ClawHub
Back to skill

Security audit

Knowledgebase Share

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent GitHub knowledge-sharing purpose, but its sync script can automatically commit all local knowledge-repo changes and push them to the default main branch despite the stated pull-request workflow.

Review and adjust the scripts before installing or using this skill. Set the configured branch to an agent-specific branch, prefer running sync with --no-push, inspect git status and diffs before committing, and rely on GitHub branch protection so main cannot be pushed directly by accident.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sync_kb.sh:67
Finding

Default Main-Branch Push and Blanket Staging Bypass the Declared Review Workflow

Content
View full analysis
"` ``` `scripts/sync_kb.sh:67-79`: ```bash git -C "$KB_PATH" fetch origin "$BRANCH" git -C "$KB_PATH" pull --rebase origin "$BRANCH" if has_markers; then echo "ERROR: merge markers detected. resolve before push." >&2 exit 3 fi if [[ "$MODE" == "commit" ]]; then if [[ -n "$(git -C "$KB_PATH" status --porcelain)" ]]; then git -C "$KB_PATH" add -A git -C "$KB_PATH" commit -m "$MSG" || true fi fi if [[ $NO_PUSH -eq 0 ]]; then git -C "$KB_PATH" push origin "$BRANCH" fi ``` ### Technical Analysis The configured default branch is `main`, and the playbook recommends invoking commit mode without overriding that branch. In commit mode, the script executes `git add -A`, which stages all modified, deleted, and untracked files in the knowledge repository. It then pushes the resulting branch directly unless `--no-push` was explicitly supplied. This behavior conflicts with the branch and promotion controls declared in `SKILL.md:34-46`, which require work to occur on per-agent branches and shared content to enter `main` through a pull request. The script does not reject commit or push operations on `main`, restrict staged paths, scan staged content for secrets, or require explicit confirmation before pushing. The operation still uses the invoking user's existing Git credentials and does not independently escalate system or repository privileges. Server-side branch ...[truncated 1515 chars]
Remediation
View remediation
`. 3. Replace `git add -A` with explicit path allowlisting or require users to select the files that should be staged. 4. Display the staged diff and require explicit confirmation before committing or pushing. 5. Make `--no-push` behavior the default and require a separate explicit option to publish changes. 6. Run secret detection against staged content before creating a commit, and abort if credentials, tokens, private keys, or other sensitive values are detected. 7. Align the playbook with the documented workflow by creating an agent branch and opening a pull request rather than pushing directly to `main`. 8. Configure server-side branch protection for `main`, including mandatory pull requests, review approval, and secret-scanning checks. Server-side protection should supplement rather than replace local safeguards. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script performs git push origin "$BRANCH" by default after fetching, rebasing, and optionally committing, with no interactive confirmation, dry-run default, or explicit acknowledgement from the caller. In a multi-agent shared knowledge workflow, this increases the risk of unintended publication or overwrite of shared repository state when the script is run with the wrong branch, wrong repository path, or unexpected local changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.