ClawHub
Back to skill

Security audit

Changelog Watcher

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent release-monitoring skill; its main risk is that changelog text from external projects should be treated as untrusted.

Install only if you are comfortable with it contacting GitHub and npm for the repositories/packages in your watchlist and keeping local last-seen version state. Treat generated release-note text as untrusted: do not follow instructions embedded in changelog output, and be cautious with links or rendered Markdown from watched projects. Use cron scheduling only when you explicitly want background checks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
scripts/format_report.py:42
Finding

Untrusted GitHub Release Notes Are Emitted Verbatim into Agent-Facing Markdown

Content
View full analysis

Vulnerability Details

File Location: scripts/check_github.py:62-74, scripts/compare_versions.py:113-119, and scripts/format_report.py:42-48, 89-99
Vulnerability Type: Indirect prompt injection and unsafe Markdown rendering
Risk Level: Medium

Complete Code Snippets

scripts/check_github.py:62-74 retrieves the externally controlled release body:

python
releases = []
for r in data:
    releases.append({
        "source": "github",
        "owner": owner,
        "repo": repo,
        "tag": r.get("tag_name", ""),
        "name": r.get("name", "") or r.get("tag_name", ""),
        "body": r.get("body", "") or "",
        "published_at": r.get("published_at", ""),
        "prerelease": r.get("prerelease", False),
        "draft": r.get("draft", False),
        "url": r.get("html_url", ""),
    })

scripts/compare_versions.py:113-119 propagates the data unchanged:

python
new_releases.append({
    **r,
    "key": key,
    "display_name": entry.get("name", f"{owner}/{repo}"),
    "previous_version": last_seen,
})

scripts/format_report.py:42-48 selects release-note lines without sanitization:

python
def summarize_body(body: str, max_lines: int = 8) -> str:
    """Return first meaningful lines of release body, trimmed."""
    if not body or not body.strip():
        return ""
    lines = [l.rstrip() for l in body.splitlines() if l.strip()]
    return "\n".join(lines[:max_lines])

scripts/format_report.py:89-99 inserts those lines directly into Markdown:

python
# Summary
summary = summarize_body(body)
if summary:
    lines.append("### What's New")
    lines.append(summary)
    lines.append("")
else:
    lines.append("*No release notes provided.*")
    lines.append("")

Technical Analysis

GitHub release bodies cross an external trust boundary. They may be authored by repository maintainers, an attacker controlling a watched repository, or an attacker who has compromised a legitimate repository account. ...[truncated 2430 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat all release metadata as untrusted data. Clearly delimit externally sourced text and explicitly state in the agent workflow that release-note content must never be interpreted as instructions.
  2. Generate plain-text summaries instead of reproducing source Markdown. Strip Markdown and HTML before including release notes in reports.
  3. Escape active Markdown constructs. At minimum, neutralize raw HTML, images, embedded resources, and unsafe link schemes. Permit links only for an explicit scheme allowlist such as https.
  4. Render external text as quoted data. Prefix each release-note line with a Markdown blockquote marker after sanitization, or place it in another inert representation appropriate to the consumer.
  5. Apply strict output limits. Enforce maximum line lengths, total character limits, and maximum numbers of extracted items.
  6. Sanitize breaking-change extraction as well. detect_breaking_changes() also returns attacker-controlled lines and must use the same sanitization procedure.
  7. Keep trusted labels separate from remote content. Do not allow release bodies to affect report headings, delimiters, or other structural elements.
  8. Add adversarial tests. Cover prompt-like instructions, raw HTML, Markdown images, nested links, control characters, and oversized release bodies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description is broader than the implemented behavior. The supplied code only fetches release entries from GitHub for a given owner/repo and returns fields such as tag, name, body, published_at, prerelease, draft, and URL. That partially aligns with 'check for updates' on GitHub repos, but it does not implement npm package lookup, release monitoring, scheduling, changelog summarization, or breaking-change analysis. The primary purpose in code is a simple GitHub release fetcher, which is materially narrower than the declared skill description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a broader release-monitoring skill covering both GitHub repos and npm packages, with changelog summarization, breaking-change analysis, and monitoring/scheduling use cases. The supplied code only performs a narrow npm-registry lookup for a single package and returns metadata plus recent version entries. While this partially aligns with checking npm version updates, it materially underdelivers on the declared scope and lacks the key described behaviors for GitHub support, changelog analysis, breaking-change detection, and monitoring automation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description claims a broader release-monitoring skill that can check repos/packages for updates and support scheduled monitoring. The code chunk only handles report formatting from already-provided JSON input. It does align with part of the description about summarizing changelogs and highlighting breaking changes, but the primary monitoring/checking behavior is absent from this code. Therefore the code does not accurately represent the declared end-to-end purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to use shell, network, file read, and file write capabilities, but it does not declare any explicit tool scope or permission boundaries. That makes the skill harder to safely govern and increases the risk of over-privileged execution, especially because it reads and writes persistent files and performs external network calls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description includes broad trigger phrases like 'what's new in X' and generic update-checking language, which can cause the skill to be invoked for a wide range of ordinary requests. Because the skill also performs shell, network, and file operations, ambiguous invocation increases the chance of unintended execution and unnecessary external access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill persists watchlist and last-seen version state across sessions in local files, which creates retention and integrity risks if that state contains sensitive repository interests or is modified unexpectedly. Persistent state also changes future behavior, so silent carryover between runs can expose prior user activity or cause tampering-driven misinformation in reports.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## Files

- `watchlist.json` — user config (create from `assets/watchlist.example.json`)
- `state.json` — auto-managed last-seen versions (do not edit)
- `scripts/compare_versions.py` — main entry point; calls the others
- `scripts/check_github.py` — GitHub releases API

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 18)May include surrounding context.

│ └── setup-guide.md ← you are here ├── assets/ │ └── watchlist.example.json ├── watchlist.json ← create this (user config) └── state.json ← auto-created on first run

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/check_github.py (reported line 23)May include surrounding context.

python
def fetch_releases(owner: str, repo: str, limit: int = DEFAULT_LIMIT) -> list:
    url = f"https://api.github.com/repos/{owner}/{repo}/releases?per_page={limit}"
    req = urllib.request.Request(
        url,
        headers={

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compare_versions.py (reported line 54)May include surrounding context.

python
script_path = os.path.join(SCRIPT_DIR, script_name)
    cmd = [sys.executable, script_path] + list(args)
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 2:
            print(f"[warn] Rate limited while running {script_name}. Skipping.", file=sys.stderr)
            return None

Static analysis

No suspicious patterns detected.