ClawHub
Back to skill

Security audit

EDID Parser

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local EDID parser, but it includes an unsafe troubleshooting instruction to write to a kernel-controlled display sysfs node.

Review before installing. The parsing scripts appear local and purpose-aligned, but users should avoid running the documented 'echo 1 > /sys/class/drm/.../edid' command unless they independently confirm it is safe for their exact kernel and display driver. Treat the skill as read-only EDID tooling and use edid-decode on existing EDID files or sysfs reads instead.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/edid_spec.md:119
Finding

Unnecessary Write to a Kernel-Controlled DRM Sysfs Node

Content
View full analysis
/sys/class/drm/card0-HDMI-A-1/edid ``` ### Technical Analysis The documentation instructs the user or executing Agent to write directly to `/sys/class/drm/card0-HDMI-A-1/edid`. Files under sysfs are kernel-controlled interfaces rather than ordinary data files, and writes can invoke driver-specific behavior. The Skill's declared parsing, validation, and diagnostic operations only require read access to EDID data. Writing ASCII `1` to an EDID node is therefore outside the minimum permissions necessary for the task and is not established in the project as a safe or portable EDID refresh procedure. On systems where the node is read-only, the command will fail. This failure may encourage users or Agents to retry it with elevated privileges. On an implementation that permits writes, the supplied byte may be interpreted as invalid EDID data or trigger driver-specific state changes. The exact behavior depends on the kernel and display driver. ### Attack Path 1. A user invokes the Skill to diagnose or parse a display. 2. The Agent or user consults the bundled EDID specification reference. 3. The “Force read EDID” procedure is selected during troubleshooting. 4. The documented command attempts to write directly to a DRM sysfs node. 5. If ordinary permissions reject the operation, the user may retry it with elevated privileges. 6. If the driver accepts writes to that node, invalid data or an unsupported operation may be passed to the kernel display subsystem, potentially changing display state or causing driver errors. No automatic privilege escalation mechanism is implemented in the project, and successful exploitation depends on system per ...[truncated 603 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to run shell commands and read local files such as /sys/class/drm/*/edid, but it does not declare an explicit tool/permission scope. In an agent environment, missing scope boundaries can cause over-broad execution authority or make reviewers and policy enforcement unable to tell what the skill is allowed to access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that the skill converts EDID data to an "easy-to-understand Chinese report," which imposes a language choice by default. This is a natural-language policy issue because the file does not indicate that users can choose another language or opt into Chinese output.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

  • edid-decode must be installed:
    bash
    sudo apt-get install edid-decode

Common EDID File Locations

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation labels a shell command that writes to a sysfs EDID node as a way to 'Force read EDID', which is misleading and can prompt users to perform a device write rather than a safe read operation. Sysfs writes can trigger kernel or driver state changes, and in a display/debugging skill users are likely to copy-paste commands directly, increasing the chance of disruption or undefined behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L18 says the skill will turn technical parsing into '通俗中文', which imposes a specific output language. Under the policy, forcing a language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified or optional.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_validate.py (reported line 57)May include surrounding context.

python
return result
    
    try:
        proc = subprocess.run(
            ['edid-decode', '-c'],
            input=binary,
            capture_output=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says the skill supports Linux sysfs EDID, binary EDID files (.bin), and raw hex data, and specifically mentions batch processing multiple EDID files. However, this batch scanner only searches for text files containing '(hex):' and explicitly skips .bin and .txt variants, so its implemented behavior is narrower than the skill's stated supported inputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline comment says the batch finder will 'only process source files', and the implementation enforces this by skipping .bin, .txt, and _bin.txt files. That contradicts the skill manifest, which explicitly states support for binary EDID files (.bin) and raw hex data, so the documented intent in this file diverges from the declared skill intent and actual expected scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnostic_report.py (reported line 16)May include surrounding context.

python
def parse_edid(edid_path):
    """Run edid-decode and return output"""
    try:
        result = subprocess.run(
            ['edid-decode', edid_path],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_info.py (reported line 118)May include surrounding context.

python
def parse_edid(edid_path):
    """Run edid-decode and return output"""
    try:
        result = subprocess.run(
            ['edid-decode', edid_path],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest frames this skill as parsing and analyzing EDID from sysfs, binary files, or raw hex data, with human-readable and JSON output. Invoking an external executable adds subprocess execution capability that is not explicitly stated in the skill purpose and goes beyond straightforward local parsing logic.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/extract_info.py (reported line 127)May include surrounding context.

python
# Check if edid-decode is available
if ! command -v edid-decode &> /dev/null; then
    echo "Error: edid-decode not found. Install with: sudo apt-get install edid-decode"
    exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/parse_edid.sh (reported line 22)May include surrounding context.

sh
# Check if edid-decode is available
if ! command -v edid-decode &> /dev/null; then
    echo "Error: edid-decode not found. Install with: sudo apt-get install edid-decode"
    exit 1
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/validate_edid.sh (reported line 35)May include surrounding context.

sh
# Check if edid-decode is available
if ! command -v edid-decode &> /dev/null; then
    echo "Error: edid-decode not found. Install with: sudo apt-get install edid-decode"
    exit 1
fi

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example shows a potentially disruptive sysfs write without any warning, preconditions, or note about privilege requirements and device-specific effects. Even if intended for debugging, presenting it as a normal troubleshooting step can lead users to execute a command that may reset state, fail unpredictably, or interfere with display operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code includes multiple hard-coded Chinese user-facing messages such as error text, status updates, and summary headings, while the usage text is partly bilingual. Because the script does not offer any language selection or document a justified locale restriction, it creates a natural-language locale policy concern under the language-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code emits user-facing report text in Chinese by default, including headings and diagnostics, without any option to select another language or locale. That creates a natural-language locale policy concern because the skill imposes a specific language on all users rather than offering opt-in or configurability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code automatically selects Chinese only when the LANG environment contains 'zh', and otherwise forces English output. That is a natural-language locale policy concern because the skill imposes a language choice by environment heuristic rather than explicitly asking or offering a neutral default with clear user selection.

Content

No source excerpt is available for this finding.