ClawHub
Back to skill

Security audit

Scripting Utils

Security checks for vulnerabilities and agentic risk

Overview

This broad scripting helper is not clearly malicious, but it can run user-supplied code during validation and generate privileged system commands without enough safeguards or disclosure.

Install only if you are prepared to treat it as a code-execution and system-administration helper, not a passive syntax checker. Run validation only on trusted files or inside a disposable sandbox, review generated system commands manually, do not run them with elevated privileges unless every argument is trusted, and avoid using paste or WebSearch-related examples with secrets or private code.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/language_validator.py:22
Finding

Untrusted Tcl and Compile-Time Code Execution During Script Validation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/system_manager.py:16
Finding

Shell Command Injection in Generated Privileged System-Management Commands

Content
View full analysis
str: """Get the command for an action.""" cmd_template = self.COMMANDS.get(action) if not cmd_template: raise ValueError(f"Unknown action: {action}") if self.os == "ubuntu": cmd = cmd_template.ubuntu else: cmd = cmd_template.centos return cmd.format(**kwargs) ``` ```python if args.package: kwargs["package"] = manager.get_package_name(ar ...[truncated 3547 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (53)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill presents itself as a universal scripting utility, but the finding indicates the actual behavior is narrower and centered on command generation or limited validation. In the context of an agent ecosystem, overstated capabilities are risky because they can expand when and how often the skill is invoked, exposing users to unintended system or shell operations under an inaccurate trust model.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill presents itself as a universal scripting utility, but the finding indicates the actual behavior is narrower and centered on command generation or limited validation. In the context of an agent ecosystem, overstated capabilities are risky because they can expand when and how often the skill is invoked, exposing users to unintended system or shell operations under an inaccurate trust model.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill presents itself as a universal scripting utility, but the finding indicates the actual behavior is narrower and centered on command generation or limited validation. In the context of an agent ecosystem, overstated capabilities are risky because they can expand when and how often the skill is invoked, exposing users to unintended system or shell operations under an inaccurate trust model.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/eggdrop/firstscript.html (reported line 214)May include surrounding context.

html
<span class="p">}</span>
</pre></div>
</div>
<p>Here, we’re going to check if pmsg is true (any value that is not 0) and, if yes, send a private message to the user. If pmsg is not true (it is 0), then we will send the message to the channel. You can see that the first putserv message sends a PRIVMSG message to $nick - this is the nickname of the user that joined, and that Eggdrop stored for us in the first variable of the proc, which we called ‘nick’. The second putserv message will send a PRIVMSG message to the $chan - this is the channel the user joined, and that Eggdrop stored for us in the fourth variable of the proc, which we called ‘chan’.</p>
<p>And finally: get the credit you deserve when the script loads!:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">putlog</span> <span class="s2">&quot;greetscript.tcl v1.0 by Geo&quot;</span>
</pre></div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Applets.md (reported line 3)May include surrounding context.

md
# Applets

<!-- md-toc-begin -->
* [About](#about)
* [Creating applets](#creating-applets)
* [Documentation for built-in applets](#documentation-for-built-in-applets)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation explicitly advertises arbitrary user-supplied code execution across many languages, unrestricted system calls, and read/write filesystem access inside a VM. Even with VM isolation and no network, this is materially broader than a normal scripting-helper skill and creates a dangerous execution surface that can enable sandbox escape attempts, local data disclosure within the sandbox, and abusive compute usage.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Applets.md (reported line 170)May include surrounding context.

md
<pragma-> cc int x = 5, y = 16; x ^= y, y ^= x, x ^= y;
       <PBot> pragma-:  no output: x = 16; y = 5

<!-- -->

    <pragma-> cc #include <sys/utsname.h> struct utsname u; uname(&u);
       <PBot> pragma-:  no output: u = {sysname = "Linux", nodename = "compiler", release = "3.2.0-8-generic", version = "#15-Ubuntu SMP Wed Jan 11 13:57:44 UTC 2012", machine = "x86_64",  __domainname = "(none)"}

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Applets.md (reported line 316)May include surrounding context.

md
<Wulf> cc printf("%b", 1234567);
    <PBot> 000100101101011010000111

<!-- -->

    <Wulf> cc printf("%#'b", 1234567);
    <PBot> 0001.0010.1101.0110.1000.0111

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Applets.md (reported line 462)May include surrounding context.

md
<pragma-> cc int i = 0, last = 1; while(i <= 7000) { printf("%d ", i); i += last; last = i - last; }
       <PBot> pragma-: 0 1 1 2 3 5 8 13 21 34 55 89 144 233 377 610 987 1597 2584 4181 6765

<!-- -->

    <Icewing> cc int n=0, f[2]={0,1}; while(n<20) printf("%d ",f[++n&1]=f[0]+f[1]); // based on cehteh
       <PBot> Icewing: 1 1 2 3 5 8 13 21 34 55 89 144 233 377 610 987 1597 2584 4181 6765

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Applets.md (reported line 651)May include surrounding context.

md
<pragma-> c99 pointer value -list
        <PBot> Sections containing 'pointer value': 5.1.2.2.1p2, 5.1.2.3p9, 6.2.5p20, 6.2.5p27, 6.3.2.1p3, 6.3.2.1p4, 6.3.2.3p2, 6.3.2.3p6, 6.5.2.1p3, 6.5.2.2p5, 6.5.2.2p6, 6.5.2.4p1, 6.5.2.4p2, 6.5.3.1p1, 6.5.3.2p3, 6.5.3.2p4, 6.5.3.3p5, 6.5.3.4p5, 6.5.6p8, 6.5.6p9, 6.5.8p5, 6.5.15p6, 6.6p7, 6.6p9, 6.7.2.2p5, 6.7.2.3p7, 6.7.2.3p3, 6.7.5.1p3, 6.7.5.2p7, 7.1.1p1, 7.1.1p4, 7.1.4p1, 7... truncated; see http://codepad.org/qQlnJYJk for full text.

<!-- -->

    <pragma-> Hmm, how about just section 6.3?
    <pragma-> c99 pointer value 6.3

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Applets.md (reported line 715)May include surrounding context.

md
<pragma-> dict hit
       <PBot> hit: n: 1) (baseball) a successful stroke in an athletic contest (especially in baseball); "he came all the way around on Williams' hit", 2) the act of contacting one thing with another; "repeated hitting raised a large bruise"; "after three misses she finally got a hit" [syn: hitting, striking], 3) a conspicuous success; "that song was his first hit and marked the beginning of his career"; "that new Broadway show is a real smasher"

<!-- -->

    <pragma-> dict -n 4 hit
       <PBot> hit: n: 4) (physics) an brief event in which two or more bodies come together; "the collision of the particles resulted in an exchange of energy and a change of direction" [syn: collision], 5) a dose of a narcotic drug, 6) a murder carried out by an underworld syndicate; "it has all the earmarks of a Mafia hit", 7) a connection made via the internet to another website; "WordNet gets many hits from users worldwide"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Applets.md (reported line 725)May include surrounding context.

md
<pragma-> dict -t v hit
       <PBot> hit: v: 1) cause to move by striking; "hit a ball", 2) hit against; come into sudden contact with; "The car hit a tree"; "He struck the table with his elbow" [syn: strike, impinge on, run into, collide with] [ant: miss], 3) affect or afflict suddenly, usually adversely; "We were hit by really bad weather"; "He was stricken with cancer when he was still a teenager"; "The earstruck at midnight" [syn: strike], 4) deal a blow to

<!-- -->

    <pragma-> dict -search ball hit
       <PBot> hit: n: 1) (baseball) a successful stroke in an athletic contest (especially in baseball); "he came all the way around on Williams' hit", v: 1) cause to move by striking; "hit a ball"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/pbot/Commands.md (reported line 4)May include surrounding context.

md
# Commands

<!-- md-toc-begin -->
* [Command interpreter](#command-interpreter)
  * [Command invocation](#command-invocation)
  * [Addressing output to users](#addressing-output-to-users)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/powershell/about.html (reported line 21)May include surrounding context.

html
<meta name="description" content="About topics cover a range of concepts about PowerShell." />
			<link rel="canonical" href="https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about?view=powershell-7.6" /> 

			<!-- Non-customizable open graph and sharing-related metadata -->
			<meta name="twitter:card" content="summary" />
			<meta name="twitter:site" content="@MicrosoftLearn" />
			<meta property="og:type" content="website" />

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/powershell/about.html (reported line 138)May include surrounding context.

html
<script src="https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js"></script>
			<script src="/_themes/docs.theme/master/en-us/_themes/global/deprecation.js"></script>

			<!-- msdocs global object -->
			<script id="msdocs-script">
		var msDocs = {
  "environment": {

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/powershell/about.html (reported line 197)May include surrounding context.

html
<script src="/static/assets/0.4.03391.7726-67491f8e/scripts/en-us/index-docs.js"></script>
			

			<!-- json-ld -->
			
		</head>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/raku/index.html (reported line 220)May include surrounding context.

html
</div>
</nav>

<div id="wrapper"> <section class="hero is-medium is-primary"> <div class="hero-body"> <div class="container"> <h1 class="title is-1 is-size-2-mobile has-text-centered"> Raku documentation </h1> <h2 class="subtitle is-4 has-text-centered mt-3"> Welcome to the official documentation of the Raku<sup>®</sup> programming language! </h2> </div> </div> </section> <section class="section"> <div class="container px-4"> <div class="columns is-multiline"> <!-- Card --> <div class="column is-one-half"> <div class="card card-home"> <div class="card-content"> <div class="has-text-centered"> <a href="/introduction"> <span class="icon is-large has-text-primary"> <i class="fas fa-graduation-cap icon-large"></i> </span> </a> </div> <div class="content has-text-centered"> <p class="title is-5 has-text-primary"><a href="/introduction">Getting started, Migration guides from other languages, &amp; Tutorials</a></p> </div> <div class="content has-text-centered"> Documents introducing the language for various audiences. </div> <div class="has-text-centered"> <a class="button is-primary" href="/introduction"> <strong>Learn more</strong> </a> </div> </div> </div> </div> <div class="column is-one-half"> <div class="card card-home"> <div class="card-content"> <div class="has-text-centered"> <a href="/reference"> <span class="icon is-large has-text-primary"> <i class="fas fa-book icon-large"></i> </span> </a> </div> <div class="content has-text-centered"> <p class="title is-5 has-text-primary"><a href="/reference">Language References</a></p> </div> <div class="content has-text-centered"> Documents explaining the various conceptual parts of the language. </div> <div class="has-text-centered"> <a class="button is-primary" href="/reference"> <strong>Learn more</strong> </a> </div> </div> </div> </div> <div class="column is-one-third"> <div class="card card-home"> <div class="card-content"> <div class="has-text-centered"> <a href="/types"> <span class="icon is-large has-text-primary
...[truncated 26 chars]

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/tcl/index.html (reported line 31)May include surrounding context.

html
<DIV style="border-top: 2px solid #3163CE; width: 780px"></DIV>
<table border="0" cellpadding="2" cellspacing="0" width="780">
	    <tr><td align="left" valign="middle">
<!-- SiteSearch Google -->
	<div style="display:table-cell; vertical-align:middle; margin:0px">
<FORM method="GET" action="https://www.google.com/search">
<A HREF="https://www.google.com/"><IMG src="/images/Search.gif" border="0"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The code constructs shell commands by formatting user-controlled parameters such as package, service, port, proto, and username directly into command strings. If the commented subprocess.run(cmd, shell=True) is enabled, an attacker could inject shell metacharacters and execute arbitrary commands with the privileges of the process, which is especially dangerous in a system-management tool likely to run with elevated rights.

Content

Scanner excerpt · scripts/system_manager.py (reported line 178)May include surrounding context.

python
print(cmd)
    else:
        print(f"Executing: {cmd}")
        # subprocess.run(cmd, shell=True)  # Uncomment to actually execute


if __name__ == "__main__":

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill advertises capabilities that imply shell execution and file access, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because consumers may invoke the skill without understanding that it could read files or run system commands, increasing the chance of over-privileged use and unsafe agent behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description uses an overly broad scope for scripting tasks, which can cause an agent to invoke it in many contexts beyond its safe or intended use. This is dangerous because broad routing increases exposure to sensitive inputs, shell-adjacent tasks, and privileged environments without adequate narrowing or safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown advertises system-management and WebSearch-related capabilities without warning about potential host or network effects. In this context, that omission is dangerous because users and calling agents may assume the skill is passive validation-only, when the claimed feature set suggests possible package installation, service manipulation, or outbound lookups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation encourages execution of arbitrary code with filesystem access and says 'anything goes' without prominently warning users about the security and data-handling implications. Even in a VM, users may wrongly assume safety and submit sensitive code or data, and reviewers may underestimate the need for strict isolation and abuse controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The '-paste' option sends code and output to an external paste site, but the documentation does not warn that source code, program output, or embedded secrets may be published to a third party. This can cause unintentional disclosure of proprietary code, credentials, or sensitive runtime data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented gdb() capability allows debugger commands that can reveal process, stack, frame, macro, and environment details from the execution context. Without warnings and command restrictions, this increases disclosure risk and may help attackers probe sandbox internals or identify escape primitives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.