ClawHub
Back to skill

Security audit

Python Use Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Python execution helper, but it exposes unsandboxed host code execution while presenting sandbox and review behavior that is not actually enforced.

Install only if you are comfortable with the skill running Python code with the same access as the hosting agent. Treat the sandbox label as ineffective in the inspected version, avoid untrusted tasks or code, and use an external container or restricted environment if you need to run it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:85
Finding

Caller-Supplied Python Executes on the Host Despite Claimed Sandbox Protection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
90% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · executor.py (reported line 69)May include surrounding context.

python
# In a full implementation:
        # 1. Call LLM to understand task and generate Python code
        # 2. Execute the generated code with safety checks
        # 3. Capture and return results
        
        # Placeholder implementation

Unvalidated Output Injection

High
Category
Output Handling
Confidence
90% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · index.js (reported line 89)May include surrounding context.

js
# In a full implementation:
        # 1. Call LLM to understand task and generate Python code
        # 2. Execute the generated code with safety checks
        # 3. Capture and return results
        
        # Placeholder implementation

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The API documents a sandbox option and logs its value, but executePython always runs python directly via execAsync with no sandboxing or isolation controls. This creates a dangerous false sense of safety: callers may pass untrusted code believing isolation is enforced when in reality the code executes with the host process's filesystem and process privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill explicitly describes a workflow that automatically generates and executes Python code, but it does not include any warning, approval boundary, or restriction on filesystem, network, or subprocess actions. In an agent setting, this can normalize unsafe execution of model-generated code and increase the chance of destructive or privacy-impacting actions being performed without informed user consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstrings and CLI help text state that the skill executes AI-generated Python code, executes Python directly, and reviews code, but the corresponding methods simply log and return canned success messages. This is an intent-code divergence because the documented behavior actively overstates what the code actually does.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · executor.py (reported line 190)May include surrounding context.

python
elif args.python:
        # Direct Python execution
        result = executor.execute_python(args.task, sandbox=not args.no_sandbox)
    
    else:
        # Task mode (default)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

executePython writes attacker-controlled Python source to disk and executes it as a subprocess, enabling arbitrary code execution with the permissions of the running service. In the context of an agent skill, this is especially dangerous because the code may access local files, environment secrets, network resources, and modify host state without meaningful safeguards.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reviewCode docstring says it reviews Python code for security, performance, and style, but the implementation only returns empty issue arrays and a success message without analyzing the input. This is an active contradiction because the code signals a completed review despite performing no review logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language instructions and usage examples are written exclusively in Chinese, and the file does not indicate that this language choice is optional or limited to a region-specific context. Under SQP-3, forcing a specific language without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill returns troubleshooting guidance only in Chinese string literals. This creates a language policy issue because the file does not offer a language choice or document that the skill is intentionally restricted to Chinese-speaking users.

Content

No source excerpt is available for this finding.