ClawHub
Back to skill

Security audit

Machiavelli Library

Security checks for vulnerabilities and agentic risk

Overview

The skill is a focused Machiavelli text-search helper, but it asks users to install an unpinned external GitHub repository directly as the active skill, so the reviewed behavior could change after installation.

Review before installing. The main risk is not the current packaged code, but the first-use git clone: it pulls changing content from a personal GitHub repository directly into the skill directory. Install only if you trust that upstream source, and prefer a pinned reviewed commit or a data-only directory. Avoid untrusted option-like search keywords until the grep wrapper is hardened.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned External Repository Installed into the Active Skill Directory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–32
Vulnerability Type: Untrusted mutable supply-chain dependency
Risk Level: Medium

Vulnerable Code

bash
git clone https://github.com/niflhum/machiavelli-library.git ~/.workbuddy/skills/machiavelli-library

Technical Analysis

The packaged artifact does not contain the library/ directory required for its advertised search functionality. Instead, the installation instructions direct users to clone a repository from a personal GitHub namespace into the active Skill installation directory.

The command does not pin a reviewed commit or immutable release and does not verify a cryptographic digest or signature. The effective Skill contents can therefore change after this artifact has been reviewed. Because the destination is the active Skill directory rather than a dedicated data directory, the downloaded repository may replace existing instructions or introduce additional scripts and configuration alongside the expected textual corpus.

The reviewed command only downloads files; it does not itself execute downloaded code. Nevertheless, later agent behavior may load modified Skill instructions or invoke newly introduced scripts from that directory.

Attack Path

  1. An attacker compromises the upstream repository, its maintainer account, or the repository's default branch.
  2. The attacker modifies Skill instructions, scripts, or other files in the repository.
  3. A user follows the documented first-use command.
  4. Git retrieves the current mutable default branch without commit or integrity verification.
  5. The files are placed in the active Skill installation directory.
  6. A subsequent agent session may load the altered instructions or execute introduced scripts as part of normal Skill use.

Impact Assessment

Exploitation could modify the effective behavior of the Skill after review. The resulting access would be limited to the pr ...[truncated 459 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle the required text corpus with the reviewed Skill package whenever licensing and package-size constraints permit.
  2. If external retrieval is necessary, pin the source to a specific reviewed commit rather than the mutable default branch.
  3. Publish and verify a cryptographic digest or signed manifest before accepting downloaded files.
  4. Store downloaded corpus data in a dedicated non-executable data directory outside the active Skill instruction and script directory.
  5. Enforce an allowlist of expected paths and file types, rejecting scripts, symbolic links, Skill manifests, and unexpected executable files.
  6. Document the exact reviewed repository revision and provide a controlled update process requiring revalidation before activation.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search.py:9
Finding

Grep Option Injection Through an Untrusted Search Keyword

Content
View full analysis

Vulnerability Details

File Location: scripts/search.py, lines 9–11
Vulnerability Type: Argument and option injection
Risk Level: Medium

Vulnerable Code

python
def search(keyword, lang=None, limit=10):
    cmd = ['grep', '-rnH', '-i', '--color=never', keyword, LIBRARY]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

Technical Analysis

The script safely avoids shell interpretation by passing an argument list to subprocess.run; therefore, ordinary shell metacharacters do not provide direct command execution. However, the command does not place the -- end-of-options delimiter before the attacker-controlled keyword.

If the keyword begins with a hyphen, grep can interpret it as an option rather than as a search pattern. This permits option injection. Depending on the installed grep implementation, an attacker may supply options that alter recursive traversal, select or exclude files, read patterns or configuration from another accessible file, change output behavior, or substantially increase resource use.

The 30-second timeout limits execution duration, but it does not prevent unintended file access before termination. The broad exception handler also converts many failures into ordinary search errors, which may obscure attempted exploitation.

Attack Path

  1. An attacker supplies an option-shaped search term beginning with -.
  2. The Skill invokes the documented fallback command with that value as the positional keyword.
  3. argparse or a direct import-based caller passes the value to search.
  4. The script inserts the value before LIBRARY without an end-of-options delimiter.
  5. grep parses the value as one or more command-line options.
  6. The injected option changes file selection, reads an attacker-selected accessible file as a pattern source, triggers errors, or consumes resources until completion or timeout.

When invok ...[truncated 870 chars]

Remediation
View remediation

Remediation Suggestions

Insert an explicit end-of-options delimiter before the untrusted keyword:

python
cmd = [
    'grep',
    '-rnH',
    '-i',
    '--color=never',
    '--',
    keyword,
    LIBRARY,
]

Additional hardening measures should include:

  1. Enforce a reasonable maximum keyword length.
  2. Reject NUL characters and unnecessary control characters.
  3. Validate that limit is positive and impose a conservative upper bound.
  4. Use Python-native file traversal and literal substring matching where regular-expression behavior is not required.
  5. If regular expressions are intended, clearly distinguish literal and regex modes and constrain expensive patterns.
  6. Log search failures securely without exposing sensitive filesystem details to untrusted users.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 77)May include surrounding context.

md
## 扩展 | Adding New Books

1. Place text file in appropriate `library/` subdirectory
2. Add entry to `catalog/catalog.json`
3. Run `python3 scripts/build-index.py` (or rebuild indexes manually)
4. No code changes needed

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The keyword trigger "马基雅维利在哪" is underspecified and can match ordinary questions such as asking where Machiavelli is, without clearly signaling intent to invoke a text-search skill. The manifest does not provide exclusion conditions or narrower scope for this phrase, so it risks unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file hardcodes Chinese-language descriptions and runtime messages, including the module docstring, argument help text, and output strings, while only allowing language selection for search results filtering. This creates a language/locale policy issue because the user interface is fixed to Chinese rather than offering a user-facing language choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/search.py (reported line 11)May include surrounding context.

python
def search(keyword, lang=None, limit=10):
    cmd = ['grep', '-rnH', '-i', '--color=never', keyword, LIBRARY]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        lines = [l.strip() for l in result.stdout.strip().split('\n') if l.strip()]

        if lang == 'en':

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The text states that queries return both Chinese and English results, which imposes a fixed language behavior rather than letting the user choose a preferred language. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The English description states users will receive passages "with citations in both languages," which imposes a fixed language/locale behavior rather than letting the user choose output language. This is a natural-language policy concern because the skill appears to force a specific bilingual format without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file is written exclusively in Chinese and does not indicate that the user opted into that language or that the skill is intended only for a Chinese-language audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file is entirely written in Chinese and provides no indication that language selection is optional or that the skill is intentionally region- or language-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.