CementOps MSHA Compliance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:58 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for MSHA cement-plant safety compliance, but it needs Review because it uses an unsafe shell-style command pattern for user hazard text and requires blanket audit logging without privacy controls.

Before installing, require the skill to invoke check_stopwork.py with structured arguments or stdin rather than a rendered shell command, pin the installer version, and define a clear audit-log policy. Use the citation-defense material only for factual preparation, abatement documentation, and counsel-reviewed responses, not as a substitute for qualified safety or legal judgment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:53

Finding

Command Injection Risk Through Untrusted Hazard Description Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53-56
Vulnerability Type: Command injection through unsafe shell-command construction
Risk Level: High

Complete Vulnerable Code Snippet:

markdown

**Step 1:** Run the stop-work check FIRST, before any other analysis:

text

python3 /sandbox/skills/msha-compliance/check_stopwork.py "[hazard description]"

Technical Analysis

The documented command places an attacker-controlled hazard description directly inside a shell command. Double quotes do not safely neutralize embedded quote characters or shell metacharacters. If the agent executes this template through a shell, a crafted description can terminate the quoted argument and append an arbitrary command.

The Python script itself does not invoke a shell and safely reads its arguments from sys.argv. The vulnerability is in the skill instruction that tells the agent how to construct the invocation. Exploitability therefore depends on whether the agent's execution tool passes the rendered command through a shell. An argument-array invocation without a shell would not be vulnerable.

Attack Path

1. An attacker submits a hazard report containing a closing quote and shell syntax.

2. The skill directs the agent to substitute that report into the quoted command template.

3. The agent renders a command conceptually equivalent to:

   text

   python3 /sandbox/skills/msha-compliance/check_stopwork.py ""; ATTACKER_COMMAND; #"
   

4. If a shell interprets the rendered text, it runs ATTACKER_COMMAND after invoking the safety script.

5. The injected command executes with the same operating-system identity and sandbox permissions as the agent process.

Impact Assessment

Successful exploitation provides arbitrary command execution within the agent's execution environment. The attacker could read or modify files available to the agent, access environment variables and loca ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

• Do not build a shell command by interpolating the hazard description.

• Invoke the program with a structured argument array and disable shell interpretation. For example:

  python

  subprocess.run(
      ["python3", script_path, hazard_description],
      shell=False,
      check=True,
      capture_output=True,
      text=True,
  )
  

• Update SKILL.md to require a tool interface with separate executable and argument fields rather than displaying a textual shell command.

• Validate that script_path is a fixed, trusted path and is not derived from user input.

• Apply a reasonable maximum length to hazard descriptions to reduce resource-abuse risk.

• If the platform only exposes a shell interface, use a platform-maintained argument-escaping function and pass the description through a protected channel such as standard input. Do not implement ad hoc escaping.

• Add regression tests containing quotes, semicolons, command substitutions, newlines, and other shell metacharacters, verifying that they are delivered as one literal argument.

T08 · Insecure Dependencies

Warning

• Location: README.md:82

Finding

Mutable npm Package Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 82-86
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Complete Vulnerable Code Snippet:

markdown

Install from ClawHub:

```bash
npx clawhub@latest install cementops-msha-compliance

text

### Technical Analysis

The installation procedure uses `npx` with the mutable `latest` tag. `npx` can download and execute package code, while `latest` may resolve to a different release each time the command is run. Consequently, the code executed during installation is not fixed to the version reviewed in this audit.

A compromise of the upstream package, its maintainer account, publication pipeline, or registry metadata could turn the documented installation command into a supply-chain execution vector. An unintended incompatible upstream update could also alter installation behavior without changes to this repository.

No evidence was found that the current `clawhub` package is malicious. The vulnerability is the absence of version and integrity pinning for automatically executed third-party code.

### Attack Path

1. An attacker compromises the upstream package publisher, registry account, or release process.
2. The attacker publishes a malicious release and assigns it to the `latest` distribution tag.
3. A user follows the project's documented installation command.
4. `npx` resolves `clawhub@latest`, downloads the attacker-controlled release, and executes its CLI or associated lifecycle behavior.
5. The malicious package runs with the privileges of the user performing the installation.

### Impact Assessment

A compromised installer could read or modify any files accessible to the installing user, steal user-level credentials and tokens, modify agent configuration, install additional packages, or establish persistence where operating-system permissions permit.

If an administrator runs the installation command with elevated
...[truncated 193 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable tag with an audited exact version, for example:

  bash

  npx clawhub@1.2.3 install cementops-msha-compliance
  

• Publish and document the expected package integrity digest or signed release provenance.

• Prefer a package-manager workflow that verifies a committed lockfile and integrity metadata.

• Disable or carefully review lifecycle scripts where the installation workflow supports doing so.

• Document the trusted registry explicitly to reduce dependency-confusion and registry-substitution risks.

• Run installation as an unprivileged user in a restricted environment.

• Establish a release-review process so documented version pins are updated only after the new package has been audited.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:147

Finding

Mandatory Logging of All Interactions Lacks Privacy and Retention Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 147
Vulnerability Type: Excessive retention of potentially sensitive information
Risk Level: Low

Complete Vulnerable Code Snippet:

markdown

10. **Log every interaction.** Every observation, classification, and recommendation is part of the audit trail.

Technical Analysis

The skill instructs the agent to log every interaction without defining the logging destination, consent model, access restrictions, encryption requirements, retention period, deletion process, or redaction policy.

Hazard and compliance conversations can include worker identities, injury or medical details, operational weaknesses, incident descriptions, and legally sensitive citation-defense information. Requiring complete logging violates data-minimization principles and may cause sensitive content to be stored in whatever state or logging mechanism the host agent provides.

No logging implementation, remote logging endpoint, or confirmed exfiltration behavior was found in this project. The issue is therefore an insecure instruction and privacy-control deficiency rather than evidence of active data theft.

Attack Path

1. A worker or supervisor submits a report containing personal, medical, operational, or legal information.
2. The agent follows the instruction to log the entire interaction.
3. The host platform stores the conversation in an audit trail or persistent state without guaranteed redaction or retention limits.
4. A user, administrator, compromised account, later session, backup operator, or other party with access to those logs retrieves the sensitive information.

Impact Assessment

Exposure is limited to information users provide during interactions and information generated by the agent. Potential consequences include disclosure of employee medical information, identities of reporting workers, plant safety weaknesses, incident records, and citation- ...[truncated 222 chars]

Remediation

View remediation

Remediation Suggestions

• Replace blanket logging with an explicit, documented audit policy based on data minimization.
• Record only fields needed for safety accountability, such as timestamp, hazard category, stop-work decision, rule identifier, and remediation status.
• Redact worker names, contact information, medical details, credentials, and free-form sensitive content by default.
• Obtain appropriate notice or consent before retaining conversations.
• Define a fixed retention period and an auditable deletion procedure.
• Store logs locally or in an explicitly approved system using encryption in transit and at rest.
• Restrict access by role and maintain a separate access audit trail.
• Prohibit logs from being written into prompt memory or other state that can influence unrelated future sessions.
• Document applicable privacy, labor, medical-record, and legal-hold requirements before production deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code’s actual function is narrow and specific: it evaluates free-text hazard descriptions against predefined stop-work rules and outputs a stop-work decision. That aligns only partially with the declared description’s mention of stop-work authority and hazard classification. However, the declared purpose prominently describes a much broader compliance skill, including citation prevention, citation defense strategies, inspection walk-through prep checklists, and rebuttal letter drafting. None of those capabilities appear in the supplied code. There are no suspicious undeclared external accesses or unrelated triggers, but the primary purpose represented by the description is materially broader than the code delivered, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · check_stopwork.py (reported line 83)May include surrounding context.

python

# Fail-safe: if rules failed to load
    if rules_data.get("error"):
        return rules_data

    hazard_tokens = tokenize(hazard_description)
    triggered_rules = []

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · check_stopwork.py (reported line 222)May include surrounding context.

python

# Fail-safe: if rules failed to load
    if rules_data.get("error"):
        return rules_data

    hazard_tokens = tokenize(hazard_description)
    triggered_rules = []

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · citation-rules.json (reported line 84)May include surrounding context.

json

"keywords": ["height", "edge", "opening", "fall", "harness", "guardrail", "ladder", "scaffold", "railing", "handrail", "tie-off", "lanyard", "elevated", "platform", "drop"],
      "default_risk": 4,
      "common_citations": ["56.15005", "56.15020", "56.11001", "56.11002", "56.11027"],
      "cement_specific_notes": "Preheater towers (200-400 feet) are the highest fall hazard structures. Silo tops, kiln hood areas, and elevated conveyor galleries are also high-risk. Fall protection is needed above 6 feet without guardrails."
    },
    {
      "id": "ELEC",

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · hazard-taxonomy.json (reported line 49)May include surrounding context.

json

"keywords": ["height", "edge", "opening", "fall", "harness", "guardrail", "ladder", "scaffold", "railing", "handrail", "tie-off", "lanyard", "elevated", "platform", "drop"],
      "default_risk": 4,
      "common_citations": ["56.15005", "56.15020", "56.11001", "56.11002", "56.11027"],
      "cement_specific_notes": "Preheater towers (200-400 feet) are the highest fall hazard structures. Silo tops, kiln hood areas, and elevated conveyor galleries are also high-risk. Fall protection is needed above 6 feet without guardrails."
    },
    {
      "id": "ELEC",

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · stop-work-rules.json (reported line 198)May include surrounding context.

json

"keywords": ["cooler undergrate", "under the cooler", "undergrate entry", "cooler not cooled", "entered cooler without", "cooler still hot", "cooler not isolated", "clinker cooler entry"],
      "cfr_reference": "30 CFR 56.14100(a)",
      "severity": "imminent_danger",
      "message": "STOP WORK IMMEDIATELY. Personnel in clinker cooler undergrate area without full isolation and cooldown. Cooler undergrate temperatures can exceed 500C. Material can fall through grate plates without warning. EXIT IMMEDIATELY if safe to do so. Cooler must be fully shut down, cooled, locked out, and atmospherically tested before entry. Reference: 30 CFR 56.14100(a)."
    },
    {
      "id": "SW-025",

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which pulls and executes the latest published package at install time rather than a pinned, reviewed version. If the upstream package is compromised, typo-squatted, or a breaking/malicious release is published, users could execute untrusted code on their systems during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs the agent to read multiple local reference files and execute a local Python script, but it does not declare any explicit tool scope or permissions. This creates an authorization and review gap: deployers and users cannot clearly see what file access the skill expects, and an agent runtime may grant broader file-read capability than is necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to log every interaction establishes data retention behavior without any user-facing notice, consent, retention limit, or handling guidance. In a workplace safety and compliance setting, interactions may contain incident details, employee reports, operational weaknesses, or legal-sensitive material, so silent logging increases privacy, labor-relations, and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Mandating that every observation, classification, and recommendation be logged creates a built-in natural-language data retention channel for sensitive operational and personnel information. Because this skill handles hazards, incidents, compliance gaps, and possible citation-defense discussions, indiscriminate retention could expose evidence, personal data, or confidential safety reports if accessed by unauthorized parties or retained too long.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file embeds repeated 'defense_strategies' for nearly every MSHA citation scenario, which materially enables users to contest, downplay, or excuse safety violations rather than just identify and remediate hazards. In the context of a compliance skill that explicitly advertises 'citation defense strategies' and 'rebuttal letter drafting,' this goes beyond neutral reference material and can facilitate regulatory evasion or delay corrective action on dangerous conditions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file explicitly states that keywords are intentionally broad to minimize false negatives, but it provides no disambiguation logic, exclusions, or confidence thresholds. In a stop-work automation context, this can cause over-triggering on ambiguous user reports, producing unsafe workflow disruption, alert fatigue, or manipulated shutdowns via trivial phrasing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Keywords like 'fire', 'burning', 'smoke', and 'on fire' are extremely generic and can match figurative, historical, training, or low-context mentions rather than active emergencies. Because this skill issues immediate stop-work directives, ambiguous fire terms raise the risk of false emergency escalation and easy prompt-based triggering.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The instruction says that when a user says "walk-through" or "inspection," the skill should immediately offer audit prep. These terms are broad and can appear in ordinary conversation without clearly indicating the user intends to invoke inspection-preparation behavior, and no exclusion conditions or negative examples are provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.