ClawHub
Back to skill

Security audit

Djtu Vehicle Eng Thesis Check

Security checks for vulnerabilities and agentic risk

Overview

This thesis-formatting skill has a reasonable goal, but it tells the agent to run and trust missing local scripts, including a flow that can ask the user to run sudo commands.

Review before installing. The skill should either include its scripts and reference files or avoid running relative-path scripts entirely. Do not run any sudo command suggested through this skill unless it is exactly an official package-manager install of pandoc from trusted repositories and you have independently checked where the command came from.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
**NEVER attempt to install pandoc by any method other than `check_env.sh`.**
Do not write ad-hoc install commands. Do not try `apt-get` without sudo.
Do not try running without sudo as a fallback. These will always fail silently
or with errors and waste the user's time.

**If `check_env.sh` outputs `[SUDO NEEDED]`:**

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
**NEVER attempt to install pandoc by any method other than `check_env.sh`.**
Do not write ad-hoc install commands. Do not try `apt-get` without sudo.
Do not try running without sudo as a fallback. These will always fail silently
or with errors and waste the user's time.

**If `check_env.sh` outputs `[SUDO NEEDED]`:**

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
Do not try running without sudo as a fallback. These will always fail silently
or with errors and waste the user's time.

**If `check_env.sh` outputs `[SUDO NEEDED]`:**
- STOP immediately. Do not try any alternative install method.
- Tell the user: "Please run this command in your terminal, then let me know
  when it's done:" and show them the exact command from the script output.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

The skill instructs the agent to show the user the exact command emitted by check_env.sh, and this line includes a privileged install command template. If check_env.sh is modified, compromised, or influenced by untrusted environment data, the skill could relay attacker-controlled sudo commands to the user, creating a social-engineering path to privileged code execution.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
Never for pip, never for building the docx, never for anything else.

**pandoc install priority (handled by check_env.sh automatically):**
1. `sudo apt-get install -y pandoc` — always first
2. `sudo dnf install -y pandoc` — if apt not available
3. `brew install pandoc` — macOS only
4. If all fail: tell user to search https://gitee.com, paste the URL

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

This line similarly endorses a sudo dnf install command as part of the scripted flow. While package installation itself is legitimate, the surrounding instruction to trust and relay script-provided commands can normalize privileged execution and could be abused if the script or environment is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
**pandoc install priority (handled by check_env.sh automatically):**
1. `sudo apt-get install -y pandoc` — always first
2. `sudo dnf install -y pandoc` — if apt not available
3. `brew install pandoc` — macOS only
4. If all fail: tell user to search https://gitee.com, paste the URL

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
72% confidence
Finding

This instruction tells the agent to display whatever command the script marks as '[SUDO NEEDED]' and have the user run it. That creates an indirect privilege-escalation channel: a compromised helper script can turn the agent into a trusted messenger for malicious root-level commands.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
Run this and follow its output exactly:
- If it prints `[OK]` for all items → proceed to Step 2.
- If it prints `[SUDO NEEDED]` → stop, show the user the command, wait for
  them to run it, then re-run this step.
- If it prints `[ERROR]` or `[MISSING]` for anything other than pandoc →
  report the error to the user and stop.

Static analysis

No suspicious patterns detected.