ClawHub
Back to skill

Security audit

git-sync

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real publishing tool, but it needs review because some release paths can execute injected commands and it changes local Git credential settings.

Install only if you understand it as a high-authority release automation tool. Do not run it on untrusted skills or agents until the ClawHub shell command and generated PyPI setup.py injection issues are fixed, and review its Git credential-helper changes before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/git-sync.py:1373
Finding

Shell Command Injection Through ClawHub Package Metadata

Content
View full analysis

Vulnerability Details

File Location: scripts/git-sync.py:1373-1381
Vulnerability Type: Shell command injection
Risk Level: High

Complete Code Snippet

python
def step_clawhub_publish(name: str, version: str):
    # v2.37.0 多仓库：skill 仓库根下直接是技能目录
    sd = get_work_repo("skill") / name
    if not sd.is_dir(): print("  ❌ 技能目录不存在"); return
    meta = json.loads((sd/"_meta.json").read_text(encoding="utf-8"))
    slug = meta.get("slug",name)
    cmd = f'npx clawhub publish "{sd}" --slug "{slug}" --name "{meta.get("displayName",name)}" --version "{version}" --changelog "v{version}"'
    if meta.get("tags"):
        cmd += ' --tags "' + ",".join(meta["tags"]) + '"'
    r = subprocess.run(cmd, capture_output=True, text=True, shell=True)
    if r.returncode==0 or "ok" in r.stdout.lower(): print(f"  ✅ ClawHub: {slug}")
    else: print(f"  ⚠️  ClawHub: {(r.stdout+r.stderr)[-300:]}")

Technical Analysis

The publishing function reads slug, displayName, and tags from the target skill's _meta.json. These fields are interpolated directly into a single command string. The resulting string is then passed to subprocess.run() with shell=True.

Double-quoting the fields does not prevent command injection. A metadata value can contain an embedded quote, shell substitution, command separator, or another shell metacharacter that terminates or alters the intended argument. No character allowlist, escaping routine, or type validation is applied before shell interpretation.

The project contains a safer implementation in scripts/clawhub_publish.py, which constructs an argument list and does not enable shell=True; however, the main workflow calls the vulnerable step_clawhub_publish() implementation in scripts/git-sync.py.

The vulnerable function is reachable through ordinary skill publishing. It is invoked in --market-only mode and after a normal synchronization unless --skip-market is specified.

Attack Path

  1. A third-party ...[truncated 1803 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove shell=True and construct the command as an argument list:
python
cmd = [
    "npx", "clawhub", "publish", str(sd),
    "--slug", slug,
    "--name", display_name,
    "--version", version,
    "--changelog", f"v{version}",
]
if tags:
    cmd.extend(["--tags", ",".join(tags)])

subprocess.run(cmd, capture_output=True, text=True, check=False)
  1. Reuse the argument-list implementation already present in scripts/clawhub_publish.py rather than maintaining a separate shell-based implementation.
  2. Validate metadata before use:
    • Require slug, displayName, and version to be strings.
    • Require tags to be a list of strings.
    • Apply a restrictive allowlist to fields such as slug and version.
    • Reject control characters and malformed metadata.
  3. Keep shell execution disabled even after validation. Validation should be defense in depth, not the primary command-injection control.
  4. Add regression tests using embedded quotes, command separators, command substitutions, newlines, and platform-specific shell metacharacters.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/git-sync.py:1268
Finding

Python Code Injection Through Generated PyPI Build Metadata

Content
View full analysis

Vulnerability Details

File Location: scripts/git-sync.py:1268-1275, 1295-1343
Vulnerability Type: Generated Python source injection
Risk Level: High

Complete Code Snippet

python
AUTHOR_STR, AUTHOR_EMAIL = "", ""
try:
    import tomllib as _toml
    _pp = src_dir / "pyproject.toml"
    if _pp.exists():
        _auth = (_toml.loads(_pp.read_text(encoding="utf-8")).get("project", {}) or {}).get("authors") or []
        if _auth:
            AUTHOR_STR = (_auth[0] or {}).get("name", "") or ""
            AUTHOR_EMAIL = (_auth[0] or {}).get("email", "") or ""
except Exception:
    pass

The resulting values are inserted into executable Python source:

python
_P(str(build_dir / "setup.py")).write_text(textwrap.dedent(f'''\
import os, re
from setuptools import setup
BS=chr(92)
init_p=os.path.join(os.path.dirname(__file__),"{pkg_dir}","__init__.py")
V="{pypi_ver}"
if os.path.exists(init_p):
    with open(init_p) as f:
        for l in f:
            if l.startswith("__version__"): V=l.split('"')[1]; break
req_p=os.path.join(os.path.dirname(__file__),"requirements.txt")
REQ=[]
if os.path.exists(req_p):
    with open(req_p) as f: REQ=[l.strip() for l in f if l.strip() and not l.startswith("#")]
    REQ=[r for r in REQ if not r.startswith("langchain")]
readme_p=os.path.join(os.path.dirname(__file__),"README.md")
LD="{name}"
if os.path.exists(readme_p):
    with open(readme_p,encoding="utf-8") as f: LD=f.read()
# 粘合当前版本的 CHANGELOG 区块到 long_description（更新说明）
changelog_p=os.path.join(os.path.dirname(__file__),"CHANGELOG.md")
if os.path.exists(changelog_p):
    with open(changelog_p,encoding="utf-8") as f: _cl=f.read()
    _esc=re.escape(V)
    _m=re.search(r"##{BS}s*\[?v?"+_esc+r"\]?[^{BS}n]*{BS}n.*?(?={BS}n##{BS}s|{BS}Z)",_cl,re.DOTALL)
    if _m:
        _vc=_m.group(0).strip()
        LD += "{BS}n{BS}n---{BS}n{BS}n## 更新说明{BS}n{BS}n" + _vc
setup(name="{pypi_name}",version=V,description="{name} — AI Agent",
      long_description=LD,long_de
...[truncated 4061 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not construct executable Python source through direct interpolation of project metadata.
  2. Prefer a static PEP 621 pyproject.toml or another structured configuration format in which author values are serialized by a TOML-aware library.
  3. If generation of setup.py is unavoidable, serialize every inserted string as a valid Python literal:
python
author_literal = repr(AUTHOR_STR)
email_literal = repr(AUTHOR_EMAIL)

Then insert the complete literals without adding another pair of quotes:

python
f"author={author_literal}, author_email={email_literal},"
  1. Apply the same safe serialization to all other interpolated values, including name, pypi_name, pypi_ver, pkg_dir, and development-status values.
  2. Validate metadata types and reject control characters or unexpected structures before generating build files.
  3. Perform builds in an isolated, minimally privileged environment with no publishing credentials present. Retrieve and provide the PyPI credential only after a trusted artifact has been produced and inspected.
  4. Add regression tests containing quotes, backslashes, newlines, expression syntax, and malformed TOML author entries.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (125)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This finding identifies a serious under-disclosure problem: the skill describes publishing workflows but, per the analysis, also reads credentials, modifies git configuration, performs broad local file writes/deletes, creates temporary decision files, and invokes external commands like git, curl, twine, and npx. In a high-permission release tool, failing to explicitly declare these privileged behaviors can lead operators to grant execution without understanding that credentials and repositories may be altered or exfiltrated through external tooling.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
> 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
> 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
> 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
> ⚠️ **执行入口**：环境无 `rsync` 时（如部分 Windows Git 环境），`git-sync.sh` 会自动切换到 Python 完整流程。**直接调用 `python git-sync.py` 与 `bash git-sync.sh` 效果相同**，推荐直接使用 Python 入口。

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrase set is overly broad and includes generic actions such as syncing, pushing, publishing, uploading, packaging, and updating README, which can cause the skill to activate in many unrelated contexts. Because this skill performs multi-platform release and repository synchronization, accidental activation could expose code or metadata to external services, create tags/releases, or publish unintended content, making the broad trigger materially dangerous in this context.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/faq.md (reported line 26)May include surrounding context.

md
### Q3: Gitee push 需要密码但 PAT 仅限 API？

Gitee 的 PAT（Personal Access Token）通常仅限 API 操作，git push 需要登录密码或 SSH key。API 操作（如 Release 创建）使用 `config.json` 的 `gitee_token` 字段。

解决方案：
1. 使用 SSH 方式配置 Gitee remote（推荐）

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/faq.md (reported line 49)May include surrounding context.

先删除临时文件再执行同步：

bash
rm -f $SKILLS_DIR/<skill-name>/*.html

或在 skill 目录下添加 .gitignore 规则排除 html。