ClawHub
Back to skill

Security audit

HomePod

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherently about HomePod troubleshooting, but its direct-control runbook gives shell command templates with untrusted placeholders and lacks safe execution guidance.

Review this skill before installing if you expect the agent to run direct-control commands. Use it only with explicit target confirmation, avoid controlling devices with unusual names, and prefer shell-free argument execution or carefully validated target, URL, path, and volume values.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
direct-control.md:20
Finding

Shell Command Injection Through Unsanitized Direct-Control Parameters

Content
View full analysis
" playing` | Read-only | Verify current media state | | 2 | `atvremote -n "" play_pause` | Mutating | Toggle playback quickly | | 3 | `atvremote -n "" set_volume=<0-100>` | Mutating | Set exact output level | | 4 | `atvremote -n "" next` | Mutating | Advance to next track | | 5 | `atvremote -n "" stop` | Mutating | End active playback session | ``` ```bash atvremote -n "" play_url="https://example.com/audio.mp3" atvremote -n "" stream_file="/absolute/path/to/file.mp3" ``` ```bash atvremote -n "" pair ``` ### Technical Analysis The direct-control runbook instructs the agent to substitute device targets, URLs, local file paths, and volume values into shell command templates. These values can originate from device discovery or user input, but the runbook does not require strict validation, shell-safe escaping, or execution through a non-shell argument-array API. Double quotes do not prevent every form of shell evaluation. In POSIX-compatible shells, command substitutions such as `$(command)` and backtick substitutions remain active inside double-quoted strings. Consequently, a malicious value inserted into ``, the URL, or the file path could cause an additional local command to execute if the agent constructs and invokes the resulting string through a shell. This weakness is particularly relevant to device names returned by local discovery. An attacker capable of advertising a crafted device name on the local network could potentially introduce shell metacharacters without directly supplying a visible command to the user. Exp ...[truncated 1802 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.