ClawHub
Back to skill

Security audit

Deep Coding

Security checks for vulnerabilities and agentic risk

Overview

The skill’s multi-agent coding workflow is mostly coherent, but its local dashboard can expose workspace files and logs more broadly than users are likely to expect.

Install only in an isolated project workspace with no secrets, credentials, private keys, sensitive logs, or unrelated source files. Do not expose the dashboard beyond localhost. Prefer a container or VM for untrusted generated code, and consider fixing the dashboard to serve only explicit public assets, validate project IDs, sanitize rendered markdown, and bundle or integrity-pin browser dependencies before regular use.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
assets/server.py:231
Finding

Unrestricted Workspace File Disclosure Through Static File Handler

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/server.py:132
Finding

Directory Traversal in Project Logs API

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
assets/dashboard.html:7
Finding

Execution of Mutable Third-Party JavaScript Without Integrity Verification

Content
View full analysis
``` ### Technical Analysis The dashboard loads and executes JavaScript directly from several public content delivery networks. The references are not protected with Subresource Integrity hashes, and several dependencies are selected only by a major version rather than an exact immutable version. As a result, the effective JavaScript payload can change after the Skill package has been reviewed. A CDN compromise, package publishing-account compromise, malicious package update, or upstream supply-chain incident could cause arbitrary code to execute whenever the local dashboard is opened. Remote scripts run in the security context of the dashboard origin. They can access the dashboard APIs and any files exposed by the same-origin server. This risk is materially amplified by the unrestricted workspace static-file handler. ### Attack Path 1. An attacker compromises a referenced CDN asset, dependency publishing account, or upstream package release. 2. The user starts the dashboard server and opens `http://127.0.0.1:8765`. 3. The browser downloads the modified script because no integrity hash is specified. 4. The malicious JavaScript executes with the dashboard's origin privileges. 5. The script requests `/api/projects`, `/api/logs/...`, and known workspace paths from the local server. 6. Retrieved project data or sensitive files can be transmitted to an attacker-controlled endpoint through outbound browser requests. No compromise of the packaged Skill files is required because the execu ...[truncated 709 chars]
Remediation
View remediation
``` 5. Avoid runtime-oriented CDN tools such as the Tailwind CDN script in production; precompile required CSS. 6. Add a restrictive Content Security Policy that permits scripts only from the local origin after dependencies are bundled: ```text Content-Security-Policy: default-src 'self'; script-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none' ``` 7. Use a lockfile and automated dependency vulnerability scanning. 8. Rebuild and re-review bundled assets whenever dependencies change. 9. Correct the unrestricted workspace file-serving issue so that a browser-side dependency compromise cannot read arbitrary project files. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description emphasizes multi-agent coding orchestration, but the actual behavior also includes running a local HTTP server, scanning directories, parsing logs, and exposing project and archived data through dashboard endpoints. This mismatch is dangerous because operators may grant trust or permissions based on the narrower description, while the real behavior materially expands the attack surface to local data exposure and unintended information disclosure.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
Dashboard is included in `assets/server.py` and `assets/dashboard.html`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
Dashboard is included in `assets/server.py` and `assets/dashboard.html`.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 65)May include surrounding context.

html
</head>
<body class="bg-gray-50 min-h-screen">
    <div id="app" v-cloak>
        <!-- Header -->
        <header class="bg-white shadow-sm border-b">
            <div class="max-w-7xl mx-auto px-4 py-4">
                <div class="flex items-center justify-between">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 169)May include surrounding context.

html
</div>
            </div>

            <!-- Pending Request Banner -->
            <div v-if="currentProject && currentProject.is_request" class="bg-gradient-to-r from-yellow-500 to-orange-500 rounded-lg shadow-lg p-6 mb-6 text-white">
                <div>
                    <h2 class="text-2xl font-bold">⏳ {{ currentProject.name.replace('[待启动] ', '') }}</h2>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 283)May include surrounding context.

html
</div>
            </div>

            <!-- Task List -->
            <div v-if="currentProject && !currentProject.is_request" class="bg-white rounded-lg shadow">
                <div class="px-4 py-3 border-b border-gray-200">
                    <h2 class="text-lg font-bold text-gray-900">任务列表</h2>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 320)May include surrounding context.

html
</div>
                                </div>
                                
                                <!-- Progress Info -->
                                <div v-if="module.progress" class="flex items-center gap-4 text-xs text-gray-500">
                                    <span>迭代：{{ module.progress.review_iterations || 0 }} 轮</span>
                                    <span v-if="module.progress.started_at">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 320)May include surrounding context.

html
</div>
                                </div>
                                
                                <!-- Progress Info -->
                                <div v-if="module.progress" class="flex items-center gap-4 text-xs text-gray-500">
                                    <span>迭代:{{ module.progress.review_iterations || 0 }} 轮</span>
                                    <span v-if="module.progress.started_at">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 382)May include surrounding context.

html
<div v-for="(it, index) in module.review_history" :key="index"
                                         class="rounded-lg overflow-hidden border"
                                         :class="getIterationBorderClass(it.status)">
                                        <!-- Header bar -->
                                        <div class="flex items-center justify-between px-3 py-2"
                                             :class="getIterationBgClass(it.status)">
                                            <div class="flex items-center gap-2">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 403)May include surrounding context.

html
<!-- Detail panel -->
                                        <div v-if="isIterationExpanded(module.module_id, it.iteration)" class="px-3 py-3 bg-white space-y-3">
                                            
                                            <!-- Parsed checklist -->
                                            <div v-if="getParsedChecks(it.summary).length > 0">
                                                <p class="text-xs font-medium text-gray-500 mb-1.5">检查项：</p>
                                                <div class="space-y-1">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/dashboard.html (reported line 421)May include surrounding context.

html
<div v-for="(line, li) in getNonCheckLines(it.summary)" :key="li">{{ line }}</div>
                                            </div>
                                            
                                            <!-- Feedback (only if different from summary) -->
                                            <div v-if="it.feedback && !isSameAsSummary(it.summary, it.feedback)" class="pt-3 border-t border-gray-100">
                                                <p class="text-xs font-medium text-gray-500 mb-1">反馈：</p>
                                                <div class="text-xs text-gray-600 space-y-1 leading-relaxed" v-html="renderMarkdown(it.feedback)"></div>

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill requests or implies powerful capabilities like file access, process execution, agent spawning, and local networking, but it does not declare an explicit tool scope or permissions boundary in the skill metadata. This increases the chance of over-privileged execution, unclear operator expectations, and accidental exposure of local files or services when the dashboard and orchestration workflow are used.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

Referencing Playwright via npx playwright without pinning a specific version introduces supply-chain and reproducibility risk, because the resolved package version may change over time or differ across environments. In a workflow that executes code and browser automation, an unexpected dependency version can alter behavior or introduce malicious or vulnerable transitive code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document declares lang="zh-CN", and the visible UI strings throughout the page are in Chinese, which enforces a specific language/locale experience. There is no visible language selector, opt-in, or documentation in this file explaining that the dashboard is intentionally region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The dashboard renders agent-supplied markdown using markdown-it and injects the rendered result with Vue's v-html. If agent feedback or handoff content contains raw HTML or dangerous links/events, this can become stored XSS in a monitoring UI that is expected to display untrusted agent output, allowing script execution in the viewer's browser and possible access to same-origin data or privileged actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

These instructions expand the orchestrator from coordination into active environment manipulation by starting HTTP servers, checking localhost reachability, keeping services running, and killing processes later. That increases the skill's operational privileges and attack surface: a coordination agent handling untrusted project content should not also manage long-lived processes and network-exposed services unless tightly sandboxed and explicitly authorized.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The delivery workflow explicitly keys off Chinese phrases like "可以", "有问题", and "需要改" as user responses, alongside a small set of English terms. This imposes a language/locale expectation in the skill logic without stating that the skill is China-specific or giving the user an explicit language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The server prepends the fixed Chinese label "[待启动]" to request-backed project names, which imposes a specific language in the UI regardless of user preference. This is a natural-language locale choice rather than a technical necessity, and the file does not offer a language selection or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The general logging section mandates filenames in the format agent-{role}-{module-id}-{timestamp}.log, but the sub-agent prompt templates later instruct Builders and Reviewers to use fixed names like logs/builder-{module_id}.log and logs/reviewer-{module_id}.log without timestamps. This is an active contradiction in the file's own operational guidance, creating ambiguity about what sub-agents are actually supposed to do.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.