T09 · Insecure Skill Coding Practices
Error
- Location
- audit.sh:51
- Finding
- Incomplete and Non-Atomic Pre-Installation Security Audit<![CDATA[ ## Vulnerability Details **File Location**: `audit.sh:51-59`; `safe-install.sh:128` **Vulnerability Type**: Incomplete artifact validation and time-of-check/time-of-use weakness **Risk Level**: High The audit only retrieves files whose names match a limited extension allowlist. It then installs the skill through a separate lookup by its mutable name rather than installing a cryptographically verified copy of the audited artifact. ### Vulnerable Code From `audit.sh:51-59`: ```bash # Get file list files=$(clawhub inspect "$VALUE" --files --json 2>/dev/null) || { echo "❌ Could not fetch skill '$VALUE' from ClawHub" exit 1 } # Collect code from SKILL.md and any .sh/.js/.py/.ts files code="" for fname in SKILL.md $(echo "$files" | jq -r '.files[]?.path // empty' 2>/dev/null | grep -E '\.(sh|js|ts|py|md)$'); do content=$(clawhub inspect "$VALUE" --file "$fname" 2>/dev/null) || continue ``` The file collection loop concludes at `audit.sh:62`: ```bash code+="--- FILE: $fname ---"$'\n'"$content"$'\n\n' done ``` After a safe verdict, `safe-install.sh:124-128` performs a new name-based installation: ```bash SAFE|LOW_RISK) echo -e "✅ Skill looks safe. Installing..." echo "" exec clawhub install "$SKILL" ;; ``` ### Technical Analysis The security decision does not cover the complete artifact that is subsequently installed: 1. The extension filter only includes `.sh`, `.js`, `.ts`, `.py`, and `.md` files. 2. Extensionless executables, binaries, configuration files, package lifecycle definitions, and files using other script extensions are omitted. 3. Failure to retrieve an individual selected file is silently ignored through `|| continue`, so the audit can proceed with incomplete input. 4. The audit and installation are separate ClawHub operations identified only by the skill name. 5. No immutable version, artifact digest, or signature binds the audited contents to the installed contents. Consequently, a ...[truncated 1825 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Retrieve the complete skill package as a single immutable artifact rather than fetching selected files individually. 2. Audit every package file and all installation metadata, including extensionless files, binaries, configuration files, manifests, hooks, and generated commands. 3. Fail closed if any listed file cannot be retrieved, decoded, or included in the audit. Do not silently continue after retrieval failures. 4. Pin the audit to an immutable package version, revision, or content digest. 5. Compute a cryptographic digest of the complete audited artifact and verify the same digest immediately before installation. 6. Install directly from the verified local artifact rather than performing another name-based remote lookup. 7. If ClawHub supports signatures, validate the publisher signature and bind the signature to the exact audited version. 8. Treat unexpected files and package mutations as hard failures requiring a new audit. 9. Display the pinned version and digest to the user so the audit and installation identities can be independently confirmed. 10. Add regression tests covering unsupported extensions, extensionless executables, failed file retrievals, and package mutation between inspection and installation. ]]>