ClawHub
Back to skill

Security audit

Google Colab

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Google Colab workflow helper that keeps local notes and asks the user to define activation and data boundaries before execution.

Install only if you want persistent local Colab workflow notes under ~/google-colab and are comfortable using Google Colab, Google APIs, GCS, and PyPI for notebook work. Do not connect sensitive datasets unless you have approved the source and handling boundaries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- For notebook execution: Google account with Colab access
- For dataset mounting: explicit permission for Drive, GCS, or external endpoints

Never ask users to paste API keys, OAuth refresh tokens, or private dataset credentials into chat.

## Data Storage
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The auto-activation criteria are broad and ambiguous, covering generic terms like Colab, notebooks, runtime errors, or model training. In an agent setting, this can cause the skill to engage in unrelated contexts, increasing the chance of inappropriate persistence, unintended data capture into local memory files, or overreach into conversations where the user did not intend this skill to operate.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
mkdir -p ~/google-colab
touch ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md}
chmod 700 ~/google-colab
chmod 600 ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md}
```
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
mkdir -p ~/google-colab
touch ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md}
chmod 700 ~/google-colab
chmod 600 ~/google-colab/{memory.md,notebooks.md,runtimes.md,datasets.md,incidents.md,experiments.md}
```

5. If `memory.md` is empty, initialize from `memory-template.md`.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.