T09 · Insecure Skill Coding Practices
Error
- Location
clawhub_guard.py:54- Finding
Bypassable Vetting Allows Untrusted Marketplace Skills to Be Installed as Low Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawhub Guard
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it advertises safety checks it does not actually perform and can auto-install marketplace skills.
Use this only as a convenience wrapper, not as a real security reviewer. Do not rely on its risk ratings before installing skills, and avoid the install command unless you have independently inspected the target package and trust its source.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented security claims do not match the described behavior: the skill presents itself as a safety guard with integrated vetting, yet static analysis indicates it can install skills and may rely only on superficial local scoring rather than the claimed review mechanism. This is dangerous because users may place elevated trust in its recommendations and auto-install path, causing unsafe skills to be installed under a false sense of security.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises shell-backed behavior via commands like scanning, auditing, and installing, but the manifest does not declare any tool scope such as allowed-tools or permissions. That creates a trust and review gap: consumers and policy engines cannot accurately constrain or evaluate what the skill is allowed to execute, which is especially risky for a skill that invokes marketplace and installation operations.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run_ch(args, timeout=60): r = subprocess.run([CLAWHUB_BIN] + args, capture_output=True, text=True, timeout=timeout) return r.stdout, r.stderr, r.returncode
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The audit command claims to check installed skills for updates but actually runs inspect on each skill, creating a misleading security posture. Users may rely on this command to maintain patch hygiene and wrongly assume vulnerable or outdated skills have been reviewed for updates when they have not.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill presents itself as a marketplace safety guard but also performs installation of third-party skills, which is a system-changing action based only on weak keyword vetting. In this context, the mismatch is dangerous because users may trust the tool's safety framing and allow it to install untrusted code that the simplistic vetting logic misclassifies as safe.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code automatically runs installation with '-y' after only a shallow heuristic check, with no explicit user confirmation immediately before the system-changing action. In a marketplace tool that handles third-party skills, this materially increases the chance of silent installation of malicious or overly privileged content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language description, examples, and workflow are presented only in Chinese, which imposes a specific language on users. Under the stated policy, a forced language or locale without user opt-in is a policy violation unless the constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The top-level natural-language description is presented in Chinese only, with no indication that the user can choose another language or locale. That can violate a language-choice policy when the skill is not clearly documented as region-specific.
- Content