ClawHub
Back to skill

Security audit

pet-feedback

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent pet feedback daemon, but users should understand its optional shell display hooks and cloud TTS data flow before using it.

Install only if you are comfortable running a local feedback daemon. Use offline TTS such as espeak-ng for sensitive messages, and configure wake/blank commands only with simple trusted display-control commands. Do not let untrusted users modify the daemon environment, command-line arguments, or watched state file.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (8)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if not cmd:
        return False
    try:
        rc = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        return rc.returncode == 0
    except Exception:
        return False
Confidence
97% confidence
Finding
The code executes a string command with `subprocess.run(..., shell=True)` in `run_cmd`, and the command value comes from CLI arguments or environment variables (`--wake-cmd`, `--blank-cmd`, `PET_WAKE_CMD`, `PET_BLANK_CMD`). Any attacker who can influence those values can execute arbitrary shell commands with the daemon's privileges, making this a real command-injection surface rather than a harmless helper.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation declares environment variables, file-based state exchange, and shell-capable wake/blank commands, but it does not declare corresponding permissions. That creates a transparency and policy gap: operators may deploy the skill without realizing it can read files, consume environment-controlled paths, and invoke shell commands for display control.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The skill explicitly supports arbitrary wake/blank command strings from arguments and environment variables, then passes them to the shell for execution. In this skill's context, screen power control only needs a narrow, predefined action, so exposing a general-purpose command execution interface is unnecessarily dangerous and can be abused for arbitrary code execution.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation states that message text may be synthesized via network-backed TTS engines such as edge-tts or gTTS, but it does not warn users that message content may be transmitted to external services. If the message contains sensitive conversation content, this can lead to unintended privacy leakage to third parties.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The demo explicitly walks users through camera capture and emotion analysis, then links the result to behavioral feedback, but provides no notice, consent guidance, retention limits, or privacy caveats. In a user-facing sensing skill, this omission can normalize collection of sensitive visual and inferred emotional data without adequate transparency, increasing the risk of covert or inappropriate monitoring.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The module automatically prioritizes network TTS providers (edge-tts, then gtts) and sends supplied text to remote services without any explicit notice, consent, or privacy control. If the text contains private conversations, secrets, or sensitive personal data, this creates an unintended data disclosure channel outside the local device.

Unvalidated Output Injection

High
Category
Output Handling
Content
if not cmd:
        return False
    try:
        rc = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        return rc.returncode == 0
    except Exception:
        return False
Confidence
95% confidence
Finding
This is a true output/command injection issue because untrusted configuration is forwarded directly into a shell command interpreter. Even though the immediate source is options/env rather than the JSON state file, that still creates a privilege boundary problem in deployments where service environment or launch parameters can be modified.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
if not cmd:
        return False
    try:
        rc = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        return rc.returncode == 0
    except Exception:
        return False
Confidence
97% confidence
Finding
The tool interface is abusable because a nominally simple feature—wake or blank the display—accepts arbitrary shell payloads. This broadens the daemon from a display controller into a generic command runner, which is especially risky for a long-running background process that may execute automatically on boot or under elevated device privileges.

Static analysis

No suspicious patterns detected.