ClawHub
Back to skill

Security audit

WheelSpotter

Security checks for vulnerabilities and agentic risk

Overview

WheelSpotter mostly does what it claims, but it needs review because it handles a GitHub token through command-line arguments and uses untrusted package metadata in agent evaluation prompts without clear guardrails.

Review before installing. Use this only when you intend to perform external package/repository searches, avoid passing GitHub tokens on the command line, and treat returned package descriptions and install suggestions as untrusted until independently verified.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search.py:548
Finding

GitHub Personal Access Token Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:219
Finding

Indirect Prompt Injection Through Untrusted Repository and Package Metadata

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.py (reported line 126)May include surrounding context.

python
Args:
        query: Search keywords
        limit: Maximum results to return
        token: GitHub personal access token (optional, increases rate limit)
    
    Returns:
        List of SearchResult objects

Credential Access

High
Category
Privilege Escalation
Confidence
76% confidence
Finding

Accepting the GitHub personal access token as a command-line argument can expose the secret through shell history, process listings, job control tooling, and audit logs on multi-user or monitored systems. In an agent setting, this is riskier because orchestration layers often log full command invocations, which can accidentally disclose credentials beyond the intended scope.

Content

Scanner excerpt · scripts/search.py (reported line 549)May include surrounding context.

python
parser.add_argument(
        "-t", "--token",
        help="GitHub personal access token (optional, increases rate limit)"
    )
    
    parser.add_argument(

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill describes network access and references writing outputs/files and runnable scripts, but it declares no explicit tool scope such as permissions or allowed-tools. In an agent environment, this can lead to overbroad execution privileges, making it easier for the skill to perform unintended network calls or file writes if the host grants defaults permissively.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
80% confidence
Finding

The trigger phrase 'find wheels' overlaps with a common built-in command pattern around 'find', creating a shadowing/confusion risk. In agent systems, command ambiguity can cause the wrong skill to activate, potentially leading to unexpected network searches, incorrect actions, or bypass of safer default flows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger keywords are broad and generic, so the skill may activate in unrelated conversations and steer the agent into unnecessary network-backed search behavior. Over-triggering increases the chance of unintended data disclosure to external services, wasted tokens/cost, and confusing or unsafe automation in contexts where the user did not request this capability.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

Referencing a Docker image without a fixed tag or digest makes executions non-reproducible and exposes users to supply-chain risk if the upstream image changes, is replaced, or a malicious image is served under the same name. This is especially relevant because the skill presents action-oriented commands users may copy directly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 131)May include surrounding context.

python
Returns:
        List of SearchResult objects
    """
    url = "https://api.github.com/search/repositories"
    headers = {"Accept": "application/vnd.github.v3+json"}
    
    if token:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script accepts an arbitrary output path and writes results there, even though the skill is described as a search/scouting utility rather than a file-writing capability. In an agent context, this expands the tool's authority from read/search/network actions into local filesystem modification, which can be abused to overwrite user files, drop misleading content, or interfere with other workflows if path inputs are attacker-controlled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The prompt templates and all activation guidance are written as fixed English instructions and examples, with no indication that users may interact in other languages or opt into English-only behavior. Under the language/locale policy, forcing or implicitly assuming a single language without user choice can be a policy concern unless clearly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The section header claims the HTTP client uses urllib to avoid external dependencies beyond requests, but the implementation immediately imports and uses the requests library instead. This is an active contradiction between documentation and code behavior, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.