ClawHub
Back to skill

Security audit

Exwind Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently checks a public EXWIND page on a schedule and sends update text to Feishu when new posts appear.

Install only if you want automatic EXWIND checks every 10 minutes and Feishu notifications. Verify that the Feishu destination and local agent-browser tool are the ones you expect; the /tmp state file can be deleted to reset duplicate tracking.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_cmd(cmd: str, timeout: int = 30) -> tuple[bool, str]:
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        return result.returncode == 0, result.stdout + result.stderr
    except Exception as e:
        return False, str(e)
Confidence
92% confidence
Finding
The helper executes shell commands with shell=True, which is dangerous because any future untrusted input interpolated into cmd can trigger command injection. In this file, open_page builds a shell command using a URL argument, so the unsafe wrapper is not purely theoretical even if the current caller passes a constant URL.

Static analysis

No suspicious patterns detected.