ClawHub
Back to skill

Security audit

Gcore FastEdge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed helper for building and deploying Gcore FastEdge Wasm apps, with expected build, network, and API-key use for that purpose.

Install this only if you intend to deploy to Gcore FastEdge. Treat GCORE_API_KEY as sensitive, review app IDs and names before create/update commands, and run the helper from a trusted repository and clean shell environment so CARGO/RUSTC cannot be hijacked.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = dict(os.environ)
    if rustc:
        env["RUSTC"] = rustc
    result = subprocess.run([cargo, "build", "--release"],
                            capture_output=True, text=True, env=env)
    if result.returncode != 0:
        sys.exit(f"Build failed:\n{result.stderr}")
Confidence
86% confidence
Finding
The script executes `cargo` from an environment-controlled value (`CARGO`) or from PATH-derived resolution, which can cause execution of an unintended binary if the environment is malicious or compromised. In CI or automation contexts, this becomes a code-execution primitive because the script trusts external tool selection without validating the executable path.

Tainted flow: 'cargo' from os.environ.get (line 23, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
env = dict(os.environ)
    if rustc:
        env["RUSTC"] = rustc
    result = subprocess.run([cargo, "build", "--release"],
                            capture_output=True, text=True, env=env)
    if result.returncode != 0:
        sys.exit(f"Build failed:\n{result.stderr}")
Confidence
94% confidence
Finding
There is a real tainted flow from `os.environ.get("CARGO")` into `subprocess.run`, allowing an attacker who controls the process environment to select an arbitrary executable to run. This is especially relevant in CI runners, shared build systems, or agent-driven automation where environment variables may be attacker-influenced.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to use sensitive capabilities including shell execution, network access, environment-variable access, and file reads, but it does not declare any permissions boundary for those actions. That mismatch can cause the skill to be invoked with broader runtime powers than users or orchestrators expect, increasing the chance of unintended secret exposure, command execution, or live deployment actions using GCORE_API_KEY.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The README states the skill will automatically activate for broad terms like "edge computing" or "Wasm deployment," which can match many unrelated requests beyond Gcore FastEdge-specific tasks. Over-broad auto-triggering can cause the wrong skill to inject instructions or workflows into unrelated sessions, increasing the chance of unsafe actions, user confusion, or unintended tool use.

Unvalidated Output Injection

High
Category
Output Handling
Content
env = dict(os.environ)
    if rustc:
        env["RUSTC"] = rustc
    result = subprocess.run([cargo, "build", "--release"],
                            capture_output=True, text=True, env=env)
    if result.returncode != 0:
        sys.exit(f"Build failed:\n{result.stderr}")
Confidence
84% confidence
Finding
Although labeled as output injection, the real issue is unsafe execution of an environment-influenced binary (`cargo`). Because the build tool path can come from `CARGO`, the script may run arbitrary code under the user's or CI agent's privileges, which is more dangerous in an automated deployment skill than in a purely local utility.

Static analysis

No suspicious patterns detected.