ClawHub
Back to skill

Security audit

Parallel FindAll

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent and purpose-aligned, but its documented shell command pattern can expose users to command injection if an agent inserts a user-supplied objective directly into the example command.

Review before installing. The skill appears intended for legitimate Parallel FindAll use, but agents should not build shell command strings by interpolating raw user objectives. Use a structured argument invocation or carefully escape user-provided objectives before calling `parallel-cli`.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Unsanitized Natural-Language Objective May Enable Shell Command Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–36
Vulnerability Type: Shell command injection through unsafe command construction
Risk Level: Medium

The skill instructs the agent to place a natural-language objective directly into a shell command:

bash
parallel-cli findall run "<objective>" [options]
parallel-cli findall status frun_xxx --json
parallel-cli findall poll frun_xxx --json
parallel-cli findall result frun_xxx --json
parallel-cli findall extend frun_xxx <n> --json
parallel-cli findall cancel frun_xxx

Technical Analysis

The <objective> value will commonly originate from untrusted user input. The skill documents command construction through a shell command string but does not require argument-array execution, shell escaping, input validation, or rejection of shell metacharacters.

Merely surrounding the objective with double quotes does not make arbitrary input safe. Shell command substitutions such as $() and backticks remain active inside double-quoted strings. An input containing a double quote can also terminate the quoted argument and introduce shell operators such as ;, |, &&, or redirection.

The vulnerability is conditional on the invoking agent substituting the user's objective into the documented command and executing it through a shell. Implementations that pass the objective as a discrete argument without invoking a shell are not vulnerable.

Attack Path

  1. An attacker submits a FindAll request whose natural-language objective contains shell syntax, such as a command substitution or a quote followed by a shell operator.
  2. The agent follows the skill documentation and replaces <objective> in the displayed shell command with the supplied text.
  3. The constructed command is executed using a shell.
  4. The shell evaluates the injected syntax before or alongside parallel-cli.
  5. The attacker's command executes wi ...[truncated 1009 chars]
Remediation
View remediation

Remediation Suggestions

  • Require execution through a process API that accepts an argument array, without a shell. For example, pass ["parallel-cli", "findall", "run", objective, "--json"] directly to the process launcher.
  • Explicitly prohibit constructing shell command strings by concatenating or interpolating the user-provided objective.
  • If a shell is unavoidable, apply a well-tested platform-specific shell-escaping function to every untrusted argument. Do not rely on adding double quotes manually.
  • Validate ancillary values as well: require run IDs to match the expected frun_... format and require numeric options such as match limits to contain only digits within documented bounds.
  • Update all examples to distinguish literal shell examples from dynamically generated invocations and add a security warning that objectives are untrusted data.
  • Prefer the CLI's structured invocation interface or a native API client so natural-language objectives are transmitted as data rather than interpreted as command syntax.
  • Add regression tests using objectives containing spaces, quotes, semicolons, pipes, backticks, $(), newlines, and redirection characters, verifying that none are evaluated by a shell.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.