ClawHub
Back to skill

Security audit

Clawhub Dev Calendar

Security checks for vulnerabilities and agentic risk

Overview

This calendar-generation skill is purpose-aligned and mostly low impact, but its ICS generator should only be used with trusted project data because it does not escape calendar text safely.

Install is reasonable if you use it for trusted project plans. Before importing or sharing generated .ics files from untrusted project JSON, review the content or update the generator to escape ICS text fields and use opaque UIDs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_ics.py:35
Finding

Unescaped User Input Allows ICS Calendar Content Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_ics.py, lines 35–44; attacker-controlled values are constructed at lines 75–83
Vulnerability Type: ICS property and event injection
Risk Level: Medium

Vulnerable Code

python
for event in events:
    start_str = event['start'].strftime('%Y%m%dT%H%M%S{tz_offset}')
    end_str = event['end'].strftime('%Y%m%dT%H%M%S{tz_offset}')
    uid = event['uid'].replace(' ', '_')
    ics_content += f"""BEGIN:VEVENT
UID:{uid}@clawhub.dev
DTSTAMP:{datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')}
DTSTART:{start_str}
DTEND:{end_str}
SUMMARY:{event['summary']}
DESCRIPTION:{event.get('description', '')}
END:VEVENT
"""

The affected values are built directly from the input project JSON:

python
summary = f"{proj['name']}: {m['name']} ({m['hours']}h @ $150/hr)"
desc = f"Cumulative: {cum_hours + m['hours']}h. Init fee $500 separate."
events.append({
    'uid': f"{proj['name']}-{m['name']}",
    'start': e_start,
    'end': e_end,
    'summary': summary,
    'description': desc
})

Technical Analysis

The project name and milestone names are read from a user-supplied JSON document and inserted directly into UID and SUMMARY properties. Replacing spaces in the UID does not neutralize carriage returns, line feeds, backslashes, commas, or semicolons.

Under RFC 5545, a newline terminates the current content line. Consequently, an input containing an escaped JSON newline becomes a real newline after json.load() and can introduce additional ICS properties or calendar components. Text values also require escaping of backslashes, commas, semicolons, and line breaks.

For example, a malicious project name could contain content conceptually equivalent to:

json
{
  "name": "Trusted Project\nATTENDEE:mailto:victim@example.com\nDESCRIPTION:Injected content",
  "start": "2026-04-01T09:00:00-06:00",
  "milestones": [
   
...[truncated 1604 chars]
Remediation
View remediation

Remediation Suggestions

  1. Apply RFC 5545 text escaping before inserting any user-controlled value:

    • Escape \ as \\.
    • Escape commas as \,.
    • Escape semicolons as \;.
    • Encode line breaks as literal \n sequences rather than physical content-line boundaries.
    • Reject remaining carriage returns, line feeds, NUL bytes, and other control characters.

  2. Generate opaque UIDs independently of user input, such as with uuid.uuid4(). Do not derive structural identifiers directly from project or milestone names.

  3. Validate the complete JSON schema before generating output:

    • Require name and milestone names to be strings.
    • Set reasonable length limits.
    • Require finite, non-negative numeric hour values within an expected maximum.
    • Require a valid timezone-aware start timestamp.
    • Reject unexpected object structures and control characters.

  4. Use a maintained iCalendar library that correctly serializes properties, escapes text, folds long lines, and handles timezone data.

  5. Add regression tests using project and milestone names containing CR, LF, backslashes, commas, semicolons, BEGIN:VEVENT, and END:VEVENT. Verify that each remains inert text in the parsed output and cannot create extra properties or events.

  6. Parse the generated ICS in security tests and assert that its event count and property structure exactly match the validated input.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: clawhub-dev-calendar
description: Generate professional calendars, timelines, schedules, and project planners for ClawHub/OpenClaw skill development services. Use when: (1) creating dev project timelines/milestones, (2) quarterly/monthly dev schedules, (3) client delivery calendars, (4) ICS exports for Google/Outlook, (5) PDF/HTML calendar visuals. Auto-incorporates Saskatchewan statutory holidays, America/Regina TZ, standard dev rates ($150/hr dev, $500 skill init), ClawHub milestones (init/develop/test/publish).
---

# ClawHub Dev Calendar

## Overview

Produce tailored calendars for ClawHub skill dev workflows.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
{"name": "SKILL.md", "hours": 4},

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/dev_milestones.md (reported line 10)May include surrounding context.

md
| Init           | 2     | skill-creator init_skill.py | 0.25              |
| Research/Plan  | 4     | Examples, resource planning | 0.75              |
| Develop        | 6     | scripts/refs/assets         | 1.5               |
| Write SKILL.md | 4     | Instructions, workflows     | 2.125             |
| Test           | 3     | Examples, validation        | 2.625             |
| Package/Publish| 1     | clawhub publish             | 2.75              |

Static analysis

No suspicious patterns detected.