ClawHub
Back to skill

Security audit

agent-skills-setup

Security checks for vulnerabilities and agentic risk

Overview

This is an offline local migration tool whose sensitive filesystem access is disclosed, scoped to agent-context migration, and guarded by preview/apply/rollback controls.

Install only if you want a local tool that can read and modify selected AI-agent context files. Review generated plans before applying, keep backups/manifests, avoid broad device-wide snapshot unless you intend it, and do not use plugin or session opt-ins unless you understand those extra surfaces.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (111)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about migrating and managing AI-agent context across tools and profiles. The supplied code does not perform migration, backup, restore, comparison, profile switching, bundle creation, secret redaction, preview, rollback, or any agent-context handling. Instead, it focuses on secure filesystem operations for private signing keys, including Win32 ACL construction/validation, regular-file checks, anti-reparse protections, controlled cleanup, and bounded reading of private file contents. This is a materially different primary purpose and introduces undeclared sensitive file/key handling capabilities, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This code chunk’s primary purpose is environment detection, not context transfer. It inspects local binaries, files, and macOS app bundles to classify install state (installed/configured-only/compatibility-only/etc.). While local detection could be a supporting part of a migration tool, the described skill emphasizes moving and safeguarding agent context across products, which is materially different from what this chunk does. Additionally, the code uses subprocesses (subprocess.run) and local app/file probing capabilities that are not mentioned in the description. Therefore the description does not accurately represent this supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code chunk is a focused utility for resolving registry selectors. It parses a selector like product/profile, follows alias_of references in registry data, enforces cycle and depth limits, determines a final profile from alias, template, or default settings, and returns metadata about the resolution chain and deprecation status. This is materially different from the declared purpose, which describes a comprehensive cross-tool context migration and backup/restore capability with redaction, verification, rollback, and packaging features. While alias resolution could be a supporting internal detail in a larger migration system, this chunk by itself does not implement or directly expose the declared capabilities, so the description does not accurately represent what the supplied code actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a broad context-migration and backup/restore tool for multiple AI coding agents. The supplied code chunk, however, only wraps and executes a secret/credential scanning component. While secret redaction or scanning could be a supporting part of such a migration workflow, this snippet does not demonstrate any of the core declared capabilities like moving profiles, creating bundles, restoring, comparing, verifying transfers, or rollback. Based on the provided code alone, the actual behavior is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a migration and portability utility for moving agent context between platforms, with backup/restore, comparison, redaction, verification, rollback, and bundle support. The actual code does none of that. It does not migrate, back up, restore, compare, package, import/export, or interact with any agent profiles. Instead, it performs security validation of a local Skill directory by scanning file contents and symlink structure for embedded secrets and unsafe links. Secret redaction is mentioned in the description, but this code does not redact secrets; it only detects and reports them. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.json (reported line 3)May include surrounding context.

json
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.json (reported line 6)May include surrounding context.

json
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.tsv (reported line 10)May include surrounding context.

text
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.tsv (reported line 13)May include surrounding context.

text
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ides/antigravity.md (reported line 7)May include surrounding context.

md
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ides/antigravity.md (reported line 10)May include surrounding context.

md
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ides/antigravity.md (reported line 24)May include surrounding context.

md
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/ide-paths.tsv (reported line 23)May include surrounding context.

text
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/ide-paths.tsv (reported line 26)May include surrounding context.

text
{
  "antigravity": {
    "global_skills": "~/.gemini/config/skills",
    "project_skills": ".agents/skills",
    "rules": ".agents/rules",
    "mcp": "~/.gemini/config/mcp_config.json",

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.json (reported line 17)May include surrounding context.

json
| MCP | `~/.claude.json` |
| Project MCP | `.mcp.json` |
| Project config | `.claude/settings.json` |
| Config | `~/.claude/settings.json` |

<!-- END GENERATED: ide-paths.json summary -->
- Settings include project `.claude/settings.json` and local `.claude/settings.local.json`; local scopes are manual.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.tsv (reported line 33)May include surrounding context.

text
| MCP | `~/.claude.json` |
| Project MCP | `.mcp.json` |
| Project config | `.claude/settings.json` |
| Config | `~/.claude/settings.json` |

<!-- END GENERATED: ide-paths.json summary -->
- Settings include project `.claude/settings.json` and local `.claude/settings.local.json`; local scopes are manual.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ides/claude.md (reported line 13)May include surrounding context.

md
| MCP | `~/.claude.json` |
| Project MCP | `.mcp.json` |
| Project config | `.claude/settings.json` |
| Config | `~/.claude/settings.json` |

<!-- END GENERATED: ide-paths.json summary -->
- Settings include project `.claude/settings.json` and local `.claude/settings.local.json`; local scopes are manual.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/ide-paths.tsv (reported line 57)May include surrounding context.

text
| MCP | `~/.claude.json` |
| Project MCP | `.mcp.json` |
| Project config | `.claude/settings.json` |
| Config | `~/.claude/settings.json` |

<!-- END GENERATED: ide-paths.json summary -->
- Settings include project `.claude/settings.json` and local `.claude/settings.local.json`; local scopes are manual.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.json (reported line 32)May include surrounding context.

json
| Global skills | `~/.agents/skills` |
| Project skills | `.agents/skills` |
| Rules | `AGENTS.md` |
| MCP | `~/.codex/config.toml` |
| Project MCP | `.codex/config.toml` |
| Project config | `.codex/config.toml` |
| Config | `~/.codex/config.toml` |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.json (reported line 35)May include surrounding context.

json
| Global skills | `~/.agents/skills` |
| Project skills | `.agents/skills` |
| Rules | `AGENTS.md` |
| MCP | `~/.codex/config.toml` |
| Project MCP | `.codex/config.toml` |
| Project config | `.codex/config.toml` |
| Config | `~/.codex/config.toml` |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.tsv (reported line 50)May include surrounding context.

text
| Global skills | `~/.agents/skills` |
| Project skills | `.agents/skills` |
| Rules | `AGENTS.md` |
| MCP | `~/.codex/config.toml` |
| Project MCP | `.codex/config.toml` |
| Project config | `.codex/config.toml` |
| Config | `~/.codex/config.toml` |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ide-paths.tsv (reported line 53)May include surrounding context.

text
| Global skills | `~/.agents/skills` |
| Project skills | `.agents/skills` |
| Rules | `AGENTS.md` |
| MCP | `~/.codex/config.toml` |
| Project MCP | `.codex/config.toml` |
| Project config | `.codex/config.toml` |
| Config | `~/.codex/config.toml` |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ides/codex.md (reported line 10)May include surrounding context.

md
| Global skills | `~/.agents/skills` |
| Project skills | `.agents/skills` |
| Rules | `AGENTS.md` |
| MCP | `~/.codex/config.toml` |
| Project MCP | `.codex/config.toml` |
| Project config | `.codex/config.toml` |
| Config | `~/.codex/config.toml` |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/ides/codex.md (reported line 13)May include surrounding context.

md
| Global skills | `~/.agents/skills` |
| Project skills | `.agents/skills` |
| Rules | `AGENTS.md` |
| MCP | `~/.codex/config.toml` |
| Project MCP | `.codex/config.toml` |
| Project config | `.codex/config.toml` |
| Config | `~/.codex/config.toml` |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/registry-v2.json (reported line 861)May include surrounding context.

json
| Global skills | `~/.agents/skills` |
| Project skills | `.agents/skills` |
| Rules | `AGENTS.md` |
| MCP | `~/.codex/config.toml` |
| Project MCP | `.codex/config.toml` |
| Project config | `.codex/config.toml` |
| Config | `~/.codex/config.toml` |

Static analysis

No suspicious patterns detected.