ClawHub
Back to skill

Security audit

智能技能推荐器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Review case because it presents itself as read-only recommendation, but its instructions also install remote skills using undeclared write and command-execution behavior.

Review this skill carefully before installing. It should be treated as more than a read-only recommender: it can lead an agent to run commands, download remote content, and persist new skills locally. Only use it where explicit confirmation, pinned installer versions, source verification, and restricted installation paths are enforced.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:60
Finding

Shell Command Injection Through User-Controlled Search Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-67
Vulnerability Type: Command injection through unsafe shell-string construction
Risk Level: High

Vulnerable Code

markdown
Use the helper script `scripts/search_skills.py`. The script searches SkillHub and ClawHub simultaneously and automatically calculates compatibility scores:

```bash
python ~/.workbuddy/skills/skill-advisor/scripts/search_skills.py "<user requirement>" --limit 20 --keywords "<kw1>,<kw2>,<kw3>"
text

The source document places the raw user requirement and derived keywords directly inside a shell command. The English placeholders above correspond to the original user-controlled requirement and keyword placeholders.

### Technical Analysis

User-controlled requirements and keywords are interpolated into a command string enclosed only by double quotes. Double-quote wrapping is not sufficient shell escaping. An attacker can supply embedded quotes, command substitutions, redirection operators, or other shell metacharacters that terminate the intended argument and introduce additional commands.

The risk arises if the agent follows this instruction by submitting the assembled text to a shell, such as through `sh -c`, `bash -c`, or an equivalent command-execution tool. The document does not require strict argument validation or structured process invocation.

The referenced `scripts/search_skills.py` file is absent from the audited project, so it cannot provide a verifiable secondary validation layer.

### Attack Path

1. An attacker submits a skill-search request containing a shell payload, such as an embedded closing quote followed by a command separator.
2. The agent treats the complete request as the `<user requirement>` value.
3. The agent interpolates that value into the documented command.
4. The injected quote terminates the intended argument.
5. The shell interprets the remaining attac
...[truncated 702 chars]
Remediation
View remediation

Remediation Suggestions

  • Never build a shell command by concatenating or interpolating user-controlled text.

  • Invoke the Python interpreter with a structured argument array, for example:

    python
    subprocess.run(
    [
        python_executable,
        script_path,
        user_requirement,
        "--limit",
        "20",
        "--keywords",
        ",".join(keywords),
    ],
    shell=False,
    check=True,
)

  • Keep shell=False and prohibit use of sh -c, bash -c, PowerShell command strings, or equivalent wrappers.

  • Validate keyword count, character set, and maximum length before invocation.

  • Treat generated keywords as untrusted because they originate from user input.

  • Bundle and audit the referenced helper script so its validation and network behavior can be reviewed.

  • Preserve the declared shell: no boundary by implementing remote search through a constrained HTTP client instead of shell execution.

T08 · Insecure Dependencies

Error
Location
SKILL.md:147
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 147-155
Additional Location: SKILL.md, line 266
Vulnerability Type: Unsafe third-party dependency retrieval and execution
Risk Level: High

Vulnerable Code

markdown
### Step 5: Installation After User Selection

After the user makes a selection, such as "install the first one," the system automatically installs it as follows without requiring the user to perform manual steps:

**Install from SkillHub**: The system automatically downloads a ZIP archive and extracts it into the `~/.workbuddy/skills/<slug>/` directory.

**Install from ClawHub**: The system automatically executes `npx clawhub install <slug> --workdir ~ --dir .workbuddy/skills` to complete installation.

The user is notified after successful installation.

The FAQ additionally directs the user to run:

bash
npm install -g clawhub

The English prose above is a faithful rendering of the original installation instructions; the executable commands and paths are unchanged.

Technical Analysis

The installation workflow invokes clawhub through npx without specifying an immutable version, package integrity hash, lockfile, or verified provenance. Depending on local npm behavior and package availability, npx can download and execute the current registry version.

The global installation instruction has the same weakness. A mutable package release can change after this skill has been audited. Package lifecycle scripts and the package's runtime logic may execute with the user's privileges.

The SkillHub path also downloads and extracts a remote ZIP archive without documenting signature verification, digest verification, archive-entry validation, or review of the downloaded skill. This creates an additional untrusted supply-chain boundary, although the exact downloader implementation is not present in the audited project.

Attack Path

  1. The use ...[truncated 1293 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin clawhub to an explicitly audited version rather than invoking an unversioned package.
  • Verify npm integrity metadata and package provenance against an approved lockfile or trusted manifest.
  • Avoid global installation. Run dependencies in an isolated environment with minimum filesystem and network privileges.
  • Disable package lifecycle scripts where compatible, and separately review any executable entry point.
  • Require an explicit confirmation that identifies the exact package, version, source, permissions, and destination before retrieval.
  • For ZIP installation, require a trusted HTTPS origin plus a publisher signature or preapproved cryptographic digest.
  • Reject archive entries containing absolute paths, parent-directory traversal, symbolic-link escapes, or device files.
  • Extract into a temporary isolated directory, audit the resulting files, and only then move approved content into the skill directory.
  • Do not automatically load newly downloaded skills until a separate security review has completed.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:9
Finding

Installation Workflow Exceeds Declared Read-Only and No-Shell Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-12 and 147-153
Related Security Claims: SKILL.md, lines 184-186
Vulnerability Type: Permission-boundary mismatch and violation of least privilege
Risk Level: Medium

Vulnerable Code

The skill declares:

yaml
permissions:
  - network: yes
  - filesystem: read-only
  - shell: no

Its installation workflow requires write and shell capabilities:

markdown
### Step 5: Installation After User Selection

After the user makes a selection, such as "install the first one," the system automatically installs it as follows without requiring the user to perform manual steps:

**Install from SkillHub**: The system automatically downloads a ZIP archive and extracts it into the `~/.workbuddy/skills/<slug>/` directory.

**Install from ClawHub**: The system automatically executes `npx clawhub install <slug> --workdir ~ --dir .workbuddy/skills` to complete installation.

The security section also states:

markdown
- This skill only reads skill-market data and does not perform write, delete, or modification operations.
- Recommendation results are output only and are not installed automatically; the final installation action is triggered after user confirmation.

The English prose above faithfully represents the original claims and instructions; executable paths and commands are unchanged.

Technical Analysis

Downloading and extracting a ZIP archive into ~/.workbuddy/skills/ requires filesystem-write access. Executing npx requires process or shell execution capability. Both operations contradict the declared filesystem: read-only and shell: no permissions.

The statement that the skill does not perform write or modification operations is also inconsistent with the installation workflow. User confirmation does not resolve the permission declaration problem: confirmation authorizes an operation, while ...[truncated 1570 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove Step 5 from this skill and keep it strictly limited to read-only recommendations, consistent with its declared permissions.
  • Implement installation as a separate, independently audited component with explicit filesystem-write and process-execution permissions.
  • If installation remains part of the skill, accurately declare all required capabilities, including destination-scoped filesystem writes and constrained process execution.
  • Require a separate confirmation immediately before installation. Display the exact source, package version, destination, integrity information, and requested permissions.
  • Enforce permissions technically rather than relying only on documentation.
  • Restrict writes to a dedicated staging directory and prevent access to unrelated user or project paths.
  • Replace unrestricted shell access with a narrowly scoped installation API that validates package identifiers, versions, archive paths, and signatures.
  • Update the security statement so that it accurately distinguishes recommendation behavior from the optional installation phase.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and description say the skill only recommends and does not install, but later workflow text explicitly states it will automatically install after user selection. This mismatch is dangerous because it undermines user consent and platform trust boundaries, making reviewers and users underestimate that the skill leads to code acquisition and execution paths.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The security statement claims the skill only reads data and performs no write, delete, or modify actions, yet the documented workflow installs skills into ~/.workbuddy/skills/<slug>/. This is a materially false security representation that can cause users or automated reviewers to approve a skill with write/install behavior they did not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill’s display name and the entire user-facing instruction set are presented in Chinese, and the examples and trigger guidance assume Chinese-language usage. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The skill instructs use of npx clawhub install <slug> without pinning a package version or integrity, which introduces supply-chain risk. If the upstream package is updated maliciously or a compromised dependency is served, user-confirmed installation could execute untrusted code during the install flow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file says it does not involve system-level operations, but the documented behavior invokes external Python and npx commands for search and installation. Even if intended as normal tooling, external command execution expands attack surface through command invocation, dependency compromise, and environmental side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad everyday language such as '推荐', '找个', and '有什么', which can cause unintended activation in unrelated conversations. In context, accidental triggering can lead to unnecessary filesystem scans and remote searches, unexpectedly exposing local skill inventory or sending user intent text to external services.

Content

No source excerpt is available for this finding.