ClawHub
Back to skill

Security audit

flashformat

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local file-format converter; its file access and optional writes are expected for the task, with only routine installation and scoping cautions.

Install in an isolated Python environment when possible, review the repository version you copy into Codex, and use the scripts only with files you intend the converter to read or overwrite.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:20
Finding
Unpinned Dependency and Mutable Skill Installation Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16`, `README.md:20-36` **Vulnerability Type**: Unpinned third-party dependency and mutable source installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16`: ```markdown `python -m pip install PyYAML` ``` `README.md:20-36`: ```markdown Install dependency: ```bash python -m pip install PyYAML ``` ## Install This Skill (Codex) Clone this repository, then copy the skill folder into your Codex skills directory. ```bash git clone https://github.com/phantom5125/flashformat-skills.git cd flashformat-skills export CODEX_HOME="${CODEX_HOME:-$HOME/.codex}" mkdir -p "$CODEX_HOME/skills" cp -R skills/flashformat-local-converters "$CODEX_HOME/skills/" ``` ``` ### Technical Analysis The installation instructions retrieve PyYAML without pinning an reviewed version or verifying package hashes. Consequently, the installed artifact is selected from the package index at installation time and may change independently of this Skill's review. The documented Skill installation procedure also clones the repository's mutable default branch without specifying a verified commit or signed release. It then copies that downloaded content into the persistent Codex skills directory. Future changes to the upstream repository would therefore alter the effective installed Skill without requiring changes to the reviewed artifact. No evidence was found that the current PyYAML package or repository contains malicious code. This finding concerns the integrity and reproducibility of the documented supply-chain process. ### Attack Path 1. An attacker compromises the package distribution account, package index path, upstream repository, or a maintainer account. 2. The attacker publishes a malicious dependency artifact or modifies the repository's mutable default branch. 3. A user follows the documented `pip install` or `git clone` instructions. 4. The user receives content that differs from the version originally ...[truncated 921 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin PyYAML to a reviewed, supported version in a requirements file: ```text PyYAML==<reviewed-version> ``` 2. Generate and enforce cryptographic hashes: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Document installation from a fixed, reviewed commit or immutable signed release instead of the mutable default branch: ```bash git clone https://github.com/phantom5125/flashformat-skills.git cd flashformat-skills git checkout <verified-full-commit-sha> ``` 4. Publish checksums or signed release artifacts and instruct users to verify them before copying files into `$CODEX_HOME/skills`. 5. Use an isolated virtual environment and avoid privileged installation. 6. Add automated dependency vulnerability scanning and periodically review the pinned version before controlled upgrades. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises and instructs use of local conversion scripts that read from input files and optionally write to arbitrary output paths, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope metadata can let the skill be invoked without clear constraints, increasing the chance of unintended file reads/writes across the repository or user workspace.

Vague Triggers

Low
Confidence
89% confidence
Finding
The manifest description says to use the skill when users ask for "local format conversion, batch processing, or CI-friendly text normalization," which is fairly broad and does not clearly bound when this skill should or should not activate. It lacks explicit negative examples or tighter trigger constraints, increasing the chance of unintended invocation for ordinary formatting requests.

Static analysis

No suspicious patterns detected.