project.
  5. Verify that the wrapper resolves only to a regular file inside the expected repository path and is not a symbolic link.
  6. Prefer invoking a reviewed Wander binary or script directly with validated arguments instead of executing repository-controlled wrappers.
  7. Run monitoring with a minimal environment and without unnecessary credentials.
  8. Keep automatic monitoring strictly opt-in and clearly disclose the exact command that will run.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:36
Finding

Retrieval and Execution of Mutable Remote Shell Scripts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-42, with subsequent execution examples at lines 58-73
Vulnerability Type: Unpinned remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/ERerGB/wander.git ~/code/wander
cd ~/code/wander
chmod +x *.sh

The retrieved scripts are subsequently executed as shown by the usage instructions:

bash
cd /path/to/wander
./smart-push.sh
bash
git push
cd /path/to/target-repo
"$WANDER_HOME/watch-workflow-bg.sh" publish.yml

Technical Analysis

The installation procedure clones the current state of a remote Git repository without pinning a reviewed commit, immutable release artifact, checksum, or cryptographic signature. It then grants executable permissions to every top-level shell script using chmod +x *.sh.

The audited package contains only documentation and does not contain the referenced shell scripts. Consequently, the effective executable payload is determined by the state of the external repository at installation time and can change independently after this skill has been reviewed or published.

The later instructions directly execute smart-push.sh and watch-workflow-bg.sh. Therefore, compromise of the upstream repository, maintainer account, release process, or network trust assumptions can turn the documented installation flow into arbitrary remote code execution.

Attack Path

  1. An attacker compromises the upstream repository or a maintainer account, or otherwise causes malicious shell code to appear on its default branch.
  2. The user follows the skill's installation instructions and clones the mutable default branch.
  3. The installation command grants executable permissions to all matching top-level shell scripts.
  4. The user or agent follows the usage instructions or the mandatory auto-trigger behavior.
  5. A modified smart-push.sh, `watch- ...[truncated 1056 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a specific, reviewed commit hash or immutable signed release.
  2. Publish checksums for release artifacts and verify them before granting executable permissions or running scripts.
  3. Use signed Git tags or release signatures and document signature verification.
  4. Package reviewed scripts directly with the skill where practical, so the audited content matches the executed content.
  5. Replace chmod +x *.sh with explicit permission changes for only the required, verified files.
  6. Review downloaded script contents before execution and prevent automatic execution when verification fails.
  7. Avoid tracking a mutable default branch for production installation.
  8. Execute the monitoring component with least privilege and remove unrelated secrets from its environment.
  9. Document the exact trusted version and provide a controlled update process requiring a new review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mandates automatic background execution after every git push that triggers GitHub Actions, which is broader than user-explicit consent and can cause unintended command execution in routine workflows. Because it launches local scripts based on repository state and environment variables, this increases the chance of surprise execution, misuse of a project-provided wrapper, and unnecessary access to GitHub/local system resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill does not clearly warn that invoking Wander will execute CLI scripts automatically, may run in the background, and can generate notifications or local logs. Missing disclosure undermines informed consent and makes the autonomous behavior more dangerous, especially where wrappers like scripts/watch-*.sh may contain repository-specific logic beyond passive monitoring.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The skill authorizes autonomous action by instructing the agent to start monitoring automatically after pushes and to inspect terminal output after a delay, without requiring confirmation in the primary path. In this context, autonomy is more dangerous because the chosen executable can be a repository-local wrapper or a path derived from environment variables, creating a trust boundary issue and enabling unintended script execution.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
3. Run in the background so the session stays responsive.
4. After ~8s, check terminal output and report initial status.

If there is no `.workflows.yml` but `.github/workflows/` exists, offer monitoring but do not auto-start without confirmation.

## When to use this skill