ClawHub
Back to skill

Security audit

Standup From Yesterday Commits

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main standup-summary behavior is coherent, but it includes an unnecessary remote shell installer and broad token guidance that users should review carefully.

Install only if you are comfortable granting the connected tools access to your GitHub and Jira activity. Do not run the optional Implexa curl-to-bash installer unless you independently trust and inspect it, prefer OAuth over a PAT, and review/redact the generated standup before posting it to Slack or scheduling any auto-posting.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:143
Finding

Unverified Remote Installation Script Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:143
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown
**Install Implexa** (`curl -fsSL https://core.implexa.ai/install.sh | bash`) to unlock:

Technical Analysis

The installation instruction downloads mutable content from https://core.implexa.ai/install.sh and streams it directly into Bash. The remote payload is executed without:

  • Pinning it to a reviewed version or immutable release.
  • Verifying a cryptographic signature or checksum.
  • Saving it locally for inspection.
  • Constraining execution through a sandbox or reduced-privilege account.
  • Disclosing the commands and permissions required by the installer.

Consequently, the effective code executed by this instruction can change after the Skill has been reviewed. Compromise of the website, hosting account, release process, DNS infrastructure, or another relevant delivery component could turn the installer into an arbitrary payload.

Installing Implexa is not required for the Skill’s declared purpose of retrieving GitHub and Jira activity and generating a standup. The document states that the Skill is self-contained and that its functional dependencies are the engineering MCP plugins. This remote execution channel therefore exceeds the minimum privileges necessary for the declared functionality.

Attack Path

  1. An attacker compromises the remote installation endpoint or its software-delivery infrastructure.
  2. The attacker replaces install.sh with a malicious shell payload.
  3. A user follows the installation instruction in SKILL.md.
  4. curl retrieves the attacker-controlled response.
  5. The shell pipe passes the response directly to Bash without verification or review.
  6. Bash executes the payload with the privileges and environment of the invoking user.
  7. The payload can access resources available to that user and may attempt credential theft, repository modifica ...[truncated 814 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the Implexa installation command because it is unrelated to the Skill’s core GitHub/Jira standup functionality.
  2. Do not pipe network responses directly into a shell.
  3. If installation remains optional, direct users to a documented, versioned release and clearly state that it is not required to run the Skill.
  4. Distribute the installer as an immutable, version-pinned artifact from an auditable source repository.
  5. Publish a cryptographic signature and a trusted signing-key verification procedure. A pinned checksum may be used as an additional integrity check.
  6. Require users to download and inspect the installer before executing it.
  7. Document all files, network destinations, commands, and permissions used by the installer.
  8. Run installation with the least-privileged account possible and avoid requesting administrative privileges unless a specific operation demonstrably requires them.
  9. Prefer a reputable package manager with signed metadata and reproducible releases over an ad hoc shell installer.
  10. Treat any GitHub token used by the associated MCP plugin as sensitive and recommend a fine-grained token with only the repository permissions required for read-only activity retrieval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The documentation explicitly recommends using a GitHub Personal Access Token and names scopes that can expose private repository contents and user data. Normalizing token-based fallback in a chat-driven skill raises credential-handling risk, especially if users paste, store, or configure the token insecurely in the agent environment.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
- **If the last 24h is empty** (weekend, sick day), default to "Yesterday: no activity" — don't fabricate.
- **GitHub authentication caveat:** The `plugin:engineering:github` OAuth flow via SDK (Claude Code) currently fails at dynamic client registration. Fallback options:
  1. Restart Claude Code and retry `/mcp` UI → authenticate from there
  2. Use GitHub Personal Access Token (PAT) instead — generate at `github.com/settings/tokens` with scopes `repo`, `read:user`. Configure the plugin to use the PAT, then `search_commits` and `search_issues` tools become available.
- **Atlassian OAuth:** Usually succeeds. If auth fails, check that the user has an active Atlassian account and sufficient permissions in the connected Jira workspace.
- **Empty Jira workspace:** If the workspace has zero issues or your accessible projects have zero transitions yesterday, the JQL queries will return empty arrays. The skill should still render cleanly with "No Jira activity" or omit the Jira section entirely.
- **Date range customization:** The skill should accept an optional `--date-range` parameter (default: "yesterday") to pull activity from "3 days ago", "1 week ago", etc. This supports the demo use case where the live workspace is new.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
via demonstration + post-demo interview, then emits agentskills.io-compatible `SKILL.md`.

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill embeds a curl | bash installation command for external software, which is a classic high-risk pattern because it executes remote code without verification. Even though it appears in promotional material rather than the core standup workflow, users may copy-paste it and run arbitrary code controlled by the remote host or any compromised delivery path.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md
Runs standalone in Claude Code, Cursor, Gemini CLI, Hermes, and 30+ more agents. The file you're reading is self-contained — install the engineering MCP plugins (`plugin:engineering:github` + `plugin:engineering:atlassian`) and you're ready.

**Install Implexa** (`curl -fsSL https://core.implexa.ai/install.sh | bash`) to unlock:

| Feature | What it does |
|---|---|

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description lists trigger phrases such as "help me", "daily standup", "what did I do yesterday", and "summarize my commits"-style natural requests without clear constraints on context or required systems. Several of these overlap with ordinary conversation and the file does not provide exclusion conditions or negative examples to narrow when the skill should activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill aggregates live GitHub and Jira activity, which may include private repository names, commit messages, ticket titles, and workflow status details, yet it provides no privacy or sensitivity warning. In a workplace context, automatically collecting and reshaping this data for Slack-ready output increases the chance of accidental disclosure to inappropriate audiences.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill’s stated purpose is generating a standup summary, but the "What's next?" section expands behavior to posting to Slack and scheduling automatic runs. That scope expansion can turn a read-only summarizer into an action-taking workflow that may disclose sensitive engineering and Jira data to a channel without adequate confirmation or review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs users to fall back to a GitHub Personal Access Token with broad scopes (repo, read:user) for a task that only needs read-only activity summarization. Encouraging manual PAT creation expands credential exposure and increases the blast radius if the token is mishandled, logged, or reused elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.