Security audit

Ber Clawhub V060

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent purpose, but its helper can persist lessons that were not approved and can be tricked into writing outside the project boundary.

Review before installing. This skill is not trying to hide its persistence model, but it can modify durable agent instruction files; only run promotion commands for lessons you have explicitly reviewed, avoid sensitive lesson text, and do not use symlinked promotion or eval targets. Maintainers should add lifecycle checks and canonical path validation before broad use.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: scripts/ber.js:645
Finding: Rejected, Quarantined, Superseded, or Unreviewed Lessons Can Be Promoted into Durable Agent Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ber.js:229
Finding: Lexical Path Validation Allows Symlink-Based Writes Outside the Project
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
- Skill promotions must target `SKILL.md` in the current skill project.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example exposes a bare "/ber report" trigger without indicating what data it reports on, what scope it uses, or whether confirmation is required before surfacing stored lessons or local evidence. In a skill centered on capturing and promoting behavioral lessons, an underspecified report command can cause overbroad disclosure of internal memory, project-local artifacts, or prior corrections if the agent interprets the request too broadly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The command uses npx --yes svg-term-cli without pinning an exact package version, so it may fetch and execute whatever version is current at runtime. That creates a supply-chain risk: a compromised upstream release, dependency takeover, or unexpected breaking change could lead to arbitrary code execution on the operator's machine when following the documented demo steps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script creates a temporary working directory and deletes it on exit via rm -rf, but there is no confirmation prompt, warning comment, or user-facing disclosure explaining that filesystem changes and cleanup will occur. It also later writes demo files, and this file itself does not document those side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script writes direct.md and later memory/decisions.md as part of the demo, but there is no explicit warning or comment in the file that local files will be created. Although the operations are part of the demo flow, the lack of direct disclosure means users may not realize the script modifies the working directory.
Content: No source excerpt is available for this finding.