Security audit

Qclaw Task Submitter

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent as a WorkBuddy task-submission bridge, but it can route broad user requests into immediate external/local automation without clear confirmation and documents an unsafe shell-command pattern.

Review before installing. Use it only if you intentionally want QClaw to hand tasks to WorkBuddy, and require explicit confirmation before submitting tasks that include files, private data, batch changes, scheduled work, or document generation. The queue command should be implemented with structured arguments rather than shell-string interpolation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:24
Finding: Shell Command Injection Through Unescaped Task Parameters
Content: View full analysis
/tmp/workbuddy-injection-result; # ``` If an agent substitutes that value into the documented command and executes the result through a shell, the resulting command can run `id` independently of `qclaw_queue.py`. Command substitutions such as `$(command)` may also be evaluated by the shell inside double-quoted arguments. The risk applies to the task description and potentially to the values passed through `--intent` and `--ctx`. The implementation of `qclaw_queue.py` is outside this project and was not available for review, so this finding concerns the unsafe shell-command construction explicitly prescribed by the skill. ### Attack Path 1. An attacker submits a WorkBuddy task containing shell syntax, such as a quote terminator followed by a command separator and an operating-system command. 2. The agent follows `SKILL.md` and interpolates the attacker-controlled task into the documented command templ ...[truncated 1028 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger description is broad and includes common phrases like '帮我生成/制作/分析/整理' and generic references to remote execution and task dispatch. This can cause unintended activation, routing ordinary user requests into a remote execution pipeline where files, data, or actions may be processed by WorkBuddy without sufficiently explicit user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs immediate submission and processing of tasks, including local file access, batch file handling, data analysis, and remote execution, but does not require a clear warning or consent flow about data sharing and potentially destructive actions. In this context, the missing warning is more dangerous because the skill explicitly promotes handing off complex tasks and local filesystem operations to another system that begins processing immediately.
Content: No source excerpt is available for this finding.