ClawHub
Back to skill

Security audit

Decision Topology

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently records short local conversation summaries as decision trees, with no evidence of network exfiltration or deceptive behavior, but it does persist data automatically.

Install only if you are comfortable with the agent automatically saving short conversation-derived topics, summaries, rejection reasons, and concepts to local JSON and Markdown files. Use a private storage directory, avoid directories writable by other users, disable always-on mode if you want explicit invocation only, and periodically review or delete stored trees if conversations may be sensitive.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/topology.js:20
Finding

Symlink-Based Filesystem Containment Bypass

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CONTRIBUTING.md (reported line 33)May include surrounding context.

Clean up after testing:

bash
rm -rf /tmp/test-trees

What to Contribute

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CONTRIBUTING.md (reported line 33)May include surrounding context.

Clean up after testing:

bash
rm -rf /tmp/test-trees

What to Contribute

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 45)May include surrounding context.

md
**Path containment is enforced at runtime.** At startup, the trees directory is canonicalized via `fs.realpathSync()`. Every user-supplied `file` argument is stripped to its basename with `path.basename()` and then resolved inside the canonical trees directory. This means:

- Absolute paths like `/etc/passwd` are rejected (basename extraction produces `passwd`, which won't exist in trees dir).
- Relative traversal like `../../etc/shadow` is rejected (basename extraction produces `shadow`).
- Symlinks are resolved by `realpathSync` — a symlink inside the trees directory that points outside it would need to already exist on disk, which the script never creates.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 46)May include surrounding context.

md
**Path containment is enforced at runtime.** At startup, the trees directory is canonicalized via `fs.realpathSync()`. Every user-supplied `file` argument is stripped to its basename with `path.basename()` and then resolved inside the canonical trees directory. This means:

- Absolute paths like `/etc/passwd` are rejected (basename extraction produces `passwd`, which won't exist in trees dir).
- Relative traversal like `../../etc/shadow` is rejected (basename extraction produces `shadow`).
- Symlinks are resolved by `realpathSync` — a symlink inside the trees directory that points outside it would need to already exist on disk, which the script never creates.

The `resolveSafePath()` function additionally verifies the resolved path starts with the canonical trees directory prefix before any read or write occurs. If the check fails, the script exits with an error.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared purpose emphasizes local JSON tree recording, but the documented behavior also includes cross-tree search, global analysis, concept indexing, and regeneration of companion Markdown files across all trees. This mismatch matters because users may consent to lightweight note persistence without realizing the skill performs broader aggregation and secondary artifact creation, which expands the privacy and data-retention footprint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that the skill persistently records conversation structure to local JSON files and companion markdown files, but it does not provide a clear user-facing warning about retention, sensitivity of captured content, or consent. Even without network access, always-on local logging can expose sensitive prompts, decisions, and internal reasoning to other local users, backups, indexing tools, or later unintended access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Documenting the skill as active during every conversation by default materially increases privacy risk because users may not realize continuous recording is occurring across unrelated chats. In this skill's context, the danger is elevated by persistent storage, cross-tree analysis, and companion .md generation, which increase the amount of retained conversational metadata and the chance of secondary exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill uses environment-controlled behavior (TOPOLOGY_TREES_DIR) and runtime file operations but does not declare an explicit tool scope or permissions boundary. That makes the actual capability surface broader than what a reviewer can infer from metadata, increasing the risk of unintended file persistence or storage in sensitive locations if the host environment exposes permissive defaults.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation criteria are broad enough to trigger during many normal brainstorming or problem-solving conversations, and the skill is marked always: true. In context, that means conversation-derived summaries may be persisted automatically and repeatedly without a narrowly bounded trigger, creating an over-collection/privacy risk even if content length is truncated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill persistently stores conversation-derived data in the background, yet the user-facing description does not prominently warn that summaries, reasons, and concepts are auto-written to disk during ordinary use. This is a meaningful transparency failure because users may reveal sensitive information assuming a normal chat flow, not silent local logging and indexing.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
- Score 0.25-0.4 — ambiguous. Ask the user naturally: "This feels related to [topic] we explored on [date]. Continuing that thread, or fresh start?"
- Score < 0.25 — new tree

Never ask the user to pick a tree by ID. If you need to disambiguate, ask naturally in conversation.

## Setup

Static analysis

No suspicious patterns detected.