ClawHub
Back to skill

Security audit

ts3

Security checks for vulnerabilities and agentic risk

Overview

The skill appears harmless at runtime, but it overstates its TypeScript framework functionality while requesting shell execution permission.

Review this before installing because it does not appear to deliver the framework capabilities it advertises. The bundled script is simple and non-destructive, but granting exec permission to a skill whose implementation is only a placeholder is unnecessary exposure unless you trust the publisher and only need the documented no-op commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill metadata and description claim a TypeScript server-side framework with HTTP scaffolding, middleware, validation, and structured logging, but the documented behavior only references a Bash script with a few CLI flags and no evidence of the advertised functionality. This kind of capability mismatch is dangerous because it can mislead users and automated systems into granting trust, permissions, or operational use under false assumptions, increasing the chance of unsafe execution or supply-chain style deception.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The manifest requests the "exec" permission even though the declared purpose is TypeScript server-side scaffolding, middleware composition, validation, and logging. Shell execution materially expands the attack surface because the skill can invoke arbitrary system commands, and this is especially risky when paired with a bundled shell script entry, making command execution available during normal skill use.

Static analysis

No suspicious patterns detected.