ClawHub
Back to skill

Security audit

go-next-move

Security checks for vulnerabilities and agentic risk

Overview

This skill performs local Go board analysis as described, with disclosed local file writes and no evidence of hidden network access or credential use.

Install only if you are comfortable running local Python/OpenCV and KataGo. Avoid using sensitive photos unless you understand that correction retries may save local copies in the recognition-label directory; delete that directory or choose a controlled path if retention is not desired.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Dependency installation lacks cryptographic artifact verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:25-29; related dependency declarations in requirements.txt:1-2
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
python3 -m pip install -r {baseDir}/requirements.txt

The referenced requirements file contains:

text
numpy==2.2.6
opencv-python-headless==4.10.0.84

Technical Analysis

The installation instructions retrieve and install third-party Python packages through pip. Although the versions are pinned, the requirements file does not specify cryptographic hashes, and the instructions do not require a trusted package index.

Version pinning provides reproducibility at the package-version level but does not authenticate the downloaded artifacts. The effective source is influenced by pip configuration, environment variables, command-line defaults, and configured package indexes. A compromised index, malicious mirror, manipulated local pip configuration, or substituted distribution artifact could therefore supply code different from the artifact reviewed by the Skill author.

Python package installation and subsequent imports execute package-controlled code with the privileges of the user running the Skill.

Attack Path

  1. A user or host follows the installation command documented in SKILL.md.
  2. pip resolves the pinned packages using the host's configured package index or mirror.
  3. An attacker controls or compromises that index, mirror, pip configuration, or the returned package artifact.
  4. pip downloads an unauthenticated malicious artifact matching the requested package name and version.
  5. Package-controlled code executes during installation or when the Skill imports NumPy or OpenCV.

Impact Assessment

Successful exploitation provides code execution with the privileges of the account performing the installation or running the Skill. The resulting code cou ...[truncated 401 chars]

Remediation
View remediation

Remediation Suggestions

  1. Generate a fully hash-locked requirements file containing SHA-256 hashes for every accepted wheel.

  2. Require hash verification during installation:

    bash
    python3 -m pip install --require-hashes -r {baseDir}/requirements.txt

  3. Document and enforce the expected trusted package index, for example with a controlled --index-url.

  4. Prefer binary wheels from a verified internal mirror and reject source distributions where practical.

  5. Install dependencies into a dedicated virtual environment rather than a shared or privileged Python environment.

  6. Periodically update and regenerate the lock file through a controlled dependency-review process.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_vendor/go_next_move_core/analysis.py:1308
Finding

Unbounded computation and image-size parameters permit local resource exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/_vendor/go_next_move_core/cli.py:43-58; incomplete validation in scripts/_vendor/go_next_move_core/analysis.py:1308-1315
Vulnerability Type: Improper resource allocation and missing upper-bound validation
Risk Level: Medium

Vulnerable Code

The CLI accepts caller-controlled resource parameters without upper limits:

python
result.add_argument("--board-size", type=int, default=19, help="Board size, default: 19")
result.add_argument("--komi", type=float, default=7.5, help="Komi, default: 7.5")
result.add_argument(
    "--visits",
    type=int,
    default=DEFAULT_VISITS,
    help=f"KataGo visit budget, default: {DEFAULT_VISITS}",
)
result.add_argument("--top-candidates", type=int, default=20, help="Number of candidate moves to return and consider for level selection")
result.add_argument("--warp-size", type=int, default=1200, help="Image recognition warp size")
result.add_argument("--corners", help="Manual image board corners as 'x,y x,y x,y x,y'")
result.add_argument("--grid-corners", action="store_true", help="Treat --corners as outer grid intersections")
result.add_argument("--overlay", type=Path, help="Write a recognition overlay when input is an image")
result.add_argument("--source-overlay", type=Path, help="Write a recognition overlay on the original source image")
result.add_argument("--reject-low-confidence-recognition", action="store_true", help="Return a reviewable result instead of calling KataGo when image recognition confidence is low")
result.add_argument("--result-image", type=Path, help="Write a clean board image with the recommended move marked")
result.add_argument("--source-result-image", type=Path, help="Write the recommended move overlay on the original source image")
result.add_argument("--result-size", type=int, default=1200, help="Pixel size for --result-image, default: 1200")

Final validation enforces only minim ...[truncated 2603 chars]

Remediation
View remediation

Remediation Suggestions

  1. Enforce explicit upper and lower bounds before loading images or starting KataGo.

  2. Because the Skill is designed for 19×19 Go, require:

    python
    if request.board_size != 19:
    raise ValueError("--board-size must be 19")

  3. Define conservative limits appropriate to the deployment, for example:

    python
    if not 1 <= request.visits <= 5000:
    raise ValueError("--visits must be between 1 and 5000")
if not 1 <= request.top_candidates <= 100:
    raise ValueError("--top-candidates must be between 1 and 100")
if not 320 <= request.result_size <= 4096:
    raise ValueError("--result-size must be between 320 and 4096")
if not 320 <= request.warp_size <= 4096:
    raise ValueError("--warp-size must be between 320 and 4096")

  4. Reject source images that exceed configured byte-size or decoded-pixel limits.

  5. Apply operating-system process limits or container quotas for CPU time, memory, disk usage, and accelerator access.

  6. Rate-limit requests when the CLI is exposed through an API or multi-user service.

  7. Add tests confirming that oversized and negative parameter values are rejected before resource-intensive operations begin.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented behavior expands beyond simple next-move analysis by persisting copied images, corrected outputs, and metadata in local label directories with timestamps and arbitrary metadata, while the high-level description emphasizes local board analysis and limited data handling. This discrepancy is dangerous because users may provide sensitive photos believing processing is transient, when the skill can retain a persistent dataset of inputs and derived annotations on disk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The documented behavior expands beyond simple next-move analysis by persisting copied images, corrected outputs, and metadata in local label directories with timestamps and arbitrary metadata, while the high-level description emphasizes local board analysis and limited data handling. This discrepancy is dangerous because users may provide sensitive photos believing processing is transient, when the skill can retain a persistent dataset of inputs and derived annotations on disk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly instructs the host to invoke local binaries, read user-specified files, write images and metadata to disk, and use temporary and persistent directories, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap: an agent or reviewer cannot mechanically constrain shell, file read/write, or environment access, increasing the chance of unintended file access or command execution beyond the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is entirely in Chinese and presents the skill's functionality in that language without indicating that responses can be localized based on user preference. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_vendor/go_next_move_core/analysis.py (reported line 710)May include surrounding context.

python
skill_config,
        working_directory=working_directory,
    )
    proc = subprocess.run(
        command,
        input=json.dumps(query, ensure_ascii=False) + "\n",
        text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code hard-codes user-facing natural-language output in Chinese across core explanation paths, including side names, level descriptions, move reasoning, and low-confidence notices. Because the file provides no opt-in or locale-selection mechanism, it enforces a specific language and matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_vendor/go_next_move_core/katago.py (reported line 81)May include surrounding context.

python
working_directory=working_directory,
        )
        self.log.info("starting resident KataGo analysis process")
        self._proc = subprocess.Popen(
            command,
            cwd=working_directory,
            stdin=subprocess.PIPE,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code creates a persistent on-disk label directory, copies the input image and derived images into it, and writes metadata.json. For a skill whose stated purpose is transient next-move analysis of board photos/text, this expands data retention beyond what is necessary and can expose user-uploaded images or metadata to later unauthorized access, debugging misuse, or accidental disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.