ClawHub
Back to skill

Security audit

Changelog Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local changelog generator that reads git history and can optionally write the result to a file.

Install only if you are comfortable with a local script reading git commit metadata from repositories you point it at. When using -o/--output, choose the destination explicitly because existing files may be replaced.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises and demonstrates shell execution and file-writing behavior via python3 scripts/changelog_gen.py and -o FILE, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization gap where an agent may invoke shell access or write files without clear governance, increasing the risk of unintended repository access, command execution, or overwriting files in broader contexts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/changelog_gen.py (reported line 70)May include surrounding context.

python
"""Run a git command and return stdout."""
    cmd = ["git"] + args
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, cwd=cwd, timeout=30)
        if result.returncode != 0:
            error_msg = result.stderr.strip() or f"git command failed with exit code {result.returncode}"
            print(f"Error: {error_msg}", file=sys.stderr)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script writes to an arbitrary user-specified path without restriction, allowing file creation or overwrite anywhere the process has permissions. In an agent context, this capability is more dangerous because a prompt or indirect instruction could steer the tool to modify unintended local files outside the repository or workspace.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/changelog_gen.py (reported line 270)May include surrounding context.

python
output = format_markdown(commits, grouped=args.group, since=args.since, until=args.until)

    if args.output:
        Path_obj = __import__("pathlib").Path(args.output)
        Path_obj.write_text(output)
        print(f"Changelog written to {args.output}")
    else:

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes the skill as having no external dependencies, yet the implementation shells out to the system's git binary and exits if git is not installed. This is a semantic mismatch between the declared operational requirements and the code's actual behavior, even though using git is otherwise expected for changelog generation from repository history.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest focuses on generating changelogs, release notes, and summaries, which suggests producing content rather than modifying the filesystem. The implementation includes an output file write path, adding a side effect not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Writing directly to a user-provided path with no overwrite warning or confirmation can unintentionally clobber existing files. In a local-agent setting, this raises the risk of accidental data loss or misuse when the output path is supplied indirectly or inferred from untrusted instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.