ClawHub
Back to skill

Security audit

Sentinel Mood

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small sentiment analyzer whose behavior matches its stated purpose, with a disclosed but imperfectly controlled NLTK/VADER dependency download.

Install this only if you are comfortable with NLTK being installed from your Python package source and the VADER lexicon being downloaded if it is missing. For locked-down or offline environments, preinstall and verify the NLTK package and vader_lexicon resource before using the skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
analyze.py:6
Finding

Unpinned NLTK Dependency and Unverified Runtime Lexicon Download

Content
View full analysis

Vulnerability Details

File Location: analyze.py:6-10
Additional Location: SKILL.md:27-30
Vulnerability Type: Supply-chain risk from an unpinned dependency and runtime resource retrieval without application-level integrity verification
Risk Level: Medium

Vulnerable Code

analyze.py:6-10:

python
def ensure_vader():
    try:
        nltk.data.find('sentiment/vader_lexicon.zip')
    except LookupError:
        # Download quietly
        nltk.download('vader_lexicon', quiet=True)

SKILL.md:27-30:

markdown
- Python 3
- `nltk` library (`pip install nltk`)
- `vader_lexicon` (downloaded via `nltk.downloader`)

Technical Analysis

The documented installation command installs nltk without a pinned version, lockfile, or package hash. Consequently, the exact code installed depends on the package version resolved when installation occurs.

In addition, ensure_vader() automatically invokes NLTK's downloader if the VADER resource is unavailable. The application does not pin a specific lexicon artifact or independently validate its checksum before use. This means the effective runtime data can depend on externally mutable package repositories, downloader metadata, and upstream resources after the skill has been reviewed.

The download is documented, and the reviewed project does not itself fetch or execute arbitrary source code. This finding is therefore a supply-chain hardening issue rather than evidence of an embedded malicious payload.

Attack Path

  1. An attacker compromises or successfully substitutes an NLTK package release, package distribution source, downloader index, or upstream VADER resource.
  2. A user installs the unpinned nltk dependency, or invokes the skill in an environment where vader_lexicon is absent.
  3. The environment resolves attacker-influenced package content or ensure_vader() silently initiates retrieval through nltk.download().

...[truncated 952 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin NLTK to a reviewed exact version in a requirements file, such as nltk==<reviewed-version>.
  2. Generate and enforce a lockfile containing cryptographic hashes, for example with pip-compile --generate-hashes, and install using pip install --require-hashes.
  3. Retrieve the VADER lexicon during a controlled build or installation phase rather than automatically during normal execution.
  4. Pin the expected lexicon artifact and verify its cryptographic checksum before making it available to the application.
  5. Replace the implicit runtime download with a clear error explaining how to install the verified resource when it is absent.
  6. Use trusted package indexes over TLS, restrict alternate indexes, and periodically review dependency and artifact updates before changing pinned versions.
  7. Run the skill under a least-privileged account with limited filesystem and network access to reduce the effect of any future supply-chain compromise.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill performs a runtime download of the VADER lexicon if it is not already present, which introduces undeclared network behavior into a tool described as local sentiment analysis. This expands the trust boundary to external infrastructure, can fail unpredictably in restricted environments, and may violate expectations around offline operation or supply-chain control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Automatic network download is not necessary for the core advertised function once dependencies are packaged correctly, so the code grants extra capability beyond the stated purpose. While not obviously malicious, this unnecessary egress increases attack surface and can surprise users operating under strict security or privacy assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code silently downloads NLTK data without any user-facing disclosure, consent, or warning, which undermines transparency and can trigger unexpected outbound connections. In locked-down or audited environments, silent network activity can create compliance, monitoring, or trust issues even if the downloaded content is legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.