ClawHub
Back to skill

Security audit

Agent Hooks

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it installs persistent Claude Code hooks that can force the agent to continue, deny repeated tool calls, and run local diagnostics automatically.

Install only the specific hooks you need, preferably in a project-scoped configuration if available. Review the shell scripts first, avoid enabling Ralph for short or low-risk tasks, keep the cancel command handy, and replace or disable the npx-based TypeScript check unless it uses a pinned local dependency.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
scripts/ralph-stop-hook.sh:113
Finding

Active Ralph State Unconditionally Overrides Agent Termination

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
scripts/doubt-gate.sh:32
Finding

Broad Language Matching Blocks Legitimate Agent Completion

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
scripts/tool-error-advisor.sh:28
Finding

Failure Hooks Deny Tool Calls and Reflect Untrusted Error Text into Agent Context

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/post-edit-check.sh:33
Finding

Automatic Post-Edit Hook Executes Unpinned npx Package Resolution

Content
View full analysis
/dev/null && [ -f "$(dirname "$FILE")/tsconfig.json" ] || [ -f "tsconfig.json" ]; then TYPE=$(npx tsc --noEmit "$FILE" 2>&1 | grep -E 'error TS' | head -3) || true [ -n "$TYPE" ] && ERRORS="${ERRORS}tsc: ${TYPE}\n" fi ;; ``` ### Technical Analysis The post-edit hook automatically executes `npx tsc` after TypeScript edits. It does not use `--no-install`, does not invoke a verified project-local binary directly, and does not specify or validate a package version. Depending on the installed npm/npx version and configuration, `npx` can resolve an executable from the project, cache, or npm registry. This allows code outside the reviewed Skill package to be selected and executed during an ordinary edit event. The command name `tsc` is also ambiguous when TypeScript is not installed locally. The hook does not verify that the resolved executable belongs to the expected locked `typescript` dependency. Additionally, shell operator precedence evaluates the condition as: ```text (command -v npx AND adjacent tsconfig exists) OR current-directory tsconfig exists ``` Therefore, a current-directory `tsconfig.json` can make the condition true independently of the intended `command -v npx` check. ### Attack Path 1. The post-edit hook is registered for Write or Edit operations. 2. A TypeScript file is edited while a matching `tsconfig.json` exists. 3. The hook automatically invokes `npx tsc`. 4. If an expected local executable is unavailable or resolution is manipulated, npx may consult its cache or configured package registry. 5. A resolved package executable runs with the same user privileges and environment as the hook. 6. Malicious or compromised dependency code could access files and credentials available to that user or modi ...[truncated 816 chars]
Remediation
View remediation
&1 | grep -E 'error TS' | head -3) || true fi ``` 2. If `npx` must be supported, prohibit installation and remote resolution: ```bash npx --no-install tsc --noEmit "$FILE" ``` 3. Require `typescript` to be declared and pinned through the project's package manifest and lockfile. 4. Verify that the selected executable resolves under the expected project `node_modules` directory. 5. Do not run package installation or registry resolution from an automatic edit hook. 6. Correct the conditional grouping: ```bash if command -v npx &>/dev/null && { [ -f "$(dirname "$FILE")/tsconfig.json" ] || [ -f "tsconfig.json" ]; }; then ``` 7. Run diagnostics with a minimal environment and without unnecessary credentials. 8. Add an execution timeout to prevent a diagnostic hook from hanging. 9. Document that only preinstalled, lockfile-controlled diagnostic tools are permitted. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill instructs users to modify ~/.claude/settings.json, which is a sensitive agent configuration file controlling hook execution. Changes there can persistently alter agent behavior and enable automatic shell execution on future sessions, so guidance touching that path carries significant security risk if not tightly scoped and reviewed.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

安装

将需要的 hook 加入 ~/.claude/settings.json：

json
{

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_doubt_gate.py (reported line 15)May include surrounding context.

python
@pytest.fixture
def env(tmp_path):
    e = os.environ.copy()
    e["HOME"] = str(tmp_path)
    sessions = tmp_path / ".openclaw" / "shared-context" / "sessions"
    sessions.mkdir(parents=True)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_ralph.py (reported line 16)May include surrounding context.

python
@pytest.fixture
def env(tmp_path):
    e = os.environ.copy()
    e["HOME"] = str(tmp_path)
    sessions = tmp_path / ".openclaw" / "shared-context" / "sessions"
    sessions.mkdir(parents=True)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_tool_error.py (reported line 15)May include surrounding context.

python
@pytest.fixture
def env(tmp_path):
    e = os.environ.copy()
    e["HOME"] = str(tmp_path)
    sessions = tmp_path / ".openclaw" / "shared-context" / "sessions"
    sessions.mkdir(parents=True)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill documents shell scripts that read environment variables, read and write files, and are installed as executable hooks, but it does not declare any explicit tool scope or permission boundaries. That omission increases the chance of over-broad execution in environments that rely on metadata for least-privilege review, making the effective capability set less visible to users and reviewers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad phrases like 'persistent execution', 'speculative', 'hook scripts', and mixed-language short phrases that could match ordinary conversation. That can cause unintended invocation of a skill that installs or recommends shell-based hooks affecting stop behavior and tool execution, which is more dangerous than an accidental invocation of a read-only informational skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all instructions and operational guidance exclusively in Chinese, with no opt-in, alternative language, or explanation that the skill is region-specific. That can violate a language/locale policy requiring user choice or documented justification rather than silently forcing one language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section recommends using PreToolUse updatedInput to directly rewrite tool commands, which changes what will execute without requiring the user or model to explicitly approve the modified action. In a hook system, that creates a command-integrity problem: a benign retry guard can silently transform intended operations into different package installs or shell commands with materially different security consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The markdown explicitly describes direct command rewriting via updatedInput and gives an example that substitutes a failed build command with a package install plus alternate build command, without any warning or approval step. This is dangerous because the hook can cause execution of commands the operator did not request, including dependency installation or arbitrary shell actions, undermining trust boundaries and making abuse or accidental unsafe execution more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document extends a retry-mitigation hook into persistent auto-memory storage of errors and resolutions across sessions. Persisting failure details and derived fixes can unintentionally retain sensitive command output, paths, credentials, or project-specific context, creating a privacy and cross-session data exposure risk if retention, scoping, and sanitization are not tightly controlled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document’s instructional content and headings are written in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This is a natural-language locale policy concern because it imposes a language requirement implicitly rather than through user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire skill description and user-facing block reason are written in Chinese, while the hook also matches both English and Chinese hedging terms. There is no indication that the skill is region-specific or that users can opt into a preferred language, which creates a language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s instructional content is entirely in Chinese, including the title and all explanatory sections, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This creates a natural-language policy concern because it effectively imposes a locale/language choice on users without opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The hook invokes npx tsc without pinning a specific package/version, which can cause npx to resolve and execute an unexpected TypeScript compiler version from the network or local environment. In an automatic PostToolUse hook, this increases supply-chain risk because the command may run repeatedly and implicitly in developer environments without explicit review.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_doubt_gate.py (reported line 25)May include surrounding context.

python
def run_doubt_gate(env, last_msg="", session_id="test-sess"):
    env["NC_SESSION"] = session_id
    inp = json.dumps({"last_assistant_message": last_msg})
    result = subprocess.run(
        ["bash", str(SCRIPTS_DIR / "doubt-gate.sh")],
        capture_output=True, text=True, env=env, input=inp, timeout=10,
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_doubt_gate.py (reported line 74)May include surrounding context.

python
e.pop("NC_SESSION", None)
        e["NC_SESSION"] = ""
        inp = json.dumps({"last_assistant_message": "I think maybe this works"})
        result = subprocess.run(
            ["bash", str(SCRIPTS_DIR / "doubt-gate.sh")],
            capture_output=True, text=True, env=e, input=inp, timeout=10,
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_post_edit_check.py (reported line 22)May include surrounding context.

python
"tool_input": tool_input,
        "hook_event_name": "PostToolUse",
    })
    result = subprocess.run(
        ["bash", str(SCRIPTS_DIR / "post-edit-check.sh")],
        capture_output=True, text=True, input=inp, timeout=10,
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_ralph.py (reported line 29)May include surrounding context.

python
cmd = ["bash", str(SCRIPTS_DIR / script_name)]
    if args:
        cmd.extend(args)
    result = subprocess.run(
        cmd, capture_output=True, text=True, env=env,
        input=stdin_data, timeout=10,
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_tool_error.py (reported line 24)May include surrounding context.

python
def run(script, env, stdin_data="", session_id="test-sess"):
    env["NC_SESSION"] = session_id
    result = subprocess.run(
        ["bash", str(SCRIPTS_DIR / script)],
        capture_output=True, text=True, env=env, input=stdin_data, timeout=10,
    )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file presents core descriptive content and trigger phrases in both Chinese and English, including locale-specific phrases like "不要停" and Chinese operational guidance, but does not state whether users can choose their preferred language. This can create a language/locale policy concern if the skill implicitly assumes bilingual comprehension without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language instructions and operational guidance are presented exclusively in Chinese, with no indication that language choice is optional or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in is a locale-policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The hook removes cancel.json via rm -f in both the active-cancel and expired-cancel paths. Although the behavior is commented for maintainers, there is no user-facing disclosure, confirmation, or visible runtime notice for this file deletion within the script.

Content

No source excerpt is available for this finding.