ClawHub
Back to skill

Security audit

Auto PieceOne

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed game automation helper, but it tells the agent to download changing code from GitHub and run it with desktop-control libraries without verification.

Review this before installing. The skill is not shown to be malicious, but following it would run whatever code is currently in a third-party GitHub repository, plus unpinned Python packages, on your machine with desktop automation access. Use a pinned, reviewed commit in an isolated environment and avoid running it against your normal desktop session.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILLS.md:55
Finding

Unverified Mutable Remote Code Is Downloaded and Executed

Content
View full analysis
") browser(action="open", targetUrl="https://piece.one/?widget=2&from=claw") # 3. Start script exec(command="python autopieceone/autopieceone.py CharacterName") ``` ### Technical Analysis The Skill directs the Agent to clone a third-party GitHub repository and execute its Python script without pinning the repository to an immutable reviewed commit. It also instructs the Agent to run `git pull` before subsequent executions, causing the effective payload to change whenever the upstream branch changes. No checksum, cryptographic signature, release attestation, or source review is required before execution. The referenced source code is not included in the audited project, so its actual behavior cannot be independently verified from this package. Because the script uses system-level GUI automation, an altered payload may also interact with applications outside the game. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or the branch referenced by the default clone and pull operations. 2. The attacker modifies `autopieceone.py` or another imported file ...[truncated 915 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILLS.md:29
Finding

Python Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILLS.md (reported line 25)May include surrounding context.

md
- **Windows**: [Download Python 3.12](https://www.python.org/downloads/)
- **Mac**: `brew install python3` or [Download from Official Site](https://www.python.org/downloads/macos/)
- **Linux**: `sudo apt install python3` or `sudo yum install python3`

Make sure to check **"Add Python to PATH"** during installation.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent/user to clone a remote GitHub repository, pull updates, and execute its Python script directly on the host without any review, pinning, integrity verification, or safety warning. Because the repository can change over time and the script uses system-level automation libraries, this creates a realistic path to arbitrary code execution and unsafe host interaction.

Content

No source excerpt is available for this finding.