ClawHub
Back to skill

Security audit

Justanote

Security checks for vulnerabilities and agentic risk

Overview

This notes skill is coherent, but it should be reviewed because its shell examples can be unsafe with crafted note paths or note content.

Review before installing. The skill is not deceptive and its notes behavior is disclosed, but it should be hardened to accept only normalized relative note paths, quote paths, pass search terms as data, and write note content through safe stdin or filesystem APIs. Avoid using it with untrusted note paths, search terms, titles, tags, or note bodies until those changes are made.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:56
Finding

Shell Command Injection Through Unsafely Interpolated Note Input

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:56-57 and SKILL.md:92-93
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash
grep -rn --include='*.md' -i 'SEARCH_TERM' $NOTES/
bash
echo -e "\n## New section\n\nContent to add" >> $NOTES/PATH_TO_NOTE.md

Technical Analysis

The documented shell templates place user-derived search terms and note content directly into shell command syntax. They do not define validation or a safe mechanism for passing these values as command arguments or standard input.

If an agent replaces SEARCH_TERM directly inside the single-quoted argument, an input containing a single quote can terminate the intended argument and introduce shell operators and commands. Likewise, note content placed directly inside the double-quoted echo argument can contain command substitutions such as $() or backticks, which the shell evaluates before invoking echo.

The vulnerability arises because shell quoting embedded in a command template is not a substitute for context-aware argument handling. User-controlled values must not be concatenated into executable shell syntax.

Attack Path

  1. An attacker asks the skill to search for a deliberately crafted search term or append deliberately crafted content.
  2. The agent substitutes the supplied value into the documented shell template.
  3. For search, the payload closes the single-quoted string and adds a shell operator followed by an attacker-selected command.
  4. For append, a command-substitution expression embedded in content is evaluated by the shell while constructing the echo argument.
  5. The injected command runs with the same operating-system privileges and environment access as the agent process.

Impact Assessment

Successful exploitation can execute arbitrary local commands with the privileges of the agent runtime. This may permit reading or modifying files accessible ...[truncated 250 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not construct shell commands by inserting user-controlled strings into command text.
  • Prefer a filesystem or process-execution API that accepts an argument array without invoking a shell.
  • If shell execution is unavoidable, pass the search term as a positional parameter and use an end-of-options marker, such as grep ... -- "$term" "$NOTES/".
  • Send note content through safely bound standard input rather than embedding it in an echo command.
  • Use printf '%s\n' "$content" instead of echo -e, while ensuring that content is supplied as data rather than inserted into generated shell source.
  • Treat all titles, tags, search terms, paths, and note bodies as untrusted input.
  • Add tests containing single quotes, semicolons, newlines, $(), backticks, redirection operators, and shell metacharacters to verify that they are handled only as literal data.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:68
Finding

Path Traversal Allows Note Operations Outside the Notes Root

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68-69, SKILL.md:76-87, and SKILL.md:92-93
Vulnerability Type: Path traversal and unrestricted filesystem access
Risk Level: High

Vulnerable Code

bash
cat $NOTES/PATH_TO_NOTE.md
bash
cat > $NOTES/SUBDIR/SLUG.md << 'EOF'
---
tags: [tag1, tag2]
created: YYYY-MM-DD
---

# Title

Content
EOF
bash
echo -e "\n## New section\n\nContent to add" >> $NOTES/PATH_TO_NOTE.md

Technical Analysis

The read, create, and append templates concatenate user-derived path components with the notes root without requiring canonicalization or containment validation. A value containing traversal components such as ../ may resolve to a file outside /home/node/.openclaw/workspace/notes/.

The path expressions are also unquoted. In addition to traversal, whitespace and shell wildcard characters can cause word splitting or pathname expansion, potentially selecting unintended files.

Merely prefixing a path with $NOTES/ does not enforce a filesystem boundary. The fully resolved path must be verified as a descendant of the canonical notes root. Symlinks inside the notes directory must also be considered because they can resolve to targets outside that root.

Attack Path

  1. An attacker asks the skill to read, create, or append to a note and supplies a path containing parent-directory components.
  2. The agent places that path into one of the documented command templates.
  3. The operating system resolves the combined path, including the traversal components or any encountered symbolic links.
  4. The resulting target falls outside the intended notes directory.
  5. A read operation discloses an accessible local file, while a create or append operation modifies an accessible file outside the skill's authorized storage area.

Impact Assessment

A successful read attack can disclose files readable by the agent account outs ...[truncated 345 chars]

Remediation
View remediation

Remediation Suggestions

  • Accept only normalized relative note paths; reject absolute paths, empty components, . components, and .. components.
  • Canonicalize both the notes root and candidate target, then verify that the target remains strictly beneath the canonical notes root.
  • Account for symbolic links by resolving existing path components and rejecting links whose resolved targets escape the root.
  • Quote every filesystem path used by a shell command, for example "$NOTES/$relative_path".
  • Prefer a filesystem API over shell commands and enforce root-relative path handling in one shared validation function.
  • Restrict note filenames to an explicit allowlist such as lowercase letters, digits, and hyphens, followed by .md.
  • For new files, use exclusive creation where appropriate to avoid unintentionally overwriting existing files.
  • Add tests for absolute paths, nested ../ sequences, whitespace, wildcard characters, symbolic-link escapes, and paths that share only a textual prefix with the notes root.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep