ClawHub
Back to skill

Security audit

BibiGPT Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward BibiGPT CLI guide with disclosed authentication and update behaviors, though users should be careful about account sessions and self-updates.

Install only if you trust BibiGPT and are comfortable with the CLI using your desktop app session or API token. On shared or managed computers, verify which account is logged in before running summaries, and prefer normal package-manager updates over self-update when you want tighter review control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Self-Modification

High
Category
Rogue Agent
Confidence
95% confidence
Finding

Documenting and encouraging bibi self-update introduces a self-modification path where the tool downloads and installs new code. In an agent skill context, recommending runtime self-update is risky because it changes the executed binary outside normal package-review controls and could be abused if update channels, signing, or transport protections are compromised.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

bibi check-update

Download and install the latest version

bibi self-update

text

## Output Format

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation states that the CLI automatically reads a saved desktop-app session, but does not warn users about the privacy and trust implications of reusing local auth state. On shared machines or managed environments, this can cause users to unknowingly use another person's session or expose account-linked actions through an implicitly inherited login.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The usage tips state that the CLI does not open any GUI window, implying purely terminal-only behavior. However, the documented bibi auth login command explicitly says it will open a browser to log in, which is a direct contradiction in the file's own intent/documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.