Security audit

Starloop

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent todo-ranking purpose, but it tells the agent to run an unpinned external CLI command using text derived from todo content.

Review this skill before installing. Its todo reading and ranking behavior is expected, but the ClawHub search step should ideally use a pinned, trusted CLI or a non-executing API, and any missing-capability query should be validated and passed as a structured argument rather than interpolated into a shell command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:39
Finding: Unpinned Third-Party Package Execution Through bunx
Content: View full analysis
``` Note the top result slug and summary for inclusion in the output. Only do this for genuinely high-priority items that had to be passed over — not for every blocked todo. ``` ### Technical Analysis The skill instructs the agent to execute `clawhub` through `bunx` without specifying an audited package version, lockfile, or integrity hash. If the package is not already available in a trusted local cache, `bunx` may retrieve it from an external package registry and execute its code. The effective executable can therefore change after this skill has been reviewed. Security depends on external registry resolution, package ownership, package publication controls, and the behavior of the latest package version. A compromised maintainer account, malicious package update, dependency compromise, or package-resolution attack could cause arbitrary package code to run. ### Attack Path 1. A high-priority todo is classified as blocked because a capability is missing. 2. The skill directs the agent to run `bunx clawhub search `. 3. `bunx` resolves the unpinned `clawhub` package and may download it and its transitive dependencies. 4. A compromised or malicious package version executes through package lifecycle behavior or the requested CLI entry point. 5. The package code runs with the permissions and environment available to the agent process. ### Impact Assessment Successful exploitation could execute arbitrary code with the same operating-system privileges as the agent or user running the skill. Depending on the runtime environment, this may permit ...[truncated 417 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:35
Finding: Shell Command Injection Risk Through Model-Derived Capability Text
Content: View full analysis
``` Note the top result slug and summary for inclusion in the output. Only do this for genuinely high-priority items that had to be passed over — not for every blocked todo. ``` ### Technical Analysis The skill derives the `missing-capability` value while analyzing todo Markdown files from a caller-selected directory. Those files are not established as trusted input. The resulting value is then shown as a placeholder inside a shell command, but the skill does not require structured argument-array execution, shell escaping, length restrictions, or character validation. If an implementation substitutes model-generated capability text directly into the command and invokes it through a shell, metacharacters such as command separators, command substitutions, redirections, or pipelines may be interpreted as shell syntax rather than as a search term. Quoting alone is insufficient unless it is performed correctly for the exact shell; structured process invocation is the safer control. Exploitation is conditional on the caller executing the generated command through a shell without safe argument handling. The skill's current instructions fail to prevent that unsafe implementation. ### Attack Path 1. An attacker places or modifies a Markdown todo in the directory supplied through `$ARGUMENTS[0]`. 2. The todo is crafted so that it appears high priority but blocked, and its content encourages the model to derive attacker-controlled text as the missing capability. 3. The agent substitutes that derived text into `bunx ...[truncated 991 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.