ClawHub
Back to skill

Security audit

Agent Factory

Security checks for vulnerabilities and agentic risk

Overview

The skill's sub-agent setup purpose is clear, but its bundled setup script can write outside the intended agents folder if given a crafted agent name.

Review before installing or running this skill. Only run scripts/create_agent.sh with trusted, simple agent names such as letters, numbers, underscores, or hyphens, and avoid using it in directories where unintended file creation or overwrite would matter. The package does not show hidden network access or malicious behavior, but the setup script should be fixed to validate names and refuse writes outside the agents directory.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/create_agent.sh:4
Finding

Path Traversal and Arbitrary SKILL.md File Overwrite via Unvalidated Agent Name

Content
View full analysis

Vulnerability Details

File Location: scripts/create_agent.sh, lines 4–17
Vulnerability Type: Path traversal and unsafe file creation
Risk Level: Medium

bash
NAME=$1
ROLE=$2
DIR="agents/$NAME"

mkdir -p "$DIR/inbox" "$DIR/outbox" "$DIR/workspace"

cat <<EOM > "$DIR/SKILL.md"
---
name: $NAME
description: $ROLE
---
# Mission
You are $NAME. Your role is: $ROLE.
Read instructions from ./inbox and write outputs to ./outbox.
EOM

Technical Analysis

The first command-line argument is used directly as part of a filesystem path without validation or canonical-path containment checks. Although quoting prevents shell word splitting and direct shell metacharacter injection, it does not prevent path components such as ../.

An attacker able to invoke the script can therefore cause DIR to resolve outside the intended agents/ directory. The script creates directories at the resulting location and writes or truncates a file named SKILL.md. The output redirection also follows an existing symbolic link, so a pre-positioned SKILL.md symlink can redirect the write to another file accessible to the invoking user.

Attack Path

  1. The attacker obtains the ability to invoke scripts/create_agent.sh and supply its arguments.

  2. The attacker provides an agent name containing traversal components, for example:

    bash
    ./scripts/create_agent.sh "../../attacker-controlled-location" "Injected role"

  3. The generated path becomes agents/../../attacker-controlled-location.

  4. The script creates inbox, outbox, and workspace directories outside the intended agents/ root.

  5. The script creates or truncates attacker-controlled-location/SKILL.md using attacker-controlled name and role content.

  6. If the attacker can pre-create SKILL.md as a symbolic link, the redirection follows that link and overwrites its writable target.

Impact Assessment

Exploitation u ...[truncated 692 chars]

Remediation
View remediation

Remediation Suggestions

  • Require both arguments and terminate on missing or invalid input.
  • Restrict agent names to a safe identifier format, such as ^[A-Za-z0-9_-]+$.
  • Construct the destination from a fixed absolute agents root.
  • Canonicalize the destination and verify that it remains strictly beneath the intended root before creating anything.
  • Reject existing destination files and symbolic links rather than following or overwriting them.
  • Use safe exclusive file creation when replacing an existing SKILL.md is not required.
  • Enable defensive shell behavior with set -euo pipefail.
  • Consider validating or safely encoding NAME and ROLE before embedding them in YAML and agent instructions.

Example validation:

bash
#!/usr/bin/env bash
set -euo pipefail

if [[ $# -ne 2 ]]; then
    echo "Usage: $0 AGENT_NAME ROLE_DESCRIPTION" >&amp;2
    exit 2
fi

NAME=$1
ROLE=$2

if [[ ! "$NAME" =~ ^[A-Za-z0-9_-]+$ ]]; then
    echo "Invalid agent name" >&amp;2
    exit 2
fi

ROOT="$(pwd -P)/agents"
DIR="$ROOT/$NAME"

mkdir -p -- "$ROOT"
if [[ -e "$DIR/SKILL.md" || -L "$DIR/SKILL.md" ]]; then
    echo "Refusing to overwrite an existing SKILL.md" >&amp;2
    exit 1
fi

mkdir -p -- "$DIR/inbox" "$DIR/outbox" "$DIR/workspace"

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.