T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:25- Finding
Global Instruction Hijacking Forces CLAM Use for Mac Application Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Tool Scout
Security checks for vulnerabilities and agentic risk
Overview
This skill openly aims to let an AI control Mac apps, but it asks for broad local automation authority with overbroad triggers and delegates execution to unaudited pip-installed code.
Install only if you are comfortable giving an AI-controlled tool access to automate local Mac apps. Use a virtual environment, review the actual clam-mac package source before granting Automation or Accessibility permissions, avoid enabling Mail/Calendar/Reminders unless needed, and require confirmation before installing wrappers, reading sensitive app data, sending messages, moving files, or changing persistent MCP/shell configuration.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
pyproject.toml:27- Finding
Unpinned Runtime Dependencies and Unauditable External Package Installation
- Content
View full analysis
=8.0", "jinja2>=3.1", "rich>=13.0", "mcp>=1.0.0", ] ``` The skill also directs installation from the default Python package index: ```bash pip install clam-mac ``` ### Technical Analysis All runtime dependencies use open-ended lower bounds. No exact versions, lock file, package hashes, or constraints file are included. Consequently, identical installation commands can resolve to different dependency versions over time. More importantly, the audited artifact contains only documentation, metadata, and a license. Although `pyproject.toml` declares entry points under `clam.cli` and `clam.mcp_server`, the corresponding `src/` implementation is absent from the supplied project. The behavior of the package installed by `pip install clam-mac` therefore cannot be verified from this artifact. This creates a supply-chain trust gap: the reviewed skill delegates its effective execution behavior to mutable external package-index content. A future compromised release, compromised dependency, or malicious transitive dependency could execute with the permissions available to the invoking user. No evidence in the supplied files proves that the current named packages are malicious. The vulnerability is the mutable and unauditable dependency installation model used for a tool that requests powerful macOS automation capabilities. ### Attack Path 1. The skill instructs the agent or user to run `pip install clam-mac`. 2. `pip` queries its configured package index and resolves the latest compatible release and dependencies. 3. Because versions and hashes are not pinned, the resolved artifacts may differ from those originally reviewed or tested. 4. Package installation and ...[truncated 1103 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger rule says any mention of a Mac app should invoke this skill first, which is excessively broad and can cause the agent to route many unrelated or sensitive requests into a high-privilege automation path. Because this skill can install wrappers and control local apps, over-invocation increases the chance of unintended access to email, files, browser state, and other private data without a sufficiently specific user request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes AI access to Apple Mail, Calendar, Reminders, and media/control surfaces without any meaningful warning about sensitive data exposure, destructive actions, or required trust boundaries. In the context of an agent skill whose purpose is to let AI control local applications, this omission is dangerous because users may enable broad automation/privacy permissions without understanding that an LLM or connected agent could read private content or perform unintended actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README normalizes automatic app discovery, wrapper generation/installation, and agent-driven command execution as frictionless defaults, but does not clearly warn that this effectively grants an AI-driven interface broad local control over installed macOS apps. Because the skill is specifically designed for autonomous agents and MCP tooling, the lack of guardrails or operator warnings increases the risk of privacy loss, unintended side effects, and misuse through overbroad automation permissions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly instructs the agent to install wrappers and read from Calendar, Mail, and Reminders, but it does not require a clear privacy notice or explicit consent before accessing those data sources. Even if framed as a helpful briefing, these apps contain sensitive personal and work information, so silent access creates a real privacy and data-minimization risk.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 1. Read all unread messages from Mail 2. Categorize: needs reply / FYI only / can archive 3. **Show the categorization to the user FIRST — do not take action without confirmation** 4. After user confirms: archive safe emails, mark FYI as read 5. Leave important emails untouched in inbox
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Listing all files in ~/Downloads is a form of filesystem enumeration that can expose sensitive filenames, document types, installers, and timestamps. In context, the user scenario is legitimate organization of Downloads, but the instruction still encourages broad collection of local file metadata before any minimization or filtering is applied.
- Content
md User says: "Clean up my Downloads folder" / "帮我整理 Downloads" 1. Use Finder to list all files in ~/Downloads (name, size, date, type) 2. Categorize: documents, images, installers, code, temp files 3. **Show the plan to the user FIRST — list what goes where** 4. After user confirms: create subfolders, move files
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This is a manifest file, so vague-trigger review applies. The description 'Give any AI Agent hands to control your Mac' is extremely broad and lacks constraints on when or how the skill should be invoked, which could overlap with many generic automation requests and lead to unintended activation.
- Content
Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: click has 1 known advisory(ies) (CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: jinja2 has 16 known advisory(ies) (CVE-2019-10906 (Jinja2 sandbox escape via string formatting); CVE-2014-1402 (Incorrect Privilege Assignment in Jinja2); CVE-2025-27516 (Jinja2 vulnerable to sandbox breakout through attr filter selecting format metho) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Static analysis
No suspicious patterns detected.