ClawHub
Back to skill

Security audit

Little7 Bcdr

Security checks for vulnerabilities and agentic risk

Overview

This backup skill is coherent, but it handles identity, memory, local skills, and optional secrets in ways that need careful review before use.

Review this before installing or automating it. Use it only if you understand that selected secrets may be archived in plaintext and synced to Google Drive. Prefer adding encryption, restrictive umask/permissions, secure temporary-directory creation, and explicit review of the secret allowlist before enabling cron-driven backups.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/little7_backup.sh:18
Finding

Predictable and Insecure Temporary Directory Used for Sensitive Backup Staging

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/little7_backup.sh:101
Finding

Unencrypted Secret Archives Created Without Enforced Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/little7_backup.sh:87
Finding

Unsafe Shell Word Splitting During Backup File Enumeration

Content
View full analysis
/dev/null | sort); do should_skip_state_path "$path" && continue copy_rel "${path#$ROOT/}" done ``` ### Technical Analysis The output of `find` is consumed through unquoted command substitution. Bash performs word splitting and pathname expansion on the resulting text before assigning values to `path`. As a result: - Filenames containing spaces or tabs are split into multiple loop iterations. - Filenames containing newlines cannot be represented safely. - Filename components containing shell glob characters may undergo pathname expansion. - Required files can be silently omitted or incorrect paths can be passed to `copy_rel`. The script uses `set -e`, but `copy_rel` deliberately returns successfully when a reconstructed path does not exist. Therefore, malformed path splitting can result in silent data loss rather than a backup failure. ### Attack Path 1. A required file under `scripts` or `skills` has a filename containing whitespace, a newline, or shell glob metacharacters. 2. `find` emits the filename as ordinary newline-delimited text. 3. Command substitution removes trailing newlines and Bash performs word splitting and pathname expansion. 4. The loop processes fragments or expanded names instead of the original filename. 5. `copy_rel` skips nonexistent fragments without reporting an error, or copies unintended matching files. 6. The backup completes and may pass its limited member checks even though required content is absent. 7. During disaster recovery, the omitted script or skill is unavailable. A user who can create files in the backed-up `scripts` or `skills` directories can deliberately trigger the behavior. It can also occur accidentally with legitimate file ...[truncated 631 chars]
Remediation
View remediation
/dev/null ) ``` If deterministic ordering is required and the platform supports it, use null-safe sorting: ```bash while IFS= read -r -d '' path; do should_skip_state_path "$path" && continue copy_rel "${path#$ROOT/}" done < <( find "$ROOT/scripts" "$ROOT/skills" -type f -print0 2>/dev/null | sort -z ) ``` Additional controls should include: 1. Record every selected source path in the manifest. 2. Treat a failed copy as an error instead of silently continuing. 3. Compare selected source files with archived members after archive creation. 4. Add tests covering spaces, tabs, newlines, wildcard characters, and leading hyphens in filenames. 5. Expand the health check beyond three fixed files so that backup completeness can be verified against the generated manifest. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep