ClawHub
Back to skill

Security audit

Taiji Topo File Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Taiji download workflow is coherent, but its required local shell step can mishandle or overwrite local files, so it belongs in Review before installation.

Install only if you are comfortable with the skill creating folders and moving files in your Downloads directory. Before use, replace the shell snippet with a safer fixed download directory, reject path separators in filenames, avoid eval, use a unique per-task download directory or browser download metadata, and confirm before moving or overwriting any local file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:87
Finding

Command Injection Through Unsafe eval-Based Path Expansion

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87–98
Vulnerability Type: Shell command injection
Risk Level: High

bash
# Specify the base directory (may be changed per task)
base_dir="~/Downloads"

# Inputs (extracted from the page or supplied as task parameters)
topo_name="{topology name}"
file_name="{file name}"

# Sanitize the topology name to avoid invalid path characters
safe_topo=$(echo "$topo_name" | tr '/:' '_' | tr -s ' ' '_' | sed 's/[^[:alnum:]_.-]/_/g')

# Current time (Asia/Shanghai)
now=$(TZ=Asia/Shanghai date +%Y%m%d_%H%M%S)
out_dir=$(eval echo "$base_dir")/${safe_topo}_${now}

Technical Analysis

The documented template describes base_dir as configurable per task and expands it using eval. Unlike ordinary parameter expansion, eval reparses its argument as shell syntax. Shell substitutions, metacharacters, or command separators embedded in an attacker-controlled base-directory value can consequently be executed.

Quoting "$base_dir" before it reaches eval does not prevent this issue because eval performs an additional parsing pass. The use of eval is unnecessary when the intended behavior is merely to resolve the user's home directory.

Attack Path

  1. An attacker supplies or influences the task's base-directory parameter.
  2. The value contains shell syntax, such as $(id > /tmp/skill-proof).
  3. The Agent substitutes that value into base_dir and executes the mandatory shell template.
  4. eval echo "$base_dir" reparses and executes the embedded command.
  5. Any command available to the Agent can run with the operating-system privileges of the Agent process.

Impact Assessment

Successful exploitation permits arbitrary command execution as the user running the Agent. This can allow reading or modifying user-accessible files, accessing locally available credentials, altering downloaded artifacts, invoking network tools, or executing addi ...[truncated 168 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove eval completely.
  • Use an explicitly expanded path such as base_dir="$HOME/Downloads".
  • If a caller may choose the directory, require an absolute path and validate it against an allowlisted parent directory.
  • Resolve and verify the canonical path before creating files, rejecting paths that escape the authorized download root.
  • Keep all variable expansions quoted and terminate option parsing with -- where supported.

A safer pattern is:

bash
base_dir="$HOME/Downloads"
mkdir -p -- "$base_dir"

base_real=$(realpath -- "$base_dir")
allowed_real=$(realpath -- "$HOME/Downloads")

case "$base_real/" in
  "$allowed_real/"*) ;;
  *) echo "Base directory is outside the permitted root" >&2; exit 1 ;;
esac

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:89
Finding

Path Traversal and File Overwrite Through Unsanitized Download Filename

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89–108
Vulnerability Type: Path traversal and unsafe file overwrite
Risk Level: High

bash
# Inputs (extracted from the page or supplied as task parameters)
topo_name="{topology name}"
file_name="{file name}"

# Sanitize the topology name to avoid invalid path characters
safe_topo=$(echo "$topo_name" | tr '/:' '_' | tr -s ' ' '_' | sed 's/[^[:alnum:]_.-]/_/g')

# Current time (Asia/Shanghai)
now=$(TZ=Asia/Shanghai date +%Y%m%d_%H%M%S)
out_dir=$(eval echo "$base_dir")/${safe_topo}_${now}
mkdir -p "$out_dir"

# Select the newest Chrome temporary download file
temp_file=$(ls -t ~/Downloads/.com.google.Chrome.* 2>/dev/null | head -1)

# Safety check
[ -z "$temp_file" ] && echo "No temporary download file found" && exit 1

# Move and rename the file
mv "$temp_file" "$out_dir/$file_name"

Technical Analysis

Although topo_name is normalized, file_name is used directly as part of the destination path. A filename containing parent-directory components such as ../../ can escape the timestamped output directory. Sufficient traversal components can target any path writable by the Agent's user.

The mv command also lacks a no-clobber or atomic collision policy. If the resolved destination already exists, the command can overwrite it. Quoting prevents argument splitting but does not prevent path traversal.

Attack Path

  1. An attacker controls or influences the filename obtained from the page or task parameters.
  2. The attacker supplies a value such as ../../../some/writable/target.
  3. The Agent constructs the destination as "$out_dir/$file_name".
  4. The operating system resolves the .. components outside the intended timestamped directory.
  5. mv places the downloaded temporary file at the escaped destination and may replace an existing file owned by the Agent's user.

Exploitation is limited by fi ...[truncated 627 chars]

Remediation
View remediation

Remediation Suggestions

  • Treat page-derived and task-supplied filenames as untrusted.
  • Reduce the value to a basename and reject empty names, . and ...
  • Reject path separators and control characters rather than attempting to preserve directory components.
  • Canonicalize the final destination and verify that it remains beneath the canonical output directory.
  • Use mv -n -- or an explicit collision-handling policy to prevent replacement of existing files.
  • Consider generating a trusted local filename and retaining the remote filename only as metadata.

Example hardening:

bash
file_name=$(basename -- "$file_name")

case "$file_name" in
  ""|"."|".."|*/*) echo "Invalid filename" >&2; exit 1 ;;
esac

destination="$out_dir/$file_name"
[ -e "$destination" ] && {
  echo "Destination already exists" >&2
  exit 1
}

mv -n -- "$temp_file" "$destination"

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:101
Finding

Race-Prone Selection of an Unverified Chrome Temporary Download

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 101–108
Vulnerability Type: Unsafe temporary-file handling and download misassociation
Risk Level: Medium

bash
# Select the newest Chrome temporary download file
temp_file=$(ls -t ~/Downloads/.com.google.Chrome.* 2>/dev/null | head -1)

# Safety check
[ -z "$temp_file" ] && echo "No temporary download file found" && exit 1

# Move and rename the file
mv "$temp_file" "$out_dir/$file_name"

Technical Analysis

The template assumes the newest path matching .com.google.Chrome.* is the download initiated by the current automation run. It does not record preexisting files, correlate the file with a browser download identifier, verify creation time against the click event, wait for download completion, or validate expected content.

This creates a time-of-check/time-of-use and file-selection race. An unrelated or concurrent Chrome download can become the newest matching file between the download action and local finalization. The template will then move that unrelated file and falsely report the requested operation as successful.

Parsing ls output also provides fragile filename handling and should not be used as a security boundary.

Attack Path

  1. The Agent initiates the intended file download.
  2. Another browser action or concurrent user process creates a newer matching Chrome temporary file in ~/Downloads.
  3. The template sorts all matching files by modification time and selects the first result.
  4. The Agent moves the unrelated file into the task output directory under the requested filename.
  5. A downstream process or user may consume, upload, execute, or disclose the wrong artifact while believing it is the requested file.

An attacker capable of causing a concurrent Chrome download can deliberately win this race by timing creation or modification of a matching temporary file.

Impact Assessment

The ...[truncated 381 chars]

Remediation
View remediation

Remediation Suggestions

  • Use browser download metadata or an automation API that returns the exact download identifier and completed file path.
  • Configure a unique, per-task download directory before initiating the download.
  • Record a directory snapshot before clicking download and correlate only newly created files afterward.
  • Wait until the browser reports completion and the temporary suffix has disappeared.
  • Verify the expected filename, size, type, and, when available, cryptographic digest before finalization.
  • Avoid parsing ls; use structured browser events or carefully bounded filesystem enumeration.
  • Refuse to proceed when multiple candidate files exist rather than guessing based on modification time.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill goes beyond browser-side interaction and instructs local shell commands that create directories, enumerate files in the user's Downloads folder, and move/rename a downloaded file. This is dangerous because it introduces filesystem side effects without explicit consent boundaries, and the use of task-derived variables such as topo_name and file_name increases the risk of unintended file placement or overwriting if inputs are malformed or attacker-influenced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown instructs moving and renaming files on the local machine after download, but it does not include an explicit warning or consent checkpoint for these filesystem modifications. Even if intended for convenience, silent local file operations can surprise users, interfere with other downloads, or mishandle files when multiple temporary downloads exist.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest emphasizes operating on the Taiji workflow page after validating that the page is correctly opened. The instructions also permit navigating to a target link when not already on the right page, adding a general page-navigation capability beyond the narrower stated role of locating the sidebar, opening the file panel, and downloading a file from the current page.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.