ClawHub
Back to skill

Security audit

Agent Health

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a disclosed endpoint health-checking tool, with a caution that its optional CI verifier can execute local Python test files if a user runs it.

Install only if you are comfortable with a local Python tool reading endpoint lists and making outbound checks to those endpoints. Do not run the included CI verifier against untrusted repositories or submitted folders unless it is sandboxed without secrets or sensitive filesystem access.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout
Confidence
97% confidence
Finding
This helper executes an arbitrary Python file from the target product directory to probe for a self-test command. In a CI or verification context, that means untrusted repository content is executed merely to validate it, creating a direct remote code execution path if an attacker can submit or influence the checked folder.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):
Confidence
98% confidence
Finding
This runs every discovered test_*.py or *_test.py file in the target folder. In the context of verifying third-party or untrusted skills, that executes attacker-controlled code during CI, which can exfiltrate secrets, modify the workspace, or pivot further depending on runner permissions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation instructs users to download and run a Python script from the network and explicitly describes capabilities that require file access, network probing, and shell execution, yet no permissions are declared. This creates a trust and review gap: an agent or operator may approve the skill without understanding the actual execution scope, increasing the chance of unintended network access or local command execution.

Static analysis

No suspicious patterns detected.