ClawHub
Back to skill

Security audit

Bytesagain Mindmap

Security checks for vulnerabilities and agentic risk

Overview

This is a local mind-map rendering skill with no evidence of network access, credential use, persistence, or destructive behavior.

This skill is reasonable to install for local outline rendering. Be cautious with outlines from other people, especially when viewing terminal output or exporting Markdown, because crafted labels may visually mislead a terminal or Markdown renderer.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:71
Finding

Unescaped Labels Enable Terminal Control-Sequence and Markdown Fence Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:71, 106-130
Vulnerability Type: Untrusted output injection
Risk Level: Medium

Vulnerable Code

python
# scripts/script.sh:71
label = re.sub(r'^[-*•]\s*', '', stripped)
python
# scripts/script.sh:106-130
def render_tree(node, prefix="", is_last=True, is_root=True):
    lines = []
    if is_root:
        lines.append(node["label"])
    else:
        connector = LAST if is_last else TEE
        lines.append(prefix + connector + node["label"])

    children = node.get("children", [])
    for i, child in enumerate(children):
        last = (i == len(children) - 1)
        if is_root:
            child_prefix = ""
        else:
            child_prefix = prefix + (BLANK if is_last else CONT)
        lines.extend(render_tree(child, child_prefix, last, is_root=False))
    return lines

nodes = parse_outline(raw)
if not nodes:
    print("Error: empty input. Provide an indented outline.")
    sys.exit(1)

tree = build_tree(nodes)
rendered = render_tree(tree)

if mode == "markdown":
    print("```mindmap")
    for line in rendered:
        print(line)
    print("```")
else:
    for line in rendered:
        print(line)

Technical Analysis

Outline labels are accepted from inline arguments, stdin, or files and are copied into rendered output without contextual encoding. The parser only removes an optional list marker; it does not remove terminal control characters or protect Markdown delimiters.

In view and create modes, labels containing ANSI escape sequences are written directly to the terminal. Such sequences can clear or rewrite displayed content, alter colors, create misleading terminal output, or trigger terminal-specific behaviors.

In export mode, the program surrounds output with a fixed three-backtick fence. A label containing three backticks can close that fence early. Subs ...[truncated 1489 chars]

Remediation
View remediation

Remediation Suggestions

  • Sanitize terminal-bound labels by removing or visibly encoding C0/C1 control characters, particularly ESC, while preserving necessary newline handling before parsing.
  • Consider rejecting labels containing unexpected control characters and return a clear validation error.
  • For Markdown export, calculate the longest consecutive backtick run in the rendered content and use a fence longer than that run.
  • Alternatively, escape or replace backtick fence sequences before inserting labels into the fenced block.
  • If exported files may be rendered by systems that permit raw HTML, disable or encode raw HTML where practical.
  • Add regression tests containing ANSI escape bytes, carriage returns, embedded triple backticks, longer backtick runs, and raw HTML.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:136
Finding

Broad Backslash Interpretation Allows Undocumented Control Bytes and Input Truncation

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:143, 155, 179
Vulnerability Type: Unsafe interpretation of untrusted escape sequences
Risk Level: Low

Vulnerable Code

bash
# scripts/script.sh:136-144
get_input() {
  local arg="${1:-}"
  if [[ "$arg" == "-" || -z "$arg" ]]; then
    cat
  elif [[ -f "$arg" ]]; then
    cat "$arg"
  else
    # Treat as raw text (unescape \n)
    printf '%b' "$arg"
  fi
}
bash
# scripts/script.sh:149-156
create)
  if [[ -z "$ARG" ]]; then
    echo -e "${RED}Error: provide text as argument${RESET}"
    echo 'Usage: bash script.sh create "Root\n  A\n  B"'
    exit 1
  fi
  TEXT="$(printf '%b' "$ARG")"
  render_mindmap "ascii" "$TEXT"
  ;;
bash
# scripts/script.sh:170-180
export)
  if [[ -z "$ARG" ]]; then
    TEXT="$(cat)"
  elif [[ "$ARG" == "-" ]]; then
    TEXT="$(cat)"
  elif [[ -f "$ARG" ]]; then
    TEXT="$(cat "$ARG")"
  else
    # treat as inline text
    TEXT="$(printf '%b' "$ARG")"
  fi
  render_mindmap "markdown" "$TEXT"
  ;;

Technical Analysis

The documented inline format requires interpreting \n as a newline, but Bash printf '%b' interprets a substantially broader escape language. This includes octal or hexadecimal byte escapes, terminal escape bytes, carriage returns, backspaces, and \c, which causes printf to stop producing output.

Consequently, an inline argument can create bytes that were not literally present in the supplied text and can unexpectedly truncate the outline. In terminal output mode, this also provides a convenient method for constructing the control sequences involved in terminal-output injection.

Quoting "$ARG" correctly prevents shell word splitting and command substitution from being reevaluated, so this issue is not shell command injection. The flaw is the broader-than-documented transformation of untrusted input.

Attack Pat

...[truncated 931 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace broad %b decoding with a narrowly scoped transformation that recognizes only the documented \n sequence.
  • Prefer stdin or actual multiline arguments so that no escape-language decoding is required.
  • Reject unsupported backslash escapes instead of silently interpreting them.
  • Apply terminal control-character sanitization after decoding and before rendering.
  • Add tests for \c, hexadecimal and octal escapes, carriage returns, backspaces, literal backslashes, and malformed escape sequences.
  • Remove the unused get_input function if it is not part of the intended execution path, reducing duplicate input-handling logic.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.