ClawHub
Back to skill

Security audit

WonderDash

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims: it manages WonderDash widget JSON in a GitHub repo, with expected but sensitive SSH-key and delete workflows.

Install only if you expect WonderDash to provide a repo-specific deploy key. Treat that key as a secret, keep it scoped to the intended wonderdash-widgets repository, avoid logging or sharing it, and remove ~/.ssh/wonderdash_deploy and the matching SSH config entry if you no longer need the integration. Use archive when unsure; permanent delete removes the widget file from the repo, though git history may still contain it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md
- **Reorder:** Rearrange the array in `dashboard.json`, commit, push.
- **Archive:** Remove the ID from `dashboard.json` — widget file stays in repo.
- **Restore:** Add the ID back to the array.
- **Delete permanently:** Remove from `dashboard.json` + `git rm widgets/{id}.json`, commit, push.

The user pulls down on their dashboard to refresh. Changes appear after a manual refresh.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to receive, write, and configure an SSH private key on disk for GitHub access without any warning about credential sensitivity, scope, storage hygiene, or cleanup. Because this skill is explicitly designed around handling a private deploy key, compromise or careless reuse of that key could grant repository access and potentially broader GitHub access depending on how the key is provisioned.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
cat > ~/.ssh/wonderdash_deploy << 'KEYEOF'
<paste the key here>
KEYEOF
chmod 600 ~/.ssh/wonderdash_deploy

# Add SSH config
cat >> ~/.ssh/config << 'EOF'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill documentation includes a permanent deletion workflow using git rm widgets/{id}.json, which removes widget files and pushes the change upstream. The section does not explicitly warn that this is irreversible from the dashboard perspective and will delete repository content unless recovered from git history.

Content

No source excerpt is available for this finding.