CementOps Environmental Compliance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.1.0

Overview

The skill is mostly coherent for cement-plant compliance guidance, but it needs review because it mandates a shell-style command with user-supplied text and contains questionable current regulatory guidance.

Install only after confirming your agent can run the checker without a shell, for example with an executable plus literal argument array or stdin. Pin the ClawHub installer version where possible, and verify all regulatory guidance against current federal rules, your permit, state requirements, and counsel, especially malfunction and SSM advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:126

Finding

User-Controlled Event Description Interpolated into a Shell Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:126-130
Vulnerability Type: Command injection through unsafe shell command construction
Risk Level: High

markdown

**Step 0 (BEFORE any other analysis):** Run the reporting obligation checker:

bash

python3 /sandbox/skills/cementops-environmental-compliance/check_reporting.py "[event description]"

Technical Analysis

The Skill directs the Agent to insert an event description derived from user input into a quoted shell command. Double quotes do not neutralize all shell syntax. If the Agent constructs this command as text and passes it to a shell, input containing command substitution, a closing quote, or other shell metacharacters can cause unintended command execution.

For example, an event description containing shell command-substitution syntax could be evaluated by the shell before check_reporting.py starts. The Python checker itself does not invoke a shell and safely reads the resulting sys.argv; the weakness is the command-construction pattern prescribed by SKILL.md.

Exploitability depends on whether the Agent's execution tool invokes a shell. An argument-array execution interface would avoid this issue, but the current instructions neither require such an interface nor define safe encoding.

Attack Path

1. An attacker submits a crafted environmental event description containing shell syntax.
2. The Agent follows the mandatory Step 0 instruction and substitutes the description into the documented command template.
3. The resulting command is submitted to a shell-based execution tool.
4. The shell interprets the injected syntax rather than treating the entire description as a literal argument.
5. The injected command executes with the privileges and filesystem access granted to the Agent's command runner.

Impact Assessment

Successful exploitation could provide arbitrary command execution within the Agent's runtime envi ...[truncated 401 chars]

Remediation

View remediation

Remediation Suggestions

1. Invoke the checker through an API that accepts an executable and argument array without launching a shell:

   text

   executable: python3
   arguments:
     - /sandbox/skills/cementops-environmental-compliance/check_reporting.py
     - EVENT_DESCRIPTION
   shell: false
   

2. Explicitly state in SKILL.md that the event description must be passed as one literal argument and that shell interpolation is prohibited.
3. If the execution environment cannot avoid a shell, send the description through standard input or a securely created input file instead of inserting it into command text.
4. Do not rely on simple quote replacement or character blocklists, because shell parsing has multiple expansion mechanisms and context-dependent escaping rules.
5. Add adversarial tests containing quotes, semicolons, command substitution, newlines, and redirection characters, verifying that they reach the Python process only as literal data.

T08 · Insecure Dependencies

Warning

• Location: README.md:43

Finding

Mutable Latest-Version Package Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:43-47
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

markdown

## Quick Start

Install from ClawHub:

```bash
npx clawhub@latest install cementops-environmental-compliance

text

### Technical Analysis

The Quick Start procedure uses `npx` to retrieve and execute the package referenced by the mutable `latest` tag. The command does not pin an audited package version or verify an expected integrity digest.

As a result, the code executed by this installation command can change after the Skill has been audited. Compromise of the upstream package, its publishing account, registry resolution, or a future release associated with `latest` could introduce arbitrary installation behavior.

This is a supply-chain exposure rather than evidence that the currently published package is malicious. No malicious dependency or remote payload was identified inside the audited project itself.

### Attack Path

1. An upstream publishing account, package, registry path, or release process is compromised, or an unsafe future release becomes the target of `latest`.
2. A user follows the documented Quick Start command.
3. `npx` resolves `clawhub@latest`, downloads it, and executes its entry point.
4. The changed package runs with the user's installation-process privileges.
5. Malicious installation behavior can access resources available to that process before or while installing the audited Skill.

### Impact Assessment

A compromised package could execute arbitrary code with the privileges of the user running `npx`. Depending on the environment, this may permit access to user files, modification of installed skills or development configuration, theft of credentials exposed to the process, installation of additional components, or outbound network communication.

The exact impact is constrained by the invoking user's permissions, containerization, ne
...[truncated 54 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable tag with an exact, reviewed package version:

   bash

   npx clawhub@X.Y.Z install cementops-environmental-compliance
   

2. Document the expected package provenance, registry, publisher identity, and integrity digest.
3. Use package-locking or an equivalent reproducible dependency mechanism where supported.
4. Run installation in a least-privileged, isolated environment without unrelated credentials or sensitive filesystem mounts.
5. Establish a release process using multifactor authentication, protected publishing credentials, signed artifacts, and automated dependency scanning.
6. Review and update the pinned version deliberately rather than allowing latest to change the executable dependency automatically.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · check_reporting.py (reported line 88)May include surrounding context.

python

# Fail-safe: if rules failed to load
    if rules_data.get("error"):
        return rules_data

    event_tokens = tokenize(event_description)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · check_reporting.py (reported line 293)May include surrounding context.

python

# Fail-safe: if rules failed to load
    if rules_data.get("error"):
        return rules_data

    event_tokens = tokenize(event_description)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file presents a malfunction affirmative defense as currently available under NESHAP Subpart LLL, but that legal position is likely outdated or invalid after court and EPA actions eliminating SSM exemptions and related defense provisions. In an environmental-compliance skill, inaccurate legal guidance can cause operators to rely on a nonexistent defense, underreport violations, delay corrective actions, or make noncompliant statements to regulators during enforcement matters.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version at install time rather than a pinned, reviewed release. If the upstream package is compromised, typosquatted, or a malicious update is published, users could execute attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs the agent to read multiple local reference files and explicitly to run a local script (check_reporting.py), but it does not declare any permissions or allowed-tools scope. That creates a hidden capability mismatch: a host may grant file access implicitly or inconsistently, and users/reviewers cannot reliably see what local resources the skill expects to access. In a security review, undeclared file-read requirements are dangerous because they reduce transparency and can enable broader-than-expected local file access if the runtime maps these instructions to generic file tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states a 2-day malfunction reporting requirement as though it is a current affirmative-defense element, which may be legally inaccurate and presented with undue certainty. Users may miss the actual notification timeline in their permit or applicable regulations, leading to late reporting, defective incident response, and avoidable enforcement exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON manifest file includes activation keywords such as "malfunction" and "breakdown" that are generic terms used in many everyday contexts. Without stronger contextual constraints or exclusion rules, the skill could be invoked for unrelated issues rather than true emissions malfunctions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Keywords like "enforcement action" and "compliance order" are broad and can refer to many legal, HR, security, or operational contexts unrelated to environmental reporting. The manifest does not provide scope limitations or exclusions to ensure these phrases only activate within the intended permit-compliance setting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill identifier cementops-environmental-compliance explicitly encodes an English-only locale via the -en- segment. In this manifest-style JSON, there is no accompanying language choice, opt-in mechanism, or documented region-specific justification, which creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.