ClawHub
Back to skill

Security audit

Agent Visio Use

Security checks for vulnerabilities and agentic risk

Overview

This bootstrap skill is coherent but asks agents to clone and run unpinned external code while using a local bridge token, so it belongs in Review.

Install only if you are comfortable reviewing the upstream DrawForge repository yourself. Pin or verify a specific commit before running the smoke test, and provide VISIO_BRIDGE_TOKEN only to the command that actually needs bridge access rather than exposing it during clone, setup, or general troubleshooting.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:67
Finding

Unpinned Remote Repository Is Retrieved and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–84
Vulnerability Type: Remote Payload Retrieval and Execution
Risk Level: High

The skill instructs the agent to clone a mutable external GitHub repository and subsequently execute Python scripts obtained from that repository:

markdown
## Clone the repository

```bash
git clone git@github.com:qweadzchn/DrawForge.git
cd DrawForge

If SSH is not available, use HTTPS instead.

Read order

Read these files first:

  1. AGENT_START_HERE.md
  2. AGENT_GUIDE.md
  3. GET_STARTED.md
  4. docs/human/setup/AGENT_COLD_START_SMOKE_TEST.md
  5. MODE_POLICY.md
text

The remotely retrieved scripts are then executed at lines 91–93:

```powershell
python Setup\prepare_smoke_test.py --config Setup\examples\smoke-test-inputpng-1.json
python Setup\run_draw_job.py --config Setup\examples\smoke-test-inputpng-1.json
python Setup\execute_drawdsl.py --config Setup\examples\smoke-test-inputpng-1.json --round 1 --save-final

Technical Analysis

The clone command does not pin the repository to a reviewed commit hash or cryptographically verified release. It therefore retrieves the repository's mutable default branch. Although the audited package contains only documentation, its prescribed workflow establishes a remote code-execution channel whose effective payload can change after the skill package has been reviewed or published.

The workflow also tells the agent to load instruction documents from the remote repository before executing its scripts. Those files and scripts are outside the audited package and could be modified by a compromised maintainer account, repository compromise, or an unsafe future update.

The package declares VISIO_BRIDGE_TOKEN as an environment requirement. If that secret is available to the processes being run, remotely supplied Python code may be able to read it from the process environment. The exact behavior of t ...[truncated 1745 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the external repository to a specific, reviewed commit hash rather than executing its mutable default branch.
  2. Publish a signed release and verify its signature or a trusted cryptographic checksum before running any retrieved file.
  3. Record the expected repository owner, URL, commit identifier, and verification procedure directly in SKILL.md.
  4. Require review of the listed agent-instruction documents, executable scripts, and local imports before execution.
  5. Run the smoke test in an isolated environment with minimal filesystem and network access.
  6. Do not expose VISIO_BRIDGE_TOKEN during cloning, documentation review, dependency installation, or preparation stages. Inject it only into the specific process that requires bridge access.
  7. Use a short-lived, least-privileged bridge token and ensure that child processes do not inherit it unless necessary.
  8. Consider vendoring the reviewed bootstrap scripts into the audited package or distributing a checksum-verified release archive so the executed content matches the reviewed content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly declares a required environment variable, VISIO_BRIDGE_TOKEN, but provides no guidance on safe handling, storage, redaction, or avoidance of logging/exposure. In a bootstrap skill that directs an agent through setup and execution, this increases the chance the token will be echoed in terminal history, copied into configs, or exposed in logs and artifacts during troubleshooting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.