ClawHub
Back to skill

Security audit

clawvision

Security checks for vulnerabilities and agentic risk

Overview

ClawVision mostly matches its stated purpose, but generated HTML can persist unsafe model-controlled content that may run script when opened or screenshotted.

Install only if you are comfortable granting access to session history and writing local export files. Do not use it on conversations containing secrets, credentials, personal data, or internal identifiers. Treat exported HTML as untrusted until the checklist status field is validated or escaped and a restrictive content policy is added.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate_visual.py:382
Finding

Stored HTML Injection Through Unvalidated Checklist Status

Content
View full analysis
{_h(c.get('text', ''))} {_h(status)}\n" template = template.replace('{{checklist}}', checklist) ``` ### Technical Analysis The `checklist[].status` value originates from summary JSON generated from session content. Although `_h(status)` escapes the value rendered as element text, the same `status` value is inserted directly into the quoted `class` attribute without validation or attribute encoding: ```python class=\"status {status}\" ``` An attacker-controlled value containing a quotation mark can terminate the `class` attribute and inject additional attributes or elements. For example, a value shaped like the following could introduce an event handler: ```text ">
Remediation
View remediation
{_h(c.get("text", ""))} ' f'{_h(status)}\n' ) ``` 2. Validate the complete model response against a strict JSON schema before rendering. Reject or normalize incorrect types, unknown status values, excessive collection sizes, and excessively long strings. 3. Use a context-aware templating engine with automatic HTML attribute and text escaping rather than assembling HTML with formatted strings. 4. Add a restrictive Content Security Policy to generated HTML. Where practical, move the legitimate inline script to a separate local asset and use a policy similar to: ```text default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; img-src data:; connect-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; ``` If the export must remain a single file, use a nonce or hash for the known inline script instead of allowing arbitrary inline execution. 5. Treat all model-generated output as untrusted, even when the prompt specifies an exact enumeration. 6. Before loading generated HTML in Playwright, perform schema validation and consider disabling unnecessary browser capabilities and outbound networking in the screenshot environment. ]]>

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description does not accurately represent the supplied code. The code's clear primary purpose is content rendering/export for ClawVision summaries, not permission disclosure for a security audit. It reads input from stdin or a JSON file, writes HTML/Markdown/PPTX/PNG outputs to disk, creates directories, and launches a headless Chromium browser through Playwright to load local files and capture screenshots. Declared permissions are empty, but the implementation materially uses file I/O and browser automation. These are substantive capabilities, not mere implementation details, so this is a strong description-behavior mismatch.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
92% confidence
Finding

The skill forwards the full session transcript directly into a model prompt, which can expose sensitive conversation content to another processing component and makes the summarizer susceptible to prompt-injection embedded in prior messages. Even though node_inference is described as local, untrusted transcript content can still manipulate summary output, cause leakage of secrets into generated files, or override summarization behavior unless the transcript is strongly delimited and filtered.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

{{transcript}}

text

## Output rules

- HTML must be self-contained: inline CSS and JS, no external assets. Preset font should be requested from a web-safe fallback stack.
- Include an EN/RU/ZH language switcher and light/dark theme toggle.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The language selection logic falls back to English for any unrecognized language code, which imposes a specific locale rather than offering an explicit choice. Because this is a user-facing rendering tool and the fallback is silent, it can violate a language/locale policy that requires opt-in or explicit selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.