ClawHub
Back to skill

Security audit

Habit tracking, todo, and routines

Security checks for vulnerabilities and agentic risk

Overview

The Buffy habit and todo skill is mostly coherent, but it includes unrelated unpinned skill-discovery and global install instructions that should be reviewed before installation.

Install only if you need Buffy’s habit, todo, routine, or reminder API client and can provide a scoped BUFFY_API_KEY. Avoid following the npx skills discovery or global -g -y install examples without separate review, pinning, and explicit approval. Enable the optional hooks only where local logs are private, minimized, and retained under your policy.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:113
Finding

Unpinned Remote CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:113
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- **Install**: Download a binary from [Releases](https://github.com/phantue2002/buffy-cli/releases) for your OS/arch, or run `go install github.com/phantue2002/buffy-cli@latest` (Go 1.21+).

Technical Analysis

The installation command uses the mutable @latest version selector. Consequently, the effective source code downloaded and compiled depends on the upstream repository state at installation time rather than an immutable version reviewed with this Skill.

Although installing the CLI is presented as an optional user action and is not automatically performed by the core Skill, following this instruction retrieves and compiles third-party code without a pinned release, commit, checksum, or signature-verification requirement. A compromised upstream repository, maintainer account, release process, or transitive Go dependency could therefore deliver code different from what was originally audited.

Attack Path

  1. An attacker compromises the upstream CLI repository, release process, maintainer credentials, or one of its dependencies.
  2. The attacker publishes a malicious version that resolves through @latest.
  3. A user or agent follows the documented go install github.com/phantue2002/buffy-cli@latest instruction.
  4. Go downloads and compiles the attacker-controlled source and dependencies.
  5. The malicious CLI executes when invoked and operates with the privileges of the installing user.

Impact Assessment

Successfully exploited code can access resources available to the user running the installed CLI. Depending on the host environment, this may include Buffy API credentials, environment variables, user files, network access, and Buffy data submitted through the CLI. The affected scope is the account and environmen ...[truncated 135 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with a reviewed, immutable release version or commit.
  • Publish SHA-256 checksums and, preferably, cryptographic signatures for release binaries.
  • Instruct users to verify the checksum or signature before executing a downloaded binary.
  • Document the expected package source and reject redirects or unofficial mirrors.
  • Review and pin relevant transitive dependencies as part of each release process.
  • Avoid automatically installing or executing the CLI; require an explicit user decision after displaying the source and pinned version.

T08 · Insecure Dependencies

Error
Location
SKILL.md:192
Finding

Unpinned Skill Discovery and Unattended Global Installation Workflow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:192-200
Vulnerability Type: Unsafe third-party package and Skill acquisition
Risk Level: High

Vulnerable Code Snippet:

markdown
- Using Buffy for requests that are **not** about habits, todo, routines, reminders, or clan/team (e.g. "how do I do X", "find a skill for X", testing, deployment, design). For those, use or suggest the **find-skills** workflow (e.g. `npx skills find [query]`) so the user can discover and install the right skill.

### Extending capabilities (find-skills)

When the user asks for help that is **outside** Buffy’s scope (e.g. "how do I test my API?", "find a skill for React", "is there a skill that can review PRs?"):

1. **Do not** call Buffy for those requests.
2. If the **find-skills** skill is available, use it: run `npx skills find [query]` with a relevant query, then present install commands and links (e.g. `npx skills add <owner/repo@skill> -g -y`).
3. If find-skills is not available, suggest the user run `npx skills find <topic>` or browse https://skills.sh/ to discover and install a skill for that capability.

Technical Analysis

The workflow directs an agent to run npx skills without pinning the npm package to a reviewed version. Depending on npm and local cache behavior, npx can retrieve executable package content from a remote registry at invocation time. The package payload can therefore change after this Skill has been audited.

The resulting workflow also recommends an example installation command containing both -g and -y. Global installation expands the persistence and affected scope of an acquired component, while unattended confirmation reduces the opportunity for a user to inspect the source, requested capabilities, provenance, and installation target. Search results are not constrained to an allowlist or required to undergo security review before installation is proposed.

This behavior is n ...[truncated 1564 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the unrelated Skill-discovery and installation workflow from the Buffy Skill.
  • If discovery must remain, pin the skills CLI to an explicitly reviewed immutable version.
  • Do not use -g or -y by default; prefer project-local installation with interactive confirmation.
  • Require explicit user authorization before downloading, installing, or executing any discovered component.
  • Display the exact package name, immutable version, publisher, source repository, permissions, and integrity digest before installation.
  • Restrict recommendations to an allowlist of reviewed publishers and Skills.
  • Verify package signatures or integrity hashes and perform a separate security review of each Skill before enabling it.
  • Run discovery and installation operations in a sandbox with restricted filesystem access, network egress, credentials, and environment variables.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
as canonical. This `SKILL.md` file is the canonical guide for how agents and tools should invoke Buffy.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
### API key provisioning (advanced)

Buffy can create API keys for other tools and integrations:

- **POST /v1/users/{id}/api-keys**

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The hook explicitly suggests logging optional context such as the endpoint or user intent into a repo-local markdown file without any privacy guidance, minimization rules, or redaction requirements. User intent can contain sensitive behavioral or personal information, and local markdown logs are often broadly accessible to developers, synced to repositories, or retained indefinitely, increasing the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.