ClawHub
Back to skill

Security audit

Agent Skills Tools

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local skill-audit helper, but its checks are shallow and should not be treated as a complete security review.

Install only if you want a lightweight local heuristic checker. Do not rely on a clean result as proof that a skill is safe; use a maintained secret scanner and a fuller code review for real security decisions, and run this only on the specific skill directory you intend to inspect.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
skill-security-audit.sh:11
Finding

Credential scanner provides materially incomplete secret detection

Content
View full analysis
/dev/null | \ while read file; do grep -n "api[_-]key.*['\"][^'\"]*['\"]" "$file" | head -3 done) if [ -z "$CREDENTIAL_LEAKS" ]; then ``` ### Technical Analysis The Skill claims to identify hardcoded API keys, passwords, secrets, and tokens, but the implementation only searches for an `api_key` or `api-key` pattern followed by a quoted value. It also restricts scanning to `.sh`, `.js`, and `.py` files. The initial file-selection `grep` is case-insensitive, but the second `grep` that produces the result is case-sensitive. A file containing only an uppercase form such as `API_KEY` can therefore be selected and then produce no output, causing the script to report that no credential leak was found. The implementation does not detect common credential forms such as: - `password`, `passwd`, `secret`, `token`, or `authorization` - Provider-specific access-key formats - PEM or SSH private keys - Secrets stored in JSON, YAML, TOML, environment files, Markdown, or extensionless files - Unquoted, concatenated, encoded, or dynamically constructed credentials This is a security-tool correctness issue rather than direct malicious credential access. The script does not read credential paths outside the requested scan target and does not transmit findings over the network. ### Attack Path 1. An attacker places a hardcoded credential in a Skill package using a name such as `TOKEN`, `PASSWORD`, or uppercase `API_KEY`. 2. Alternatively, the attacker stores the credential in an unsupported file type such as `.json`, `.yaml`, or `.env`. 3. A reviewer runs this audit script before installing the ...[truncated 874 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill-security-audit.sh:28
Finding

Network and sensitive-path checks match text rather than executable behavior

Content
View full analysis
/dev/null) if [ -z "$DANGEROUS_ACCESS" ]; then echo "✅ 未发现危险的文件访问" else echo "⚠️ 发现文件访问：" echo "$DANGEROUS_ACCESS" fi echo "" # 检查3: 网络请求 echo "📋 检查3: 外部网络请求" echo "----------------------------------------" NETWORK_REQUESTS=$(find "$SKILL_DIR" \( -name "*.sh" -o -name "*.js" -o -name "*.py" \) \ -exec grep -l -E "(curl|wget|fetch|axios|http\.get)" {} \; 2>/dev/null) if [ -z "$NETWORK_REQUESTS" ]; then echo "✅ 未发现网络请求" else ``` ### Technical Analysis These checks search for literal strings without determining whether the strings represent executable operations. Consequently, references in comments, documentation, examples, variable names, or security-detection rules are treated as actual behavior. The sensitive-path expression does not verify filesystem operations and can match unrelated strings containing `.config`, `.ssh`, or `.aws`. Conversely, it can miss dynamically constructed paths, environment-variable expansions, alternate credential locations, symlinks, and code that derives paths at runtime. The network expression covers only a small set of names. It can miss network access through: - Python `requests`, `urllib`, sockets, or subprocess wrappers - Node.js `https`, sockets, alternate request libraries, or dynamic imports - Shell tools other than the listed commands - Aliases, renamed binaries, language runtimes, or constructed command strings - DNS-based or other non-HTTP communication The pre-scan references to `~/.ssh`, `~/.aws`, and `~/.config` are only literals used by ...[truncated 1595 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill-security-audit.sh:57
Finding

Credential file permission check treats simple readability as secure

Content
View full analysis
/dev/null) if [ -z "$CREDS_FILES" ]; then echo "ℹ️ 未发现credentials.json文件" else echo "📁 发现credentials.json文件：" echo "$CREDS_FILES" echo "" for file in $CREDS_FILES; do if [ -r "$file" ]; then echo " ✅ $file 可读（正常）" else echo " ❌ $file 权限异常" fi done fi ``` ### Technical Analysis The check labels a credential file as normal when it is readable by the current process. Readability is not a security property for a credential file: a file can be readable by the owner, group, and all local users and still receive a successful result. The implementation does not inspect: - File ownership - Group ownership - Owner, group, or world permission bits - Whether the path is a regular file or symbolic link - Access-control lists - Whether the file is writable by unauthorized users The loop also expands the newline-separated output of `find` using shell word splitting and pathname expansion: ```bash for file in $CREDS_FILES ``` Paths containing spaces, tabs, newlines, or glob characters can be split or expanded into different paths. This can cause files to be skipped, misreported, or checked incorrectly. ### Attack Path 1. A package contains `credentials.json` with permissive permissions, such as mode `0644` or `0666`. 2. The current user can read the file. 3. The audit script evaluates `[ -r "$file" ]` as true. 4. The script prints a success indicator even though other local users may also be able to read or modify the credentials. 5. A reviewer accepts the result without correcting the permissions. 6. Another local account or process with access permitted by the mode can read or alter the credential file. For f ...[truncated 816 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill-security-audit.sh:81
Finding

Git history audit searches only one exact credential identifier

Content
View full analysis
/dev/null | head -3) if [ -n "$SENSITIVE_COMMITS" ]; then echo " ⚠️ 历史记录中发现包含'api_key'的提交：" echo "$SENSITIVE_COMMITS" fi ``` ### Technical Analysis The Git-history check searches only for changes in the number of occurrences of the exact, case-sensitive string `api_key`. It is not a general secret-history scan. It can miss: - `API_KEY`, `api-key`, `token`, `password`, and `secret` - Provider-specific key formats - Private keys and certificates - Secret values committed without a recognizable variable name - Credentials in binary or encoded content - Secrets in repositories where `.git` is represented differently, such as certain worktree layouts Only the first three matching commits are displayed. Suppression of Git errors through `2>/dev/null` can also make scan failures indistinguishable from a clean history. ### Attack Path 1. A secret is committed to repository history under a name other than the exact lowercase string `api_key`. 2. The secret is removed from the current working tree but remains recoverable from an earlier commit. 3. A reviewer runs the audit script. 4. `git log -S "api_key"` returns no match. 5. The script does not warn that the history still contains the credential. 6. Anyone who can clone or inspect the repository history may recover and use the credential if it remains valid. ### Impact Assessment No privilege escalation or history modification is performed by this script. The command is read-only and local. The impact is failure to detect credentials retained in repository history. Exposure ...[truncated 252 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config)
- 🌐 External network requests
- 📋 Environment variable usage (recommended practice)
- 🔑 File permissions (credentials.json)
- 📜 Git history for leaked secrets

**Usage:**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
- 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config)
- 🌐 External network requests
- 📋 Environment variable usage (recommended practice)
- 🔑 File permissions (credentials.json)
- 📜 Git history for leaked secrets

**Usage:**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill-security-audit.sh (reported line 70)May include surrounding context.

sh
- 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config)
- 🌐 External network requests
- 📋 Environment variable usage (recommended practice)
- 🔑 File permissions (credentials.json)
- 📜 Git history for leaked secrets

**Usage:**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill-security-audit.sh (reported line 72)May include surrounding context.

sh
- 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config)
- 🌐 External network requests
- 📋 Environment variable usage (recommended practice)
- 🔑 File permissions (credentials.json)
- 📜 Git history for leaked secrets

**Usage:**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill-security-audit.sh (reported line 75)May include surrounding context.

sh
- 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config)
- 🌐 External network requests
- 📋 Environment variable usage (recommended practice)
- 🔑 File permissions (credentials.json)
- 📜 Git history for leaked secrets

**Usage:**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill-security-audit.sh (reported line 77)May include surrounding context.

sh
- 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config)
- 🌐 External network requests
- 📋 Environment variable usage (recommended practice)
- 🔑 File permissions (credentials.json)
- 📜 Git history for leaked secrets

**Usage:**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill-security-audit.sh (reported line 115)May include surrounding context.

sh
- 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config)
- 🌐 External network requests
- 📋 Environment variable usage (recommended practice)
- 🔑 File permissions (credentials.json)
- 📜 Git history for leaked secrets

**Usage:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

text
   credentials.json
   *.key
   .env

License

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises shell-based tooling but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this can lead to overbroad execution authority because consumers cannot reliably determine what commands or filesystem access the skill expects before enabling it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use the skill when the user needs to audit skills for security, validate packages against standards, or ensure best practices, but it does not define specific invocation phrases, constraints, or non-matching cases. This broad wording could overlap with many general security or quality-review requests and lead to unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented example output is entirely in Chinese, but the skill description does not state that output language is configurable or limited to a Chinese-speaking context. This creates a locale-policy concern because the skill appears to impose a language choice without user selection or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The user-facing comments and all printed audit messages are in Chinese throughout the script, which effectively forces a specific language for interaction. The file does not provide any opt-in, fallback, or documentation that the skill is intended only for Chinese-speaking users or a China-specific environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README content describing the skill is written in Chinese, and there is no indication that users may choose another language or that the tool is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:72