ClawHub
Back to skill

Security audit

Timeline

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent personal timeline skill, but its script has input-handling flaws that could let crafted entries or options run local commands.

Review or fix the shell script before installing, especially input validation for event text, dates, tags, times, and `--limit`. Treat the timeline file as persistent sensitive storage if you log medical or family details, and prefer explicit write commands like `add to timeline` over broad trigger-based use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/timeline.sh:87
Finding

Arbitrary Command Execution Through sed Program Injection

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi ``` 2. Validate time values similarly: ```bash if [[ ! "$time_str" =~ ^([01][0-9]|2[0-3]):[0-5][0-9]$ ]]; then echo "Error: Invalid time" >&2 exit 1 fi ``` 3. Treat event text and tags exclusively as data. Rebuild the file using a temporary file and `printf '%s\n'`, rather than placing the entry inside executable `sed` syntax. 4. Create temporary files with `mktemp` in a trusted directory, preserve permissions where necessary, and atomically replace the original file only after successful generation. 5. Consider rejecting carriage returns, newlines, and other control characters if timeline entries are required to remain single-line records. 6. Validate tags against an allowlist such as letters, digits, underscores, and hyphens. 7. Add regression tests with multiline input and strings containing `sed` metacharacters to verify that they are stored literally and never interpreted. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/timeline.sh:143
Finding

Command Execution Through Unvalidated Bash Arithmetic Expression

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi if (( 10#$limit < 1 || 10#$limit > 1000 )); then echo "Error: --limit must be between 1 and 1000" >&2 exit 1 fi ``` After validation, compute counts separately and use explicit `-n` options: ```bash local tail_count=$((10#$limit + 10)) local head_count=$((10#$limit + 5)) grep -E "^- \*\*[0-9]{2}:[0-9]{2}\*\*|^## [0-9]{4}" "$TIMELINE_FILE" | tail -n "$tail_count" | head -n "$head_count" ``` Additional hardening should include: 1. Reject missing option values before reading `$2`. 2. Set a reasonable maximum to prevent excessive processing or unexpected output. 3. Avoid evaluating any externally supplied value as Bash arithmetic until it has passed a strict decimal-digit allowlist. 4. Add tests using alphabetic input, negative values, very large values, arithmetic operators, variable references, array syntax, and command-substitution-like payloads. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
95% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
- "add to timeline"
      - "record that"
      - "timeline"
---

# Timeline Skill

A personal event log for dated facts that don't belong on a calendar.

## Use Cases

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is explicitly designed to store potentially sensitive family and medical information, but the description does not warn users that data is written to a local file. This weakens informed consent and increases the chance that users disclose health or personal information without understanding retention and storage behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrase "timeline" is so generic that ordinary conversation about timelines can unintentionally invoke the skill. Because this skill stores personal and medical events, accidental activation could cause sensitive user content to be logged without clear intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill stores potentially sensitive personal data such as medical events, family moments, and milestones in a persistent local Markdown file without any user-facing disclosure, consent, or guidance about retention and sensitivity. In this context, the data is explicitly personal and may include health information, so silent persistence increases privacy risk if the device, vault, backups, or synced storage are accessed by others.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.