ClawHub
Back to skill

Security audit

Baud

Security checks for vulnerabilities and agentic risk

Overview

This skill is a safety-focused guide for using a serial-device CLI and does not show hidden, deceptive, persistent, or unrelated behavior.

Before installing, confirm you trust the `baud-cli` package source and consider pinning or verifying the version yourself. Use the skill's safety gates carefully because serial commands can affect connected hardware, especially motion, heating, flashing, reset, or persistent configuration changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
2. If the command is unavailable, report the missing prerequisite. When installation is authorized, use `uv tool install baud-cli`; use `uv run --directory <baud-cli-repo> baud` only when the source checkout is known. Do not silently replace it with an ad hoc `pyserial` script.

Technical Analysis

The documented installation command retrieves baud-cli without pinning a reviewed version, verifying a package hash or signature, or specifying an approved package index. Consequently, the package selected at installation time can differ from the package that existed when this Skill was audited.

Although installation is conditioned on user authorization, authorization alone does not establish package integrity. Once installed, the CLI is trusted to enumerate serial devices, open ports, transmit commands, process workflow files, and interact with connected hardware. A compromised package registry account, malicious future release, or dependency-chain compromise could therefore introduce attacker-controlled executable code.

The alternative source-checkout command is limited to a checkout described as “known,” but the documentation does not prescribe commit pinning or cryptographic provenance verification.

Attack Path

  1. An attacker compromises the baud-cli package, its maintainer account, or an upstream dependency and publishes a malicious release.
  2. The target system does not already have the baud command.
  3. The user authorizes installation according to the Skill instructions.
  4. The Agent runs uv tool install baud-cli, which resolves the current package release without a reviewed version or hash constraint.
  5. Malicious package installation or runtime code executes with the privileges of the invoking user.
  6. During subse ...[truncated 829 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin baud-cli to a specific reviewed version rather than installing the latest available release.
  2. Use lockfile or hash-based verification so the resolved package and transitive dependencies match audited artifacts.
  3. Specify the approved package index and canonical project identity to reduce dependency-confusion and package-spoofing risks.
  4. Verify signed release provenance or attestations where the package ecosystem supports them.
  5. For source-checkout execution, require a reviewed immutable commit hash rather than a mutable branch or tag.
  6. Document a controlled upgrade process that reviews release changes and refreshes integrity metadata before changing the pinned version.
  7. Where practical, run the CLI with only the filesystem, network, and device permissions required for the authorized serial task.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.