Security audit

Taizi Filesystem

Security checks for vulnerabilities and agentic risk

Overview

This filesystem skill is broadly purpose-aligned, but its reviewed package is missing the declared executable and its docs point users to install unpinned external code with read-write file access.

Review carefully before installing. Prefer a ClawHub/package release that includes the actual filesystem executable, is pinned to a signed version or checksum, and clearly documents safety limits. Avoid running broad content searches or system-log examples unless you have narrowed the path and are comfortable with matched content being shown to the agent or logs.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

Location: README.md:43
Finding: Unpinned Remote Source Is Retrieved and Installed as an Executable## Vulnerability Details **File Location**: `README.md:43-49` **Vulnerability Type**: Unpinned remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```bash # Clone the skill git clone https://github.com/gtrusler/clawdbot-filesystem.git cd clawdbot-filesystem # Make executable chmod +x filesystem # Optional: Install globally npm install -g . ``` ### Technical Analysis The manual installation instructions clone a mutable Git repository without specifying a reviewed commit, version tag, checksum, or cryptographic signature. They then instruct the user to grant executable permission to the downloaded `filesystem` file and optionally expose it globally through npm. This is particularly significant because the audited artifact does not contain the `filesystem` executable, even though `package.json` declares that file as both the package entry point and command-line executable. Consequently, the effective implementation cannot be reviewed from this artifact, and users following the instructions may execute code that differs from the audited package. A repository owner, compromised maintainer account, or attacker with repository write access could modify the repository after this audit. Subsequent installations would retrieve the modified implementation without an integrity check. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or the repository's default branch. 2. The attacker replaces or modifies the remote `filesystem` executable with malicious code. 3. A user follows the documented manual installation procedure. 4. `git clone` retrieves the current attacker-controlled branch contents rather than a pinned, reviewed revision. 5. The user grants executable permission with `chmod +x filesystem`. 6. The user runs `npm install -g .`, making the downloaded command globally accessible, or invokes the executable directly. 7. The malicious impl ...[truncated 728 chars]
Remediation: ## Remediation Suggestions 1. Include the declared `filesystem` executable in the distributed artifact so its implementation can be reviewed alongside the documentation and metadata. 2. Pin manual installation instructions to a specific audited commit or immutable signed release rather than cloning the repository's mutable default branch. 3. Publish a SHA-256 or stronger checksum for every release artifact and instruct users to verify it before granting executable permission or installing the package. 4. Cryptographically sign release tags and distribution artifacts, and document signature verification steps. 5. Ensure the package version, documentation version, metadata version, and referenced source revision are consistent. 6. Avoid recommending global installation from an unverified working tree. Prefer installation from a versioned, integrity-protected package registry or a verified local release archive. 7. Add automated release checks that fail if files declared by `package.json`, especially executable entry points, are absent from the published artifact.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README promotes full-text content search and context display but does not warn that matching lines may contain secrets, credentials, tokens, personal data, or other sensitive content that will be echoed into terminal output, logs, or downstream tools. In an agent skill context, this is more dangerous because automated workflows may search broad directory trees and then forward results to other systems without human review.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The system administration examples explicitly operate on /var/log and /tmp and encourage content searching for error patterns without a clear warning that these directories can contain sensitive operational details, usernames, hostnames, tokens, stack traces, or other confidential data. In an AI-agent skill, such examples normalize scanning sensitive system paths and can lead to unintentional disclosure through model context, logs, or copied outputs.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The package metadata describes 'advanced filesystem operations' and 'analysis' without any stated scope limits, safe directories, or user-confirmation constraints. For an agent-invoked skill with read-write filesystem permission, overly broad capability framing increases the risk of unintended activation for generic file-related prompts and can enable destructive or privacy-impacting actions if the agent routes tasks too loosely.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: This markdown file documents a batch copy command that writes files into a backup directory, but the surrounding example does not explicitly warn that it changes the filesystem or may overwrite files depending on options and destination state. Although the document mentions safety features elsewhere, the usage example itself omits a user-facing warning about data modification impact.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The keyword set contains broad terms like 'files', 'directories', 'search', and 'automation' that are likely to overlap with common user requests. In an agent ecosystem, generic trigger terms can cause over-selection of a powerful filesystem skill, increasing the chance that read-write operations are offered or executed in situations where a narrower, safer tool should have been used.

Static analysis

No suspicious patterns detected.