ClawHub
Back to skill

Security audit

Accountability

Security checks for vulnerabilities and agentic risk

Overview

This operations follow-up tracker is understandable, but it can run free-form checks from project notes and automatically change audit files, so it should be reviewed before install.

Install only if you want an agent to maintain persistent operational follow-up files and you are prepared to review every stored Check command before it runs. Treat FOLLOWUPS.md as trusted operational input, restrict who can edit it, prefer structured check types over shell snippets, and require explicit approval before networked or credentialed checks execute.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:62
Finding

Unvalidated Execution of Shell Commands from a Mutable Workspace Ledger

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62-76, 172-191, and 223-229
Vulnerability Type: Arbitrary command execution through untrusted ledger content
Risk Level: High

Vulnerable Code

markdown
- **Check:** `<exact command to copy-paste>`
markdown
- **Check**: A command that someone (human or cron) can copy-paste and run. No vague instructions like "check if it works". If the check requires auth headers or API keys, use env var references (`$CULKIN_API_KEY`), never hardcode secrets.
markdown
### 2. Verify

When checking an item (at session start, on request, or when the deadline arrives):

1. Run the `Check` command
2. Compare output against `Expected`
3. Update the item:
markdown
## Session Start Protocol

Every time a new session starts with Guilherme, before doing anything else:

1. Read FOLLOWUPS.md
2. Run cleanup (archive DONE items older than 3 days)
3. Report any FAILED items first (these are blockers)
4. Report any PENDING items past their deadline (overdue)
5. For overdue items, offer to run the check right now
6. Summarize: "X pending, Y failed, Z resolved since last session"

Technical Analysis

The Skill uses a mutable workspace file, FOLLOWUPS.md, as both a tracking ledger and a source of shell commands. It directs the agent to run each item's Check value, but it does not establish a trust boundary or define any validation controls for that value.

In particular, the instructions provide no:

  • Command or executable allowlist
  • Network destination allowlist
  • Provenance or integrity verification for ledger entries
  • Rejection of shell operators, pipes, redirections, or command substitutions
  • Mandatory user confirmation before execution
  • Restricted execution environment or sandbox
  • Limit on inherited environment variables or credentials

Consequently, anyone able to alter FOLLOWUPS.md could rep ...[truncated 2398 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace free-form shell commands with structured verification records, for example:
    yaml
    check:
  type: http_health
  url: https://culkin.mygri.com/api/health
  method: GET
  expected_status: 200
  expected_json:
    status: ok
  2. Implement a strict allowlist of supported check types, executables, arguments, HTTP methods, and network destinations.
  3. Do not invoke a shell for routine checks. Use direct process execution with fixed argument arrays or dedicated HTTP/database APIs.
  4. Reject shell metacharacters and execution features, including |, ;, &, redirections, backticks, $(), newline injection, and environment assignment.
  5. Treat all ledger content as untrusted data. Validate its schema and verify its provenance or integrity before acting on it.
  6. Require explicit user approval showing the fully resolved command, target, and required permissions before any exceptional command execution.
  7. Run checks in a sandbox with a minimal environment, read-only filesystem access where possible, execution timeouts, resource limits, and restricted network egress.
  8. Pass only the individual credential required for an approved check rather than inheriting the agent's complete environment.
  9. Separate ledger maintenance from command execution permissions so that routine cleanup does not require unrestricted network or process access.
  10. Record the command origin, approval identity, execution result, and timestamp in an append-only audit log.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

markdown
### Culkin Deploy #251 — Journey Grid v3 (Culkin) — 2026-03-22
- **Status:** PENDING
- **Check:** `curl -sf "https://culkin.mygri.com/api/health" -H "X-API-Key: $CULKIN_API_KEY" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status','FAIL'))"`
- **Expected:** status=ok
- **Deadline:** 2026-03-22 15:30 UTC
- **On failure:** Check Vercel deploy logs, rollback to #250 if broken

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation description is extremely broad and can trigger on many ordinary operational conversations, causing the skill to run in contexts where the user did not explicitly request accountability tracking. In this skill, unintended activation is risky because it carries mandatory file reads, writes, cleanup, escalation behavior, and operational reporting that can alter project state or distract from the requested task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to modify FOLLOWUPS.md and remove entries from DONE automatically during session start, but it does not require a user-facing warning or confirmation before making those data-changing operations. In an unintended or loosely scoped invocation, this can silently alter audit records and operational state, which is especially sensitive because the files are described as centralized and append-only/audit-oriented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.