ClawHub
Back to skill

Security audit

nanyuu

Security checks for vulnerabilities and agentic risk

Overview

This skill handles sensitive ride receipt data, but its access, local processing, persistence, and Gateway use are disclosed and aligned with its stated purpose.

Install only if you are comfortable letting the skill read scoped ride receipt emails from the selected Gmail account and store raw receipt HTML locally. Prefer running it on a single-user machine or inside a private workspace, delete data/ride-insights/emails.json when no longer needed, and review exported CSV files before opening them in spreadsheet software or sharing them.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_emails_json.py:128
Finding

Sensitive ride and email artifacts are created without restrictive filesystem permissions

Content
View full analysis
Remediation
View remediation

other

Warning
Location
scripts/extract_rides_gateway.py:98
Finding

Attacker-controlled receipt HTML can indirectly inject instructions into the extraction model

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/export_anonymized_rides_csv.py:160
Finding

Exported CSV fields are not neutralized against spreadsheet formula injection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'req' from os.environ.get (line 104, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/extract_rides_gateway.py (reported line 113)May include surrounding context.

python
},
        method='POST',
    )
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        body = json.loads(resp.read().decode('utf-8'))
    for item in body.get('output', []):
        if item.get('type') == 'message':

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_emails_json.py (reported line 23)May include surrounding context.

python
last_err = None
    for attempt in range(1, retries + 1):
        try:
            out = subprocess.check_output(cmd, text=True, stderr=subprocess.STDOUT)
            return json.loads(out)
        except subprocess.CalledProcessError as e:
            last_err = e

Static analysis

No suspicious patterns detected.