Security audit

Workspace Standard

Security checks for vulnerabilities and agentic risk

Overview

This workspace-organization skill is mostly coherent, but its setup script and documentation include avoidable file-overwrite and remote-script risks that users should review before installing.

Install only if you are comfortable with a skill that creates and organizes persistent workspace files. Prefer the bundled scripts over the README's curl download path, avoid --force unless you have reviewed the destination, use simple project names without slashes or dot-dot segments, and review git changes before any maintenance commit or push.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/workspace-init.sh:89
Finding: Unvalidated Project Name Permits Filesystem Path Traversal
Content: View full analysis
"$file" created "$file" fi } ``` ### Technical Analysis The value supplied through `--project` is accepted without verifying that it is a safe, single directory name. It is concatenated directly into: ```bash $WORKSPACE/projects/$name ``` A name containing parent-directory components such as `../` can therefore escape the intended `projects/` directory. The script subsequently creates subdirectories and writes a `README.md` beneath the traversed destination. When `--force` is supplied, `write_if_new` overwrites an existing target file. The implementation also does not canonicalize destinations or reject symbolic-link targets. Consequently, the script's write authority is not reliably constrained to the declared workspace boundary. Configuration-derived project subdirectory and entity seed names are also used a ...[truncated 1596 chars]
Remediation: View remediation
&2; exit 1; } [[ "$value" != "." && "$value" != ".." ]] || { echo "Invalid project name: $value" >&2; exit 1; } } validate_component "$PROJECT" ``` 2. Reject `/`, `\`, `..`, control characters, leading hyphens, and empty values. 3. Apply equivalent validation to every path component loaded from `.workspace-standard.yml`, including project subdirectories and entity seed names. 4. Canonicalize the workspace and destination before writing, then verify containment: ```bash workspace_real=$(realpath "$WORKSPACE") destination_real=$(realpath -m "$workspace_real/projects/$PROJECT") case "$destination_real" in "$workspace_real/projects/"*) ;; *) echo "Destination escapes workspace" >&2; exit 1 ;; esac ``` 5. Refuse to overwrite symbolic links and validate each parent directory before writing. 6. Require explicit confirmation before `--force` overwrites an existing file, or provide a noninteractive opt-in intended specifically for trusted automation. 7. Add regression tests covering `../`, nested separators, control characters, symlink destinations, and configuration-based traversal attempts. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: README.md:190
Finding: Mutable Remote Shell Scripts Are Downloaded Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a broader workspace-standard skill that both defines and maintains/audits structured workspace conventions, including migration support, role-based taxonomy specifications, and MEMORY budget rules. The supplied code is much narrower: it initializes directories and template files, and can add a project. Those bootstrapping behaviors are consistent with part of the description, but several advertised primary capabilities are absent. There is no health audit, no maintenance procedure implementation, no migration from flat docs/, and no validation/enforcement of front-matter or memory budgets. The code does not show harmful undeclared behavior; the issue is that the description materially overstates the implemented functionality.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/workspace-init.sh (reported line 12)May include surrounding context.
sh
# Options: # --project NAME Create a single project (skip full bootstrap) # --path DIR Workspace path (default: current directory) # --force Overwrite existing files set -euo pipefail

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 172)May include surrounding context.
clawhub install workspace-standard

text
The skill installs to `skills/workspace-standard/` in your workspace. Your agent will automatically use it when it needs to decide where to write things, add a project, or run maintenance. ### Option 2: Clone from GitHub

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that the agent will 'automatically use it when it needs to decide where to write things, add a project, or run maintenance,' but it does not define concrete trigger phrases, boundaries, or exclusion conditions. This broad natural-language activation scope could cause unintended invocation during ordinary workspace conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This line describes automatic activation in generic terms without defining which tasks qualify or what contexts are excluded. Because the trigger scope is not narrowly constrained, the skill could overlap with common organizational or planning requests and activate unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill says it is automatically read when the agent needs to 'decide where to write something', 'run workspace maintenance', or 'understand what a file's role is', and adds that it 'triggers on matching tasks.' These conditions are broad, lack explicit trigger phrases or exclusions, and could overlap with many ordinary workspace interactions, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The checklist instructs the agent or user to run git add, git commit, and git push as a routine maintenance step, but it provides no warning, approval gate, or verification step before publishing changes. In an agent setting, this can cause unintended modification and exfiltration of workspace contents to a remote repository, especially because prior checklist steps aggregate and rewrite memory, references, and entity files that may contain sensitive or incorrect data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script exposes a --force option that overwrites existing files, and the implementation writes directly with echo "$content" > "$file". Although the usage text names the option, there is no explicit safety warning, confirmation, or cautionary message to the user before destructive overwrites occur.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.