ClawHub
Back to skill

Security audit

Subdomain Enum

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward subdomain-enumeration skill with disclosed network lookups and optional file output, but users should only run it on domains they are authorized to assess.

Install only if you need subdomain enumeration and are comfortable making live DNS and crt.sh requests for the target domain. Use it only on domains you own or have permission to test, avoid confidential targets if third-party lookup disclosure is unacceptable, and consider pinning the Python dependency in controlled environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:53
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53-57
Vulnerability Type: Unpinned third-party dependency and unverified package source
Risk Level: Medium

Vulnerable Code

markdown
## Dependencies

```bash
pip install requests
text

### Technical Analysis

The installation command retrieves whichever version of the `requests` package the configured Python package index currently serves. The project provides no version constraint, lock file, package hash, or trusted-index requirement.

Although `requests` is a legitimate package and no malicious dependency was observed in the audited files, this installation process does not produce a reproducible or cryptographically verified dependency set. A compromised upstream release, package repository, dependency account, or configured package mirror could supply altered code. That code may run through package installation behavior or when `scripts/subenum.py` imports `requests`.

### Attack Path

1. An attacker compromises the relevant package release channel, repository account, or package index/mirror configured on the user's system.
2. The attacker causes the index to serve a malicious or compromised dependency version.
3. A user follows the documented command:
   ```bash
   pip install requests
  1. Pip resolves and installs the uncontrolled package version from that index.
  2. Malicious package logic executes during installation or when scripts/subenum.py imports requests at lines 20-24.
  3. The payload runs with the privileges of the user or automation process that installed or launched the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's privileges. The resulting access may include files, environment variables, network credentials, and services available to that account. The scope does not inherently exceed the installer or runtime account's privileges, and exploitation depends on compromise or manipulati ...[truncated 43 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin requests and all transitive dependencies to reviewed versions using a lock file or fully pinned requirements file.
  2. Record and enforce cryptographic hashes, for example:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  3. Generate hashes from artifacts obtained through a trusted dependency-review process.
  4. Use an explicitly controlled package index or internal dependency mirror rather than relying on arbitrary user-level pip configuration.
  5. Add automated dependency vulnerability and integrity scanning to the release process.
  6. Periodically update pins through a reviewed process instead of using unconstrained latest versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises and instructs use of capabilities that perform network access and file output, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, this weakens policy boundaries and can allow broader-than-expected execution, making it easier for the skill to perform external queries or write files without clear user-visible guardrails.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation language is broad enough to match general reconnaissance, discovery, or infrastructure-mapping requests, which increases the chance the skill is invoked in situations beyond the user's intent or authorization. Because this skill performs external enumeration against arbitrary domains, overbroad routing materially raises misuse risk in a security-sensitive context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill omits a prominent warning that it will perform live external DNS lookups and query crt.sh, disclosing the target domain and potentially specific subdomains to third parties. Users may unknowingly leak sensitive targets, internal naming conventions, or assessment activity to external infrastructure, especially when using custom wordlists or confidential domains.

Content

No source excerpt is available for this finding.