ClawHub
Back to skill

Security audit

Mindgraph

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent knowledge-graph tool, but it tries to affect all Markdown work and contains an unbounded path-handling flaw in its mindskill commands.

Review before installing. This skill is not showing malicious exfiltration or destructive behavior, but it can influence ordinary Markdown edits, index broad workspace notes, and create persistent files. Only use it in workspaces where Obsidian-style wikilinks are desired, and avoid passing untrusted or path-like names to mindskill commands until path validation is added.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:3
Finding

Mandatory Session-Wide Behavior Override Through Always-On Skill Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mindgraph.py:449
Finding

Path Traversal in MindSkill Read and Creation Commands

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Mandating wikilinks as 'standard practice in every markdown file' is an ambiguous global instruction with no directory, project, or task boundaries. This can silently alter unrelated documentation, introduce formatting changes where they are inappropriate, and cause the agent to prioritize skill-specific conventions over the user's immediate intent or repository norms.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Mandating wikilinks as 'standard practice in every markdown file' is an ambiguous global instruction with no directory, project, or task boundaries. This can silently alter unrelated documentation, introduce formatting changes where they are inappropriate, and cause the agent to prioritize skill-specific conventions over the user's immediate intent or repository norms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to save result files under the workspace and rebuild an index, but does not prominently warn that these steps perform writes and may modify repository state. In practice, this can lead to non-obvious persistence, accidental file creation, and workspace-wide index churn without explicit user awareness or consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The listed triggers include generic phrases such as "Should I build X?", "Validate this idea", and "Is this worth building?" that could easily occur in ordinary conversation outside a deliberate invocation context. The file does not provide narrowing constraints, exclusions, or negative examples to clarify when the skill should and should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L20 says the process is encoded and 'just say "knockout test this" and it executes.' For a markdown file, this is an invocation description, and the phrase is broad enough to be ambiguous without constraints, scope, or negative examples. The document does not clarify when this trigger should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script writes a graph index to mindgraph.json in the workspace, and this behavior is not accompanied by any confirmation prompt or explicit warning before the write occurs. Although the operation is central to the index command, the file write itself can modify user workspace state and should be clearly disclosed at the point of action or in surrounding documentation/comments.

Content

No source excerpt is available for this finding.

Tainted flow: 'GRAPH_FILE' from os.environ.get (line 16, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/mindgraph.py (reported line 149)May include surrounding context.

python
'linkCount': sum(len(n['outLinks']) for n in nodes.values())
    }
    
    with open(GRAPH_FILE, 'w') as f:
        json.dump(graph, f, indent=2)
    
    file_nodes = sum(1 for n in nodes.values() if n['file'])

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level docstring describes the script as an Obsidian-style wikilink graph that indexes, queries, and traverses markdown links. Starting at L407, the code adds a separate capability for creating, listing, and reading 'mindskills' and their results, including writing new PROCESS.md files, which is beyond the stated graph-focused behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Creating directories and files without confirmation becomes security-relevant here because the destination path is derived from unvalidated user input. In the context of cmd_learn, an attacker-controlled or mistaken name can cause unintended filesystem writes outside the intended skill area, making the file-creation behavior materially dangerous.

Content

No source excerpt is available for this finding.

Tainted flow: 'process_file' from os.environ.get (line 508, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
98% confidence
Finding

The learn command uses the unvalidated user-supplied name to construct skill_dir/process_file and then writes PROCESS.md. Because name is passed directly into os.path.join without sanitization, path traversal values such as '../../somewhere' can escape the intended mindskills directory and create or overwrite arbitrary files accessible to the current user.

Content

Scanner excerpt · scripts/mindgraph.py (reported line 509)May include surrounding context.

python
os.makedirs(os.path.join(skill_dir, 'results'), exist_ok=True)
    
    process_file = os.path.join(skill_dir, 'PROCESS.md')
    with open(process_file, 'w') as f:
        f.write(f"""# [[{name.replace('-', ' ').title()}]]

<!-- PURPOSE: What this process does and when to use it -->

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring says 'Find links pointing to nothing (no file, no other references),' which implies zero references. The actual filter requires len(n.get('inLinks', [])) == 1, meaning the node has one reference, so the documentation actively misstates the behavior of the command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.