ClawHub
Back to skill

Security audit

Net Detective

Security checks for vulnerabilities and agentic risk

Overview

This skill runs disclosed network diagnostic tests and stores limited local history, with no evidence of deception or malicious behavior.

Install only if you are comfortable with active network tests. Avoid running it with sudo, do not share raw diagnostic JSON from sensitive networks, and replace the documented /tmp filenames with a private temporary directory such as one created by mktemp -d with restrictive permissions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:29
Finding

Predictable shared temporary files permit symlink-based file overwrite

Content
View full analysis
/tmp/net-diag.json ``` Add `--speed` to include a bandwidth test (adds ~20s): ```bash python3 scripts/diagnose.py --speed > /tmp/net-diag.json ``` Skip traceroute or MTU if time-constrained: ```bash python3 scripts/diagnose.py --no-traceroute --no-mtu > /tmp/net-diag.json ``` ### 2. Compare against history (if available) ```bash python3 scripts/history.py --compare /tmp/net-diag.json > /tmp/net-history.json ``` The same predictable history file is subsequently consumed when generating a report: ```bash python3 scripts/report.py /tmp/net-diag.json --history-compare /tmp/net-history.json ``` ### Technical Analysis `/tmp` is normally writable by every local user. Although its sticky bit prevents users from deleting each other's files, it does not prevent an attacker from creating an unused predictable filename before the victim does. Shell output redirection opens the destination while following symbolic links and ordinarily truncates an existing target. The workflow does not securely create the files, verify their ownership or type, use exclusive creation, or place them in a private directory. Consequently, a local attacker can pre-create `/tmp/net-diag.json` or `/tmp/net-history.json` as a symbolic link to another file writable by the victim. The issue is in the documented execution workflow rather than the Python subprocess calls. The flagged `subprocess.run` invocation at `scripts/diagnose.py:42-43` is only a fixed localhost `ping` capability probe and is not a reverse shell. ### Attack Path 1. An attacker with access to the same host predicts that the victim will follow the documented Net Detective wo ...[truncated 1543 chars]
Remediation
View remediation
"$diag_file" python3 scripts/history.py --compare "$diag_file" > "$history_file" python3 scripts/report.py "$diag_file" --history-compare "$history_file" ``` Additional hardening measures: 1. Document that the workflow must not be run with `sudo` or another elevated account. 2. Set a restrictive umask, such as `umask 077`, before creating files containing local network metadata. 3. If scripts gain direct output-file support, create files atomically using exclusive creation and mode `0600`. 4. Validate that any existing destination is a regular file owned by the current user and reject symbolic links. 5. Delete temporary diagnostics promptly after report generation unless the user explicitly chooses to retain them. 6. Prefer a user-private runtime directory, such as `$XDG_RUNTIME_DIR`, when available. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description uses broad activation phrases such as "internet problems," "connection issues," and "network diagnostic," which can cause the skill to trigger in situations where the user did not clearly consent to active network testing. Because the skill runs potentially intrusive diagnostics like traceroute, DNS queries, MTU probing, and optional speed tests, overbroad routing increases the chance of unnecessary network activity and unintended data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow instructs the agent to run active diagnostics and save results without warning the user that these steps may generate network traffic, contact external resolvers or servers, and persist diagnostic history locally. This omission undermines informed consent and can expose sensitive network metadata, especially in enterprise, monitored, metered, or privacy-sensitive environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 42)May include surrounding context.

python
if PING_BIN is None:
        for path in ["/sbin/ping", "/bin/ping", "/usr/bin/ping", "ping"]:
            try:
                subprocess.run([path, "-c", "1", "-W", "500", "127.0.0.1"],
                               capture_output=True, timeout=2)
                PING_BIN = path
                break

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 64)May include surrounding context.

python
cmd = [ping_bin, "-c", str(count), "-W", "2", host]

    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=20
        )
        output = result.stdout + result.stderr

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 109)May include surrounding context.

python
def find_traceroute():
    for path in ["/usr/sbin/traceroute", "/sbin/traceroute", "/usr/bin/traceroute", "traceroute"]:
        try:
            subprocess.run([path, "--help"], capture_output=True, timeout=2)
            return path
        except FileNotFoundError:
            continue

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Traceroute output can reveal internal or semi-internal network topology, intermediary hops, and latency characteristics, which may expose sensitive infrastructure details when the resulting JSON is shared, logged, or sent elsewhere. In a diagnostic skill this collection is functionally relevant, but the automatic capture and raw output of route data without explicit consent or minimization creates a real privacy and reconnaissance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 126)May include surrounding context.

python
cmd = [tr_bin, "-m", str(max_hops), "-w", "2", "--", host]

    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=60
        )
        output = result.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 200)May include surrounding context.

python
# to find max working payload size.
        def probe(size):
            try:
                result = subprocess.run(
                    [ping_bin, "-c", "1", "-W", "2000", "-s", str(size), host],
                    capture_output=True, text=True, timeout=5
                )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 211)May include surrounding context.

python
# Linux: ping -M do sets DF bit; returns non-zero if packet too large
        def probe(size):
            try:
                result = subprocess.run(
                    [ping_bin, "-c", "1", "-W", "2", "-M", "do", "-s", str(size), host],
                    capture_output=True, text=True, timeout=5
                )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Collecting and outputting the local hostname, local IP address, and default gateway discloses internal network identifiers that can aid environment fingerprinting and lateral movement planning if exposed to logs, remote services, or untrusted users. In a networking diagnostic tool this data may be useful, but emitting it by default without notice or redaction creates an unnecessary information-disclosure issue.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 257)May include surrounding context.

python
gateway = None
    try:
        if IS_MAC:
            r = subprocess.run(["route", "-n", "get", "default"], capture_output=True, text=True, timeout=5)
            m = re.search(r"gateway:\s+([\d.]+)", r.stdout)
            if m:
                gateway = m.group(1)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 262)May include surrounding context.

python
if m:
                gateway = m.group(1)
        else:
            r = subprocess.run(["ip", "route", "show", "default"], capture_output=True, text=True, timeout=5)
            m = re.search(r"default\s+via\s+([\d.]+)", r.stdout)
            if m:
                gateway = m.group(1)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 280)May include surrounding context.

python
script_dir = os.path.dirname(os.path.abspath(__file__))
    dns_script = os.path.join(script_dir, "dns_check.py")
    try:
        result = subprocess.run(
            [sys.executable, dns_script],
            capture_output=True, text=True, timeout=30
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 300)May include surrounding context.

python
if quick:
        args.append("--quick")
    try:
        result = subprocess.run(args, capture_output=True, text=True, timeout=60)
        return json.loads(result.stdout)
    except Exception as e:
        return {"error": str(e)}

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/speedtest.py (reported line 35)May include surrounding context.

python
]
    start = time.monotonic()
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,