ClawHub
Back to skill

Security audit

Ok Computer Swarm

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed DuckDuckGo search helper for parallel research, with supply-chain hardening gaps but no evidence of hidden, destructive, or unrelated behavior.

Install this only in a normal isolated Python environment and avoid sending sensitive or private queries to DuckDuckGo. For stronger reproducibility, the publisher should pin requests and transitive dependencies with a lock file or hashes and declare the outbound network requirement explicitly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Allows Unreviewed Package Versions

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Supply-chain risk through an unbounded dependency version
Risk Level: Medium

Vulnerable Code:

text
requests>=2.31.0

The documented installation procedure in README.md:34-39 invokes:

bash
git clone <repository-url>
cd ok-computer-skill
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Technical Analysis

The dependency declaration specifies only a minimum version and permits pip to install any later release of requests, together with dynamically resolved transitive dependencies. Consequently, the installed dependency set is not reproducible and may differ from the versions reviewed during development or auditing.

If a future allowed release or one of its transitive dependencies is compromised, malicious package code could execute during installation or when requests is imported by scripts/swarm_search.py. The project does not provide exact version pins, package hashes, or a lock file that would constrain installation to reviewed artifacts.

This is a supply-chain hardening deficiency. It does not establish that the current requests package is malicious, but it creates an avoidable path through which a future compromised or otherwise unsafe release could enter the execution environment.

Attack Path

  1. An attacker compromises a future version of an allowed dependency or one of its transitive dependencies.
  2. The compromised version remains compatible with the constraint requests>=2.31.0.
  3. A user follows the README and runs pip install -r requirements.txt.
  4. Package resolution selects the compromised or unreviewed release because no upper bound, exact pin, lock file, or hash restricts it.
  5. Malicious code executes during package installation or later when the dependency is imported and used by the search script.

Impact Assessme

...[truncated 582 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin requests and all transitive dependencies to reviewed, exact versions.
  2. Generate a reproducible lock file using a tool such as pip-compile.
  3. Include cryptographic hashes for every permitted distribution and install with:
    bash
    pip install --require-hashes -r requirements.txt
  4. Review and update pinned dependencies through a controlled process that includes vulnerability scanning and automated tests.
  5. Configure automated dependency monitoring for newly disclosed vulnerabilities.
  6. Install dependencies inside an isolated virtual environment as an unprivileged user and avoid running package installation with administrative privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documentation indicates the underlying script performs DuckDuckGo searches, which implies outbound network access, but the manifest does not declare any tool scope such as permissions or allowed-tools. That creates a mismatch between declared and actual capabilities, weakening least-privilege controls and making it harder for operators to review or sandbox what the skill can do.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/swarm_search.py (reported line 35)May include surrounding context.

python
import requests


DUCKDUCKGO_API = "https://api.duckduckgo.com/"


def search_duckduckgo(query: str, max_results: int = 5) -> Dict[str, Any]:

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified as requests>=2.31.0, which allows future unreviewed versions to be installed and prevents reproducible builds. This increases supply-chain risk and makes it harder to verify whether a deployed version contains known security fixes or introduces regressions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Because requests is not pinned, it is impossible to determine from the manifest alone whether the installed version is affected by known advisories. In a skill that performs outbound web searches and HTTP requests, using an unknown or vulnerable requests release could expose credentials, TLS handling, or request integrity to known library flaws.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.