ClawHub
Back to skill

Security audit

Mechanics Sketches

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local engineering-sketch helper, but its install and import path choices create review-worthy supply-chain and local code-hijacking risk.

Install only in an isolated virtual environment without administrator privileges, prefer a pinned commit or reviewed release of MechanicsSketches, and avoid running the helper from shared or world-writable directory layouts until the import-path behavior is fixed.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/generate_sketch.py:17
Finding

Python Import Path Precedence Enables Local Package Hijacking

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Git Dependency Allows Mutable Upstream Code Execution

Content
View full analysis
Remediation
View remediation
" ``` 2. Prefer a trusted package registry release with an exact version rather than installing directly from a mutable Git branch. 3. Maintain a lock file containing exact versions and cryptographic hashes for the dependency and its transitive dependencies. Use hash-enforced installation where supported. 4. Review and update pinned revisions through a controlled dependency-update process. Each update should include source review, automated security scanning, and rendering tests. 5. Install dependencies inside a dedicated virtual environment without administrative privileges. 6. Correct the security documentation in `SKILL.md`. The statement that the skill makes no network requests should distinguish runtime rendering from setup, because the documented installation command performs a network fetch and introduces supply-chain exposure. ]]>

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
95% confidence
Finding

The setup instructions tell users to install code directly from a remote GitHub repository using pip install git+https://..., which executes arbitrary package build/install logic from a moving remote source. This creates a supply-chain risk: if the repository, dependency chain, or referenced revision is compromised, users may run attacker-controlled code during installation.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

gineering figures. license: MIT homepage: https://github.com/MatthiasHBusch/MechanicsSketches metadata: {"author": "MatthiasHBusch", "version": "1.0.0"} files: ["scripts/", "references/"]

MechanicsSketches Skill

You can generate engineering mechanics sketches programmatically using the MechanicsSketches Python library.

Setup

Install the library via pip:

bash
pip install git+https://github.com/MatthiasHBusch/MechanicsSketches.git

Or install dependencies manually and add to PYTHONPATH:

bash
pip install matplotlib PyQt5
export PYTHONPATH="/path/to/parent/of/MechanicsSketches:$PYTHONPATH"

Quick Start — Writing a Script

Create a Python script that builds a sketch and renders it:

python
from MechanicsSketches import *
import os

sketch = create_sketch("My Sketch")
S = 30.0  # Scale factor (recommended: 20-40)

# Add components
add_beam(sketch, ax=0, ay=0, bx=10*S, by=0, scale_factor=S)
add_pinned_support(

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.