ClawHub
Back to skill

Security audit

Os Update Checker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only update checker, though it can contact package registries and expose package names during checks.

Install only if you are comfortable with a read-only tool running local package-manager commands and contacting package registries for update metadata. Use --no-changelog when you want less network activity, and avoid running it in environments where installed package names are sensitive.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares shell and network-capable behavior in its documentation, but provides no explicit tool scope such as permissions or allowed-tools to constrain or communicate those capabilities. Even if the intended operations are read-only, the absence of declared scope weakens policy enforcement and increases the risk that an agent may invoke broader shell or network access than reviewers expect.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_updates.py (reported line 71)May include surrounding context.

python
empty string on any error rather than raising.
    """
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_updates.py (reported line 208)May include surrounding context.

python
"""Parse `dnf check-update` output into PackageUpdate objects."""
        # dnf check-update exits 100 when updates are available — that's normal.
        try:
            result = subprocess.run(
                ["dnf", "check-update", "--quiet"],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_updates.py (reported line 275)May include surrounding context.

python
def list_upgradable(self) -> list[PackageUpdate]:
        """Parse `yum check-update` output into PackageUpdate objects."""
        try:
            result = subprocess.run(
                ["yum", "check-update", "--quiet"],
                capture_output=True,
                text=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is described as a read-only local update checker, but the npm backend performs outbound network requests to the npm registry for each package when changelogs are enabled. This expands the trust boundary, can leak installed global package names and usage patterns to a third party, and may violate operator expectations or network isolation assumptions in sensitive environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The module documentation asserts changelogs are fetched in a read-only package-manager-based manner, but the npm backend actually substitutes remote registry metadata fetched over HTTP. This documentation mismatch is security-relevant because it can cause users to run the tool in environments where outbound access or software inventory disclosure is not acceptable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.