ClawHub
Back to skill

Security audit

Python Assistant

Security checks for vulnerabilities and agentic risk

Overview

This Python helper is mostly coherent, but one documented refresh path can delete an arbitrary writable folder if the virtual-environment path is misused.

Review before installing. The skill is not showing deception or exfiltration, but only use its recreate command with a clearly project-local .venv path. Avoid passing absolute paths or parent directories to --venv, and prefer a version that validates the target before deleting anything.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/python_env_tool.py:37
Finding
Arbitrary Recursive Directory Deletion via User-Controlled Virtual Environment Path## Vulnerability Details **File Location**: `scripts/python_env_tool.py`, lines 37–40 **Vulnerability Type**: Unrestricted recursive deletion of a caller-controlled path **Risk Level**: High **Vulnerable Code**: ```python def cmd_bootstrap(args: argparse.Namespace) -> int: venv = Path(args.venv) if args.recreate and venv.exists(): shutil.rmtree(venv) if not venv.exists(): _run([sys.executable, "-m", "venv", str(venv)]) ``` The affected path is supplied through the unrestricted `--venv` argument at lines 91–92: ```python bootstrap.add_argument("--venv", default=".venv", help="venv path (default: .venv)") bootstrap.add_argument("--recreate", action="store_true", help="delete and recreate venv") ``` ### Technical Analysis The `bootstrap` command converts the caller-provided `--venv` value directly into a `Path`. If `--recreate` is present and that path exists, the program passes it to `shutil.rmtree()` without validating that: - The path is a virtual environment. - The path is inside the current project. - The resolved path is not the project root, user home, or another sensitive directory. - The path contains a virtual-environment marker such as `pyvenv.cfg`. - The user has explicitly confirmed the resolved deletion target. This creates a destructive path-manipulation vulnerability. An accidental argument or attacker-influenced Agent instruction can select any writable directory for recursive deletion. Argument-list execution in `_run()` prevents shell injection, but it does not mitigate the unsafe filesystem operation. ### Attack Path 1. An attacker-controlled task, prompt, automation input, or operator mistake influences the value passed to `--venv`. 2. The helper is invoked with both `--recreate` and a path to a valuable writable directory, for example: ```bash scripts/python_env_tool.py bootstrap --recreate --venv /path/to/writable/data ``` 3. `Path ...[truncated 833 chars]
Remediation
## Remediation Suggestions 1. Resolve and normalize both the project root and requested virtual-environment path before any deletion. 2. Require the deletion target to be a strict descendant of the project root; reject the project root itself and all paths outside it. 3. Reject filesystem roots, the current user's home directory, empty paths, `.` and other sensitive targets. 4. Before deletion, require a recognized virtual-environment marker such as `pyvenv.cfg` and verify the expected interpreter layout. 5. Consider restricting `--recreate` to a fixed project-local directory such as `.venv` rather than accepting arbitrary paths. 6. Display the resolved deletion target and require explicit confirmation for destructive operations, with a separate carefully named noninteractive override for trusted automation. 7. Refuse deletion when validation is ambiguous, including unexpected symlink or path-resolution conditions. 8. Add automated tests covering absolute paths, parent traversal, project-root selection, home-directory selection, filesystem roots, symlinks, and directories that are not virtual environments.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to run shell commands and environment-detection/install workflows, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a policy gap where an orchestrator may permit broader command execution than intended, increasing the chance of unauthorized installs, script execution, or environment modification if the skill is invoked in a sensitive context.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill enables implicit invocation but does not define a narrowly scoped trigger or constraint on when it should be auto-selected. This can cause the agent to invoke a Python-capable skill in broader contexts than intended, increasing the chance of unnecessary environment changes, dependency installation, or script execution based on ambiguous user input.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def _run(cmd: list[str], cwd: Path | None = None) -> None:
    subprocess.run(cmd, cwd=cwd, check=True)


def cmd_doctor(_: argparse.Namespace) -> int:
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.