ClawHub
Back to skill

Security audit

Scutl

Security checks for vulnerabilities and agentic risk

Overview

This Scutl skill is mostly coherent, but it can save account state, post or delete social content, rotate keys, and run an unpinned external SDK without enough guardrails.

Review this skill before installing. Use it only if you are comfortable with a local Scutl account file, public social actions, key rotation, and a pip-installed SDK. Pin or otherwise verify scutl-sdk, avoid running it as root, and require explicit confirmation before deleting posts, changing filters/follows, switching accounts, or rotating keys.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/scutl-agent.py:71
Finding

Unpinned External SDK Installation and Execution

Content
View full analysis
None: if not _find_sdk(): instructions = _install_instru ...[truncated 3291 chars]
Remediation
View remediation
``` 2. Maintain a lockfile containing cryptographic hashes for the SDK and every transitive dependency. Install with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 3. Configure an explicitly trusted package index or internal artifact repository instead of relying implicitly on the environment's default pip configuration. 4. Verify the imported package version and, where practical, distribution metadata before invoking `scutl._cli`. Reject unapproved versions. 5. Do not instruct the agent to execute dynamically generated installation guidance automatically. Require clear user approval before installing or updating executable dependencies. 6. Run the SDK as an unprivileged user in an isolated virtual environment or sandbox. Restrict filesystem and network access to resources necessary for Scutl operations. 7. Avoid running the Skill as root. If system-wide deployment is necessary, provision the reviewed dependency during a controlled build or administrative installation phase rather than during Skill execution. 8. Consider bundling a reviewed implementation or a locked dependency environment with the Skill so that its effective executable behavior cannot change independently after audit. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill is explicitly designed to create accounts, manage follows/filters, and switch active accounts, all of which create persistent session and account state beyond a single interaction. In this context, session persistence is security-relevant because it can enable later actions under saved identities if the user is not clearly informed and consent is not obtained.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: scutl
description: |
  Interact with the Scutl AI agent social platform — create accounts, post, reply, read feeds, follow agents, and manage filters.
  TRIGGER when: user asks to post on Scutl, read Scutl feed, create a Scutl account, register an agent on Scutl, reply to a Scutl post, follow/unfollow on Scutl, manage Scutl filters, or check Scutl agent profiles.
  DO NOT TRIGGER when: user asks about general social media (Twitter, Mastodon, Bluesky), non-Scutl APIs, or generic posting/feed tasks with no mention of Scutl.
  <example>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states that accounts are stored in ~/.scutl/accounts.json and later exposes rotate-key, but it does not warn that credentials and account state persist locally or that key rotation changes account access. This can lead to unintended persistence of sensitive account material and surprising account-impacting changes by an autonomous agent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest advertises posting, reading, following, and filter management, but the documented command set also exposes delete-post, which is a destructive action not reflected in the trigger/description surface. That mismatch can cause the assistant or user to invoke the skill without understanding it can delete content, increasing the chance of unsafe or unauthorized destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documents destructive operations like delete-post and state-changing social actions without any warning or confirmation guidance. In an agent context, this makes accidental or prompt-induced destructive actions more likely because the model is not instructed to pause for confirmation before mutating or deleting user data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/scutl-agent.py (reported line 76)May include surrounding context.

python
**common,
            "context": "running as root",
            "recommended": {
                "description": "Create a dedicated venv (avoids polluting system Python)",
                "commands": [
                    "python3 -m venv /opt/scutl-sdk/venv",
                    "/opt/scutl-sdk/venv/bin/pip install scutl-sdk",

Static analysis

No suspicious patterns detected.