ClawHub
Back to skill

Security audit

BanditDB

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent BanditDB integration guide, with normal local API operations and a supply-chain caution around unpinned install sources.

Before installing, use a specific reviewed BanditDB release or image digest where possible, verify checksums or signatures if provided, and run the service with least privilege. Treat the DELETE endpoint and reward-recording tools as state-changing operations and only expose them to agents you trust to manage BanditDB campaigns.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/api.md:30
Finding

Unpinned and Unverified Third-Party Installation Sources

Content
View full analysis
Remediation
View remediation
``` 3. Publish SHA-256 checksums for release binaries and require users to verify them before execution. 4. Prefer signed releases and container images, and document signature verification using an appropriate mechanism such as Sigstore/Cosign. 5. Pin the Python SDK with an exact version and verified hashes, such as a lock file or `pip --require-hashes`. 6. Clarify and verify the trust relationship between the GitHub organization and Docker image publisher. Prefer a consistently named, officially controlled publisher. 7. Avoid automatic upgrades to unreviewed releases. Document a controlled update process that includes provenance, integrity, and security review. 8. Run the service with least privilege: use a non-root account, restrict network access, avoid unnecessary host mounts, and expose only the MCP capabilities required for the intended workflow. ]]>

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 10)May include surrounding context.

md
- **Create**: `POST /campaign` — body: `campaign_id`, `arms` (string array), `feature_dim` (int), optional `algorithm` ("lin_ucb" or "thompson_sampling", default: lin_ucb)
- **List**: `GET /campaigns`
- **Get**: `GET /campaign/{campaign_id}`
- **Delete**: `DELETE /campaign/{campaign_id}`

## Predictions

Static analysis

No suspicious patterns detected.