ClawHub
Back to skill

Security audit

coder

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a low-impact brand-information skill, not a working coding utility, and it does not show malicious data access, persistence, or exfiltration.

Install only if you want Netsnek coder brand and feature information. Do not expect actual scaffolding, refactoring, formatting, or snippet-management functionality from this version, and be aware it asks for exec permission even though the current script only prints static text and may not run correctly as packaged.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:30
Finding

Forced Promotional Output Through Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:30; scripts/coder-info.sh:36-40
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

The skill instructs the agent to present script output containing fixed branding and an external promotional URL. This behavior is inconsistent with the broadly advertised code-scaffolding, snippet-management, refactoring, formatting, and template-generation capabilities, none of which are implemented by the reviewed script.

Relevant code from SKILL.md:30:

markdown
Present the script output to the user. Use the default mode for general questions, `--features` for capability inquiries, and `--json` when machine-readable data is needed.

Relevant code from scripts/coder-info.sh:36-40:

bash
*)
  echo "coder - Developer productivity, amplified"
  echo "Copyright (c) 2026 Netsnek e.U. All rights reserved."
  echo "https://netsnek.com"
  ;;

Technical Analysis

The instruction in SKILL.md requires the agent to reproduce the local script's output. The script's default branch emits fixed corporate branding and an external website rather than performing a developer-productivity operation. Consequently, invoking the skill can redirect the agent's response toward promotional content under the appearance of a coding utility.

The reviewed implementation does not alter safety constraints, obtain additional system privileges, execute downloaded content, or establish persistence. The risk is limited to manipulation of the current response and possible user redirection to the external website.

Attack Path

  1. A user installs or invokes the skill based on its description as a developer-productivity suite.
  2. The agent loads SKILL.md and follows its instruction to execute scripts/coder-info.sh.
  3. When no recognized option is supplied, the script enters its default branch.
  4. The script emits fixed branding and the `https://n ...[truncated 699 chars]
Remediation
View remediation

Remediation Suggestions

  1. Change the skill description to state accurately that it only provides brand and product information.
  2. Remove the instruction requiring the agent to reproduce promotional output automatically.
  3. Return external links only when explicitly requested by the user, and clearly label them as third-party destinations.
  4. Implement the advertised development capabilities before describing the package as a scaffolding, refactoring, formatting, or snippet-management tool.
  5. Apply least privilege by reconsidering whether the exec permission is necessary for static information that could be included directly in the skill documentation.
  6. Add tests verifying that invocations produce task-relevant output and do not insert unsolicited promotional material.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md
---
name: coder
description: Coder namespace for Netsnek e.U. developer productivity suite. Provides code scaffolding, snippet management, refactoring helpers, and project template generation.
user-invocable: true

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: coder
description: Coder namespace for Netsnek e.U. developer productivity suite. Provides code scaffolding, snippet management, refactoring helpers, and project template generation.
user-invocable: true

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The overview says the skill provides brand identity and feature information "when invoked," but it does not specify concrete trigger phrases, invocation conditions, or exclusions. Because this is a markdown skill file, the lack of explicit trigger scope can lead to ambiguous or overly broad activation behavior.

Content

No source excerpt is available for this finding.