ClawHub
Back to skill

Security audit

Md Linter

Security checks for vulnerabilities and agentic risk

Overview

This Markdown linter mostly matches its stated purpose, but its install instructions fetch executable code from a mutable remote branch and its external link checker can make unrestricted network requests.

Install and run the bundled reviewed md_linter.py rather than downloading from the mutable GitHub main branch. Use --check-external only on trusted Markdown or inside a network-restricted environment, and avoid running ci/verify_product.py against untrusted package directories.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:32
Finding

Mutable Remote Payload Retrieval and Subsequent Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
md_linter.py:158
Finding

Blind SSRF Through Unrestricted External Link Validation

Content
View full analysis
= 400: issues.append({"line": line_num, "link": link, "display": display, "status": f"HTTP {resp.status}"}) exit_code = 1 except (urllib.error.URLError, socket.timeout, ValueError) as e: issues.append({"line": line_num, "link": link, "display": display, "status": f"ERROR: {e}"}) exit_code = 1 ``` ### Technical Analysis When `links --check-external` is used, the program extracts arbitrary HTTP and HTTPS URLs from the supplied Markdown document and sends HEAD requests to them. There is no destination policy or validation preventing requests to: - IPv4 or IPv6 loopback addresses. - RFC1918 private network ranges. - Link-local addresses. - Cloud instance metadata services. - Internal DNS names. - Reserved, multicast, or otherwise non-public destinations. - Public endpoints that redirect to internal destinations. `urllib.request.urlopen` follows HTTP redirects by default, while the implementation does not validate each redirect destination. Restricting the method to HEAD reduces response-body exposure but does not eliminate SSRF: the request can still reveal network reachability through status and error differences, reach metadata or administrative services, or trigger endpoints that incorrectly perform actions for HEAD requests. The network ope ...[truncated 1830 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

This function executes arbitrary Python files discovered in the target product directory as part of verification by invoking them with a self-test argument. In a CI or pre-merge context, an attacker can submit a malicious product containing a crafted .py file, causing the verifier to run untrusted code on the host and enabling remote code execution, data exfiltration, or CI compromise.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python
all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

This code executes any test_*.py or *_test.py file found in the product directory, treating attacker-controlled repository content as trusted code. In CI, a malicious contributor can place hostile logic in a test file and obtain code execution under the verifier's privileges, potentially stealing tokens, modifying artifacts, or pivoting within the build environment.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python
# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

Static analysis

No suspicious patterns detected.