ClawHub
Back to skill

Security audit

Dep Vuln Scanner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward dependency vulnerability scanner, but its results should not be treated as a strict CI gate without hardening.

Install only if you are comfortable sharing dependency names and versions with OSV.dev. For CI enforcement, fix or compensate for fail-open network handling, lossy version parsing, and invalid JSON output before relying on this as a deployment gate.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/dep_vuln_scan.py:112
Finding

OSV Query Failures Are Silently Reported as Clean Scan Results

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dep_vuln_scan.py:21
Finding

Lossy Dependency Version Parsing Can Scan a Different Version Than the Installed Package

Content
View full analysis
=, etc. to get base version clean = re.sub(r"^[\^~>=<]*", "", ver).strip() if clean and re.match(r"\d", clean): deps[name] = clean ``` The Python parser similarly extracts one version token from a constraint: ```python # Handle ==, >=, <=, ~=, != match = re.match(r"^([a-zA-Z0-9_.-]+)\s*[=~!<>]=?\s*([0-9][0-9a-zA-Z.*-]*)", line) if match: deps[match.group(1)] = match.group(2) else: ``` ### Technical Analysis Dependency manifests commonly contain version ranges rather than the exact versions installed in an environment. The scanner strips operators such as `^`, `~`, `>=`, and `<`, then submits the remaining value to OSV as though it were an exact package version. For example, an npm declaration such as `^1.2.3` may resolve to a later version within the allowed range, but the scanner queries only `1.2.3`. Likewise, a Python constraint such as `>=1.2.3` does not establish that `1.2.3` is installed. The scanner does not inspect lockfiles or the installed package environment. Complex constraints, multiple bounds, environment markers, direct references, and other valid dependency formats may also be reduced incorrectly or omitted. Because vulnerability status is version-specific, querying the wrong version can produce false negatives or false positives. ### Attack Path 1. A manifest declares a dependency range whose boundary version is not vulnerable. 2. Dependency resolution selects a different version within that range. 3. The res ...[truncated 910 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/dep_vuln_scan.py:163
Finding

JSON Mode Emits Non-JSON Banner Text to Standard Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises behavior that reads local dependency files and queries the OSV.dev API, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a trust and containment gap: an agent may grant broader-than-necessary file read or network access, increasing the chance of unintended data exposure or unauthorized outbound requests when the skill is invoked.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/dep_vuln_scan.py (reported line 92)May include surrounding context.

python
def query_osv(package_name, version, ecosystem):
    """Query OSV.dev API for vulnerabilities."""
    url = "https://api.osv.dev/v1/query"
    payload = {
        "package": {"name": package_name, "ecosystem": ecosystem},
    }

Static analysis

No suspicious patterns detected.