ClawHub
Back to skill

Security audit

迁移打包与部署 (Migration Pack & Deploy)

Security checks for vulnerabilities and agentic risk

Overview

This skill is for local assistant migration, but it needs Review because it handles persistent assistant memory while running unreviewed migration scripts and recommending a third-party software download path.

Install only if you trust the source of the migration scripts and the migration zip, and avoid running deploy.py from an archive you did not create or verify. Use an isolated MIGRATE_DEST for testing, keep a full backup before restore, review the exact files to be copied or overwritten, and obtain any required tools only from official verified sources.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:20
Finding

Execution of Unverified External Migration Scripts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-29 and 65
Vulnerability Type: Execution of scripts that are not included in the audited package and lack integrity verification
Risk Level: High

Relevant snippet (English rendering of the source instructions):

text
2. Run: python ~/.workbuddy/scripts/pack.py [output directory] [workspace root]

2. Confirm that the extraction path exists, then run:
   python deploy.py [workspace directory]
   - During testing or isolation, set MIGRATE_DEST=<target>.

The only external scripts invoked are pack.py and deploy.py.

Technical Analysis

The Skill instructs the Agent to execute pack.py from ~/.workbuddy/scripts/ and deploy.py from an extracted migration archive. Neither script is present in the audited project, which contains only SKILL.md and _user_meta.json. Consequently, the scripts' actual behavior, provenance, and security properties cannot be audited from this package.

The instructions do not require a cryptographic signature, pinned checksum, trusted publisher, canonical-path validation, ownership check, or symlink check before execution. User confirmation of a destination path does not establish the integrity of executable code.

This creates a trust-boundary vulnerability: any process or attacker able to replace the local pack.py, alter the migration archive, or place a malicious deploy.py in the extraction directory can cause arbitrary Python code to run under the user's account.

Attack Path

  1. An attacker or compromised local process replaces ~/.workbuddy/scripts/pack.py, tampers with a migration archive, or places a malicious deploy.py in the directory selected for deployment.
  2. The user asks the Agent to package or restore the assistant.
  3. The Agent obtains the documented path confirmation.
  4. The Agent executes the unverified Python script as instructed.
  5. The malicious script runs with the cu ...[truncated 1005 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include pack.py and deploy.py in the reviewed Skill package so their behavior can be audited.
  2. Sign release artifacts and verify their signatures against a pinned, trusted public key before execution.
  3. Publish and verify pinned SHA-256 checksums for both scripts and the complete migration archive.
  4. Resolve script paths canonically and reject symlinks, hard links, unexpected ownership, writable parent directories, and scripts located outside approved directories.
  5. Validate archive members before extraction and reject absolute paths, traversal sequences, links, device files, and unexpected executable content.
  6. Display the exact script path, digest, source, and planned file changes before requesting execution approval.
  7. Execute restoration in an isolated destination first and compare the resulting file manifest against an explicit allowlist.
  8. Enforce filesystem restrictions in code or through operating-system sandboxing rather than relying only on written instructions.

T08 · Insecure Dependencies

Error
Location
SKILL.md:34
Finding

Software Acquisition Through an Untrusted Third-Party Proxy

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 34
Vulnerability Type: Unsafe third-party software distribution source
Risk Level: High

Relevant snippet (English rendering of the source instruction):

text
If a tool cannot be found, guide the user to install it.
Obtain the portable version of Notepad++ through ghfast.top.

Technical Analysis

The Skill directs acquisition of Notepad++ through ghfast.top, a third-party proxy rather than an official Notepad++ distribution endpoint. No pinned artifact version, cryptographic digest, release signature, publisher certificate requirement, or independent integrity check is specified.

A proxy can alter the downloaded response, redirect to a different artifact, serve a stale vulnerable release, or become compromised after the Skill has been reviewed. If the resulting portable executable is trusted and launched, this creates a software supply-chain execution path.

Attack Path

  1. Deployment path calibration fails to locate Notepad++.
  2. The Skill instructs the user or Agent to obtain a portable version through ghfast.top.
  3. The proxy, its DNS path, or its upstream artifact is compromised or malicious.
  4. A modified executable is delivered under the expected product name.
  5. The user or Agent launches the portable application without verifying a pinned digest and trusted signature.
  6. The modified binary executes with the current user's privileges.

Impact Assessment

Exploitation can result in arbitrary native-code execution under the user's account. A malicious binary could access user-readable documents and assistant memory, alter user-writable configuration, steal credentials available to the process, install user-level persistence, or download further payloads.

The Skill does not request administrative rights, so administrator-level access is not directly established. Nevertheless, the binary inherits all privileges and acces ...[truncated 37 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to use ghfast.top.
  2. Download software only from the official Notepad++ website or its verified official release repository.
  3. Pin an explicit release version and SHA-256 digest in reviewed configuration.
  4. Verify the downloaded artifact's Authenticode signature and expected publisher before execution.
  5. Fail closed if the digest, signature, publisher, filename, or expected release metadata does not match.
  6. Require separate user approval before downloading and before executing any third-party binary.
  7. Prefer informing the user that the dependency is unavailable rather than automatically retrieving executable software.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:32
Finding

Filesystem Discovery Exceeds the Declared Access Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-41
Vulnerability Type: Inconsistent filesystem scope and least-privilege guarantees
Risk Level: Medium

Relevant snippet (English rendering of the source instructions):

text
Path calibration automatically:
- Detects invalid absolute tool or workspace paths in PATHS.md.
- Searches common locations such as ProgramFiles and LocalAppData.

Scope:
- Read and write access is limited to ~/.workbuddy/, the workspace
  .workbuddy/memory/ directory, and one user-confirmed output directory.
- It never reads or writes anything outside these paths.

Technical Analysis

The declared security boundary states that the Skill never reads or writes outside three narrowly identified locations. However, the path-calibration procedure explicitly searches locations such as ProgramFiles and LocalAppData, which are outside that declared scope.

Filesystem search necessarily reads directory metadata and potentially file names or attributes. Therefore, the discovery behavior contradicts the absolute claim that nothing outside the listed paths is read. The external implementation is absent, so the audit cannot verify that discovery is restricted to exact application names or that traversal is bounded.

This discrepancy can cause a user to approve deployment based on a materially inaccurate description of its access scope. It also weakens least-privilege assurances because no enforceable allowlist or separate consent requirement is documented for the broader search.

Attack Path

  1. PATHS.md contains a missing or invalid absolute tool path.
  2. Deployment invokes automatic path calibration.
  3. The external deployment script searches ProgramFiles, LocalAppData, or other common locations outside the declared boundary.
  4. The script enumerates filesystem information and selects a discovered path.
  5. It writes that path into PATHS.md.
  6. If the ...[truncated 975 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the absolute “never reads outside” statement with an accurate and exhaustive access policy.
  2. Enumerate every directory that path calibration may inspect, including platform-specific locations.
  3. Obtain separate, explicit user consent before searching outside the migration directories.
  4. Restrict discovery to a fixed allowlist of canonical directories and exact expected filenames.
  5. Do not recursively traverse broad profile or application-data trees.
  6. Reject candidates from user-writable or untrusted directories unless separately approved.
  7. Validate discovered binaries using expected publisher signatures, pinned hashes, ownership, and canonical paths before recording or invoking them.
  8. Add implementation-level sandboxing and automated tests proving that reads and writes cannot exceed the documented allowlist.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is written as an instruction set for Chinese-language use and centers the skill around Chinese trigger phrasing, but it does not state that language choice is optional or limited for a justified regional reason. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to activate on ordinary conversation about changing devices, restoring work, or moving platforms, which could cause the agent to propose or initiate sensitive migration actions in the wrong context. Because this skill handles packaging and deployment of assistant memory and config, accidental invocation increases the chance of unintended data exposure, overwrite, or persistence changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The skill is explicitly designed to read and write persistent assistant memory and configuration under ~/.workbuddy/, which creates a session persistence mechanism across machines. In context this is the intended feature, but persistence of identity, memory, and config is security-relevant because it can transfer sensitive state, preserve compromised settings, or overwrite an existing profile on the destination system if the workflow is misused.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
This skill moves sensitive assistant memory between machines. The following are **hard limits**, not suggestions:

### Scope — what it may touch
- READ/WRITE is limited to: `~/.workbuddy/` (assistant memory & config), the workspace `.workbuddy/memory/` directory, and ONE user-confirmed output directory (default `~/Downloads/谢尔比的礼物/`).
- It NEVER reads or writes anything outside these paths: no system files, no unrelated user documents, no other apps' data.

### Data flow — nothing leaves the machine