ClawHub
Back to skill

Security audit

Monitoring Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local monitoring tool, but it needs review because it stores process and resource telemetry on disk while its install metadata understates those writes and retention controls are missing.

Install only if you are comfortable with a local tool recording host and running-process activity to monitoring.db and system_report.xlsx. Prefer a version that declares its file-write permissions, pins dependencies, documents exactly where data is stored, and provides clear deletion or retention controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies Allow Unreviewed Package Code

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-4
Vulnerability Type: Supply-chain dependency risk
Risk Level: Medium

Complete Code Snippet:

text
psutil
openpyxl
pandas
scikit-learn

Technical Analysis

The project declares four third-party Python packages without exact versions or cryptographic hashes. Consequently, each installation may resolve to whichever compatible release is currently available from the configured package index rather than the versions originally reviewed and tested.

This does not establish that any listed package is currently malicious. However, it removes reproducibility and integrity controls. A compromised package release, compromised package-index account, unsafe private-index precedence, or maliciously altered package source could introduce executable code after this Skill has been reviewed. Python packages may execute code during build or installation, and their imported modules execute with the privileges of the monitoring.py process.

Attack Path

  1. An attacker compromises a listed package's distribution account, package-index delivery path, or an organization's higher-priority private package source.
  2. The attacker publishes a malicious release under one of the unpinned package names.
  3. A user or automated installer resolves requirements.txt after that release becomes available.
  4. pip downloads and installs the unreviewed release because no exact version or expected hash is specified.
  5. Malicious build-time code executes during installation, or malicious runtime code executes when monitoring.py imports the dependency.
  6. The payload operates with the installing user’s or Skill process’s permissions.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account installing or invoking the Skill. The resulting scope may include access to files available to that acco ...[truncated 414 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an explicitly reviewed version, for example:
    text
    psutil==<reviewed-version>
openpyxl==<reviewed-version>
pandas==<reviewed-version>
scikit-learn==<reviewed-version>
  2. Generate a lock file that also fixes all transitive dependencies.
  3. Record SHA-256 hashes and install with:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Generate pins and hashes from a trusted, isolated build environment rather than inserting unverified versions manually.
  5. Configure an approved package index explicitly and prevent dependency resolution from untrusted or unintended extra indexes.
  6. Scan locked dependencies for known vulnerabilities and review dependency updates before regenerating the lock file.
  7. Install and execute the Skill under a non-privileged account with only the filesystem and system-information access required for local monitoring.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly states that collected process and resource metrics are saved to a local SQLite database, but it does not provide a clear user-facing warning about this persistence or the sensitivity of the stored data. Process names, CPU usage, and memory usage can reveal user activity, running applications, and operational details, so collecting and retaining them without explicit disclosure creates a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Scope Creep

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest declares only read access to system information, but the skill’s stated behavior includes saving metrics and generating reports, which implies writing files to disk. This permission mismatch can mislead users and any permission enforcement layer, causing the skill to perform actions beyond what reviewers expect and reducing transparency around its data-handling behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill collects and persists hostnames, process names, CPU usage, memory usage, and timestamps into a local SQLite database without any consent flow, disclosure, retention policy, or access controls. Even though this is framed as monitoring functionality, the stored telemetry can reveal sensitive operational details about the host and running applications, which becomes risky if the database is accessed by other local users, bundled into logs/backups, or exfiltrated by another component.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Excel export writes system telemetry, including device name, process/application names, and resource usage history, to a spreadsheet on disk with a predictable default filename and no warning or protection. Exported reports are easy to copy, email, or sync to shared storage, which increases the chance of unintended disclosure of sensitive host and process information.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
75% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · monitoring.py (reported line 265)May include surrounding context.

python
ws.append([i, m['device_name'], m['app_name'], f"{m['cpu_usage']:.3f}", f"{m['mem_usage']:.3f}", m['timestamp'], m['day'], m['week'], m['month'], m['working_day']])
        
    for column_cells in ws.columns:
        max_length = 0
        column_letter = column_cells[0].column_letter
        for cell in column_cells:
            if cell.value:

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency psutil is unpinned, which makes builds non-reproducible and can cause the skill to install a newer or older release with undiscovered or known vulnerabilities. In a monitoring skill that directly imports and executes third-party packages, this increases supply-chain risk and makes it impossible to verify whether a safe version is consistently deployed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
psutil
openpyxl
pandas
scikit-learn

Unverifiable Dependency: psutil has 2 known advisory(ies) (CVE-2019-18874 (Double Free in psutil); CVE-2019-18874 (psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs bec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

psutil has known advisories, but because the manifest does not specify a version, there is no way to determine whether deployment will pull an affected release. This uncertainty is itself a security problem because the skill monitors system resources and would execute the installed library in a privileged local context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency openpyxl is unpinned, so installations may resolve to different versions over time, including releases with security defects. Because this skill generates Excel reports, openpyxl is likely part of the active execution path, which makes version drift a practical supply-chain concern.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
psutil
openpyxl
pandas
scikit-learn

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

openpyxl has known advisories, and the lack of version pinning prevents verification that the installed release is patched. Given that the skill generates Excel output, this library is relevant to the skill's operation, so leaving the version unspecified unnecessarily increases exposure to historical parser and XML-related issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency pandas is unpinned, allowing uncontrolled version selection at install time. This can introduce vulnerable or incompatible releases into production and complicates verification of the security posture of the skill.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
psutil
openpyxl
pandas
scikit-learn

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
85% confidence
Finding

pandas has at least one advisory, and without version pinning the installed package may or may not be affected. Even though the cited issue is disputed, the manifest still prevents meaningful assessment and reproducible risk control, which is a supply-chain weakness.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency scikit-learn is unpinned, exposing the skill to non-deterministic installs and potential introduction of versions affected by published vulnerabilities. Since the skill relies on Random Forest regression, this package is core functionality and should be tightly controlled.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
psutil
openpyxl
pandas
scikit-learn

Unverifiable Dependency: scikit-learn has 6 known advisory(ies) (CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
93% confidence
Finding

scikit-learn has multiple published advisories, including issues related to deserialization, data leakage, and denial of service, but the manifest leaves the version unconstrained. Because this package is central to the predictive model, an affected version could directly impact confidentiality, availability, or safe handling of model artifacts if unsafe features are later used.

Content

No source excerpt is available for this finding.