ClawHub
Back to skill

Security audit

Padel

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward guide for using a Playtomic booking CLI, with clear user approval steps and no hidden code, though its installation guidance relies on trusting upstream package sources.

Before installing, make sure padel-tui is the tool you intend to trust with Playtomic access, prefer an official and versioned source, avoid sudo, and treat the local session file as sensitive. Confirm booking and cancellation details before allowing commands that reserve or cancel a court.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/INSTALLATION.md:8
Finding

Unverified Third-Party Installation Paths

Content
View full analysis

Vulnerability Details

File Location: references/INSTALLATION.md, lines 8–27
Vulnerability Type: Supply-chain exposure through unpinned and unverified dependencies
Risk Level: Medium

Vulnerable Code

bash
brew install philipp-eisen/tap/padel-tui
padel-tui --version
text
1. Download the archive from GitHub releases.
bash
tar -xzf padel-tui-<version>-<platform>.tar.gz
chmod +x padel-tui
./padel-tui --version
bash
bun install
./bin/padel-tui --version

Technical Analysis

The installation guide offers three ways to obtain and execute third-party code, but none establishes an immutable and authenticated artifact:

  • The custom Homebrew tap is not pinned to an audited formula revision or package version.
  • The prebuilt-binary workflow does not specify an exact official repository or release URL and provides no checksum or signature verification.
  • The source workflow invokes bun install without requiring an audited lockfile or frozen dependency resolution.

Merely running --version after installation does not establish integrity because the potentially substituted executable has already run. These weaknesses expose installation to compromised maintainers, release assets, repositories, package sources, or artifact substitution.

Attack Path

  1. An attacker compromises the custom tap, upstream release assets, source repository, or a resolved dependency. Alternatively, the user obtains an archive from an unofficial location because the guide does not identify the authoritative release URL.
  2. The user explicitly approves installation and follows one of the documented workflows.
  3. Homebrew installation logic, the downloaded executable, or Bun lifecycle/dependency code executes without prior cryptographic verification.
  4. The attacker-controlled code runs with the installing user's privileges.
  5. The code can ...[truncated 731 chars]
Remediation
View remediation

Remediation Suggestions

  1. Specify the exact authoritative HTTPS repository and release URL rather than referring generically to “GitHub releases.”
  2. Pin installation to an audited release version and, where practical, an immutable source commit.
  3. Publish SHA-256 checksums or cryptographic signatures through an independently protected channel and require verification before extraction or execution.
  4. Pin the Homebrew formula or release version and document the trust boundary of the custom tap.
  5. Require a committed, reviewed Bun lockfile and use frozen lockfile installation so dependency resolution cannot change silently.
  6. Disable or review dependency lifecycle scripts where supported and document any scripts that must run during installation.
  7. Perform integrity verification before invoking the binary, including before --version.
  8. Recommend installation under least privilege and explicitly warn users not to run these commands with sudo or an administrative account.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
- Confirm installation intent before running any install command.
- Ask: "Do you want me to install `padel-tui` now, or skip installation and use your current setup?"
- If installation is declined, continue with the existing binary/path.
- Do not ask the user for email or password.
- Ask the user to authenticate interactively with `<prefix> auth login`.
- Treat `book` and `match-cancel` as user-impacting operations and run only after explicit user intent.

Static analysis

No suspicious patterns detected.