ClawHub
Back to skill

Security audit

Steam Icon Fixer

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it claims: repair local Steam launcher icons on Linux without network access, credentials, or unrelated system changes.

Before using it, review the script if you are cautious, install Pillow in the Python environment, and run it only against image and icon directories you intend to modify. The cache refresh runs local desktop icon-cache tools if present.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def shutil_which(name: str) -> str | None:
    return subprocess.run(
        ["sh", "-lc", f"command -v {name}"],
        capture_output=True,
        text=True,
Confidence
98% confidence
Finding
The helper uses `sh -lc` with string interpolation to resolve a command path, which creates a shell-injection sink if the `name` argument is ever influenced by untrusted input. In this file the current callers pass hardcoded values, so immediate exploitability is limited, but the implementation is unsafe and could become exploitable if reused or modified later.

Static analysis

No suspicious patterns detected.