ClawHub
Back to skill

Security audit

Native Run

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides local command execution, but it does so with broad, weakly controlled shell access that should be reviewed carefully before installation.

Install only in a tightly trusted, isolated environment. Anyone or anything able to trigger this skill, or reach the localhost runner with the embedded token, may be able to run local commands and see their output. Prefer a version with explicit command allowlists, per-use confirmation, generated per-install credentials, sandboxing, and audit logging.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
native_run.py:31
Finding

Unrestricted Shell Command Execution from Chat-Controlled Input

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
native_run.py:11
Finding

Hardcoded Shared Secret Protecting the Native Command Runner

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (11)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This service exposes arbitrary shell execution over HTTP without a clearly justified constrained use case, effectively acting as a remote command runner. Even though it binds to localhost, local malware, browser-based local service abuse, SSRF from local apps, or any process on the machine could use it to execute commands if the token is known or recovered.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The service performs dangerous native actions without any user confirmation, approval flow, or interactive warning, making accidental or unauthorized execution far easier. In an agent or skill context, this is especially risky because a downstream component could trigger command execution implicitly once it can reach the endpoint and supply the token.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This is a classic tool-parameter abuse issue: untrusted request data is passed directly into a powerful execution primitive. The use of shell=True magnifies the risk by allowing shell metacharacters, chaining, redirection, and expansion, so an attacker can execute far more than an intended single command.

Content

Scanner excerpt · native_run.py (reported line 43)May include surrounding context.

python
# Run the command
        try:
            output = subprocess.check_output(
                payload["command"],
                shell=True,
                stderr=subprocess.STDOUT,

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill takes user-controlled text from context.message, strips a prefix, and forwards the remainder as a command to a native runner endpoint with task 'native_run'. This creates a direct command-execution bridge with no validation, allowlist, authentication boundary, or safety controls, so an attacker who can invoke the skill can likely execute arbitrary OS-level actions via the local service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill exposes native command execution on the local gateway machine, but the usage trigger is only described as a message that 'matches the configured pattern' with an example of free-form command text. This ambiguity increases the risk that unintended or overly broad inputs will activate arbitrary command execution, which is especially dangerous because the skill returns command output and runs on Windows locally.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

The code executes attacker-controlled input from an HTTP request using subprocess.check_output with shell=True, which enables arbitrary shell command execution on the host. Because the command comes directly from payload["command"] with no validation or restriction, any caller with the token can run system commands, read files, modify the environment, or pivot further.

Content

Scanner excerpt · native_run.py (reported line 43)May include surrounding context.

python
# Run the command
        try:
            output = subprocess.check_output(
                payload["command"],
                shell=True,
                stderr=subprocess.STDOUT,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Returning raw command output over HTTP can expose sensitive system information such as environment variables, file contents, credentials, keys, hostnames, and network configuration. Since the output is entirely determined by the executed command, this endpoint can be used for direct data exfiltration as well as command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill silently transmits user-supplied command text to a backend HTTP service without any disclosure, confirmation, or trust boundary warning. Because the payload is a command destined for a native runner, this is especially risky: users may not realize their input is being handed to an execution service, increasing the chance of abuse, accidental destructive actions, or social-engineering-driven execution.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
77% confidence
Finding

The code makes a request to an internal localhost service, which is an internal network interaction and can expose privileged local functionality to remote or less-trusted callers of the skill. While this is not classic user-controlled SSRF because the destination is hardcoded, it still acts as a proxy into a sensitive local service and expands access to internal-only capabilities.

Content

Scanner excerpt · native_run_skill.js (reported line 11)May include surrounding context.

js
if (!command) return '❌ No command provided.';

  try {
    const resp = await axios.post(
      'http://localhost:8080/?token=272d22dec98da63a3362c6dc0a9c0eebf2aa9ed96d21775d',
      { task: 'native_run', command }
    );

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description 'Run an arbitrary command' is explicitly unconstrained and advertises unrestricted command execution as the skill's purpose. In the provided context, this is not merely vague wording: the task comment states that the command is injected from the chat message, which makes the broad scope directly security-relevant because it enables arbitrary OS command execution from untrusted input.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The comment describes a health-check endpoint, implying a specific endpoint intended for health status. In practice, do_GET unconditionally returns 200 and "native-run online" for any GET request path, so the documented intent is narrower than the actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.