T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/vet.sh:51
- Finding
- Incomplete scanning and unsafe scoring can approve malicious skills## Vulnerability Details **File Location**: `scripts/vet.sh:51-144` **Vulnerability Type**: Incomplete security coverage and fail-open trust decision **Risk Level**: High ### Vulnerable Code ```bash FILES=$(clawhub inspect "$SLUG" --files 2>/dev/null | grep -E "^scripts/|^hooks/" | awk '{print $1}') CRED_FLAG=0 NET_FLAG=0 DESTRUCT_FLAG=0 for file in $FILES; do CONTENT=$(clawhub inspect "$SLUG" --file "$file" 2>/dev/null) # Only flag actual hardcoded credential VALUES (not env var references) # Look for: API_KEY="sk_live..." or api_key = "sk_live..." or similar if echo "$CONTENT" | grep -E 'API_KEY\s*=\s*"sk_[a-zA-Z0-9]{20,}' > /dev/null 2>&1; then CRED_FLAG=1 fi if echo "$CONTENT" | grep -E 'PASSWORD\s*=\s*"[^"]+' > /dev/null 2>&1; then CRED_FLAG=1 fi if echo "$CONTENT" | grep -E 'TOKEN\s*=\s*"[^"]{20,}' > /dev/null 2>&1; then CRED_FLAG=1 fi # Network check if echo "$CONTENT" | grep -E "curl |wget |fetch\(|requests\.post|requests\.get" > /dev/null 2>&1; then NET_FLAG=1 fi # Destructive ops check if echo "$CONTENT" | grep -E "rm -rf|chmod 777|sudo |eval |exec " > /dev/null 2>&1; then DESTRUCT_FLAG=1 fi done ``` ```bash if echo "$SKILL_MD" | grep -qi "requires\|permission\|tool\|node\|bin"; then echo " Permission docs: CLEAR (+1)" SCORE=$((SCORE+1)) else echo " Permission docs: VAGUE" fi if [ "$DESC_LEN" -lt 500 ]; then echo " Documentation: MINIMAL (${DESC_LEN} bytes)" SCORE=$((SCORE+1)) elif [ "$DESC_LEN" -gt 3000 ]; then echo " Documentation: DETAILED (+1)" SCORE=$((SCORE+1)) fi # Verdict echo "" echo "==============================" echo "FINAL SCORE: $SCORE / 7" echo "==============================" if [ $SCORE -ge 5 ]; then echo "" echo "VERDICT: Install ✅" echo "Reason: Security checks passed — safe to install" elif [ $SCORE -ge 3 ]; ...[truncated 2740 chars]
- Remediation
- ## Remediation Suggestions 1. Enumerate and inspect every file in the package rather than restricting analysis to `scripts/` and `hooks/`. 2. Treat unknown file types, binaries, symlinks, generated code, and executable content in unexpected locations as requiring manual review. 3. Analyze `SKILL.md` and related documentation for instruction hijacking, requests for excessive access, remote execution instructions, and unsafe installation commands. 4. Replace simple substring matching with syntax-aware analysis for supported languages and established secret-scanning tools. 5. Detect indirect command execution, encoded commands, alternate network clients, dynamic imports, subprocess APIs, and configuration-driven execution. 6. Do not award security points for documentation length or generic keyword presence. Score only independently verified security properties. 7. Fail closed when the official scan status is missing, parsing fails, a file cannot be retrieved, or complete package coverage cannot be established. 8. Require manual review before recommending installation whenever a skill contains executable behavior, outbound network access, credential handling, or unsupported content. 9. Clearly distinguish automated heuristic results from a verified safety determination and avoid presenting a heuristic pass as “safe to install.” 10. Add adversarial regression tests covering payloads outside expected directories, case variations, single-quoted secrets, command construction, alternate network tools, and unavailable security metadata.