ClawHub
Back to skill

Security audit

OSV Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a purpose-aligned vulnerability scanner, but it sends package/version data to OSV and has packaging and dependency-pinning hygiene issues.

Install and run it only in a dedicated virtual environment, avoid running it as root or administrator, and do not use os mode on sensitive hosts unless sharing installed package names and versions with OSV is acceptable. Prefer pinned dependency versions and verify the renamed XLSX template before relying on report generation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Runtime Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-18, SKILL.md:26-28, README.md:16-18, and README.md:26-28
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown
- python3 -m venv .venv
- pip install requests openpyxl
- source .venv/bin/activate

The Windows instructions contain the same unpinned installation command:

markdown
- python3 -m venv .venv
- pip install requests openpyxl
- ./.venv/Script/Activate.ps1

Technical Analysis

The installation instructions retrieve requests, openpyxl, and their transitive dependencies from the configured Python package index without pinning reviewed versions or validating artifact hashes. Consequently, the code installed by users can change after the Skill has been audited.

Python packages may execute code during installation or when imported by scanner.py. An upstream account compromise, malicious replacement release, compromised package index, or unsafe custom package-index configuration could therefore introduce attacker-controlled code into the Skill environment. The use of a virtual environment limits package placement but does not prevent installation or runtime code from executing with the current user's operating-system privileges.

No evidence was found that the listed packages are currently malicious. This finding concerns the absence of dependency reproducibility and integrity controls.

Attack Path

  1. An attacker compromises an upstream package, one of its transitive dependencies, or a package index used by the victim.
  2. The attacker publishes a malicious release that satisfies the unrestricted dependency names.
  3. A user follows the documented pip install requests openpyxl command.
  4. Pip resolves and installs the attacker-controlled release because no exact version or cryptographic hash is required.
  5. Malicious installation logic executes during installatio ...[truncated 848 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed dependency file containing exact versions for all direct and transitive dependencies.

  2. Generate and record cryptographic hashes for every approved distribution artifact.

  3. Install dependencies using hash enforcement, for example:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  4. Use a lock-generation tool such as pip-tools to produce reproducible dependency sets:

    bash
    pip-compile --generate-hashes requirements.in

  5. Review and update the lock file through a controlled process that includes vulnerability scanning and testing.

  6. Configure pip to use an explicitly trusted package index and avoid unreviewed additional indexes.

  7. Apply the corrected installation instructions consistently in both SKILL.md and README.md.

  8. Continue installing into a dedicated virtual environment and avoid running installation or scanning commands with administrator or root privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scanner.py (reported line 36)May include surrounding context.

python
lines = file.readlines()
    eco = 'Red Hat'
elif program == 'os':
    result = subprocess.run(
        "lsb_release -a | grep 'Distributor ID' | awk '{print $3}'",
        shell=True,
        capture_output=True,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scanner.py (reported line 47)May include surrounding context.

python
if eco.lower() in operatingSystems:
        if eco == 'kali':
            eco = 'Debian'
        result = subprocess.run(
            "dpkg-query -W -f='${binary:Package} ${Version}\n'",
            shell=True,
            capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script transmits package names, versions, and in OS mode the host's installed package inventory to an external service without explicit user notice or consent. Dependency inventories can reveal sensitive information about internal systems, installed software, and patch posture, creating privacy and reconnaissance risk if used in sensitive environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The hard-coded external endpoint indicates all lookups are performed against a third-party service, creating a built-in data exfiltration path for package inventory. The risk is contextual rather than malicious: in security tooling, dependency lists may still be confidential operational data.

Content

Scanner excerpt · scanner.py (reported line 10)May include surrounding context.

python
NEW_FILE = f'ScanResult_{datetime.date.today()}.xlsx'

def getCVEversion(name, version, ecosystem):
    url = 'https://api.osv.dev/v1/query'
    payload = {
        "version": version,
        "package": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This POST request sends package metadata to a third-party API, which can disclose sensitive dependency and system inventory information. In enterprise or restricted environments, such telemetry can aid fingerprinting of internal assets and reveal vulnerable or proprietary software usage.

Content

Scanner excerpt · scanner.py (reported line 18)May include surrounding context.

python
"ecosystem": ecosystem
        }
    }
    res = requests.post(url, json=payload).json()
    
    if 'vulns' in res:
        return res['vulns']

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scanner.py (reported line 36)May include surrounding context.

python
lines = file.readlines()
    eco = 'Red Hat'
elif program == 'os':
    result = subprocess.run(
        "lsb_release -a | grep 'Distributor ID' | awk '{print $3}'",
        shell=True,
        capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script invokes shell commands via subprocess.run with shell=True to inspect the operating system and installed packages. Although errors and usage are printed, there is no explicit disclosure that the skill will execute shell commands on the host, which is a safety-relevant action for code files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scanner.py (reported line 47)May include surrounding context.

python
if eco.lower() in operatingSystems:
        if eco == 'kali':
            eco = 'Debian'
        result = subprocess.run(
            "dpkg-query -W -f='${binary:Package} ${Version}\n'",
            shell=True,
            capture_output=True,

Ae2

Medium
Category
analysis-evasion
Confidence
90% confidence
Finding

Artifact content does not match its filename extension

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README states the tool scans "Node.js/NPM dependencies and Linux Packages" using OSV API, which implies Linux system package support. However, the documented workflow only references package.json and pip freeze > packages.txt, indicating Node.js and Python dependency scanning rather than Linux OS package scanning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file describes that the tool reads project package information and sends it to the Google OSV API, but it does not include any warning about transmitting project dependency metadata to an external service. Under the markdown-specific warning rule, behaviors that may affect privacy should be disclosed to users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The opening note instructs the user to change a ScanResult file extension in the template, which is unrelated to the later-described workflow of reading package manifests and sending dependency data to the OSV API. This creates an intent/documentation inconsistency within the skill documentation itself about what artifacts the skill expects or produces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

When vulnerabilities are found, the script copies a template and saves results into a new workbook file. This file write is not destructive, but it is still a filesystem-modifying action with no explicit warning beyond the implicit behavior in the code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.