ClawHub
Back to skill

Security audit

Adsbrain Trace Error Locator

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with trace debugging, but it needs review because it tells agents to run a local script with user-controlled trace and project IDs without clear validation or safe argument handling.

Install only if you trust the local xray-ai-trace-analysis script and can ensure trace_id and project_id values are strictly validated before execution. Prefer updating the skill to call the script through a structured argument API, reject shell metacharacters and whitespace, and replace the user-specific absolute path with a reviewed package-controlled path.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:73
Finding

Command Injection Through Unquoted Trace and Project Identifiers

Content
View full analysis
--trace_id ``` ```bash python3 /Users/jialize/.codewiz/skills/xray-ai-trace-analysis/scripts/query_langfuse_trace.py --trace_id ``` ```bash python3 /Users/jialize/.codewiz/skills/xray-ai-trace-analysis/scripts/query_langfuse_trace.py --trace_id --env sit ``` ### Technical Analysis The skill directs the agent to extract `project_id` and `trace_id` from user-provided URLs or messages and substitute them directly into shell command templates. It does not require validation, shell escaping, quoting, or invocation through an argument-array API. If the agent constructs and executes these commands through a shell, an attacker can supply identifiers containing shell metacharacters such as `;`, `&&`, command substitutions, redirections, or newline characters. The shell may interpret those characters as additional commands rather than as part of a trace identifier. The `--save_project_id` variant also passes attacker-controlled data into a persistent project-ID storage operation. This is not independently proven to enable arbitrary persistent instructions because the referenced script was not included in the audited project, but it increases the importance of strict input validation. The hardcoded absolute path is also environment-specific and places trust in an external local script outside the reviewed skill package. No evidence established that this script is malicious, modified, or downloaded remotely. ### Attack Path 1. An attacker provides a crafted trace URL or identifier, for example an input conceptually equivalent to: ```text legitimate-trace-id; attacker- ...[truncated 1835 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep