ClawHub
Back to skill

Security audit

Improvement Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims at a high level, but it can send local skill content and evaluator failures to an external Claude CLI without a separate opt-in or clear data controls.

Install only if you are comfortable with this tool invoking the local Claude CLI and sending target SKILL.md excerpts plus evaluator failure details to that external model path. Use sanitized inputs, avoid secrets or private benchmark data in sources and traces, and require human review before applying generated prompt or SKILL.md changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
)

    try:
        result = subprocess.run(
            ["claude", "-p", "--output-format", "json"],
            input=prompt, capture_output=True, text=True, timeout=120,
        )
Confidence
92% confidence
Finding
The code launches an external `claude` subprocess and sends it prompt content built from local `SKILL.md` text and evaluator failure data. Even though it avoids `shell=True`, this still creates a real trust-boundary crossing: repository content and trace-derived data are exfiltrated to an external tool, and its output is later treated as structured change instructions for downstream use.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises and documents capabilities that read files, write artifacts, invoke shell commands, and reach an external LLM CLI, but it declares no permissions or trust boundaries. This creates a real security issue because operators and orchestrators cannot accurately constrain or review what the skill is allowed to do, increasing the chance of unintended data exposure, unsafe command execution, or policy bypass.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The description says the skill generates improvement candidates and is not for scoring or evaluation, but the documented behavior also ingests evaluator failure data, scans feedback traces, and calls an external `claude -p` service to synthesize fixes. That mismatch is dangerous because users may invoke the skill under a narrower trust model than its actual behavior, leading to unexpected transmission of sensitive traces or broader processing than intended.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest describes a candidate-proposal skill, but this function escalates into synthesizing a concrete SKILL.md fix via an external LLM. That mismatch expands capability and data exposure beyond the documented purpose, which can surprise operators and bypass policy assumptions about what the skill is allowed to do.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Spawning `claude` gives the skill an undeclared external execution/dependency capability not justified by the stated role of proposing improvements from local context. In security-sensitive environments, undeclared subprocess/network-adjacent behavior increases attack surface and can violate least-privilege expectations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The LLM prompt includes slices of `SKILL.md` and evaluator failure details without notice, consent, or redaction. If these files contain proprietary prompts, internal workflow details, or sensitive traces, the skill silently discloses them to an external processor.

Static analysis

No suspicious patterns detected.