ClawHub
Back to skill

Security audit

DeepTask

Security checks for vulnerabilities and agentic risk

Overview

DeepTask is mostly transparent about managing tasks, running tests, and auto-committing work, but it gives the workflow broad local execution and repository mutation authority without enough containment or approval controls.

Install only in an isolated test workspace or disposable repository. Do not run it against a repository with unrelated changes or secrets, and review the SQLite unit_tests content and Git diff before allowing the full cycle to execute or commit.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ai_worker.py:274
Finding

Unrestricted Execution of Database-Supplied Python Test Code

Content
View full analysis

Vulnerability Details

File Location: scripts/ai_worker.py, lines 274-291
Vulnerability Type: Arbitrary code execution through untrusted test content
Risk Level: High

Vulnerable Code

python
test_code = ut.get('test_code', '')

if tool_name == "python3" or tool_name == "python":
    return self._run_python_test(test_code, project_dir)
elif tool_name == "moon":
    return self._run_moon_test(project_dir)
else:
    return True

def _run_python_test(self, test_code: str, project_dir: str) -> bool:
    """Run Python tests"""
    try:
        result = subprocess.run(
            ["python3", "-c", test_code],
            cwd=project_dir,
            capture_output=True,
            text=True,
            timeout=30
        )
        return result.returncode == 0
    except Exception as e:
        print(f"  Python test exception: {e}")
        return False

Technical Analysis

The worker retrieves test_code directly from the SQLite unit_tests table and supplies it to a full Python interpreter through python3 -c. The subprocess is not isolated and inherits the invoking user's operating-system privileges, environment, filesystem access, and network capabilities.

The timeout limits execution duration but does not restrict the operations the test can perform. There is no test-content validation, human approval boundary, sandbox, network restriction, filesystem allowlist, reduced-privilege account, or process-level containment.

Executing tests is consistent with the declared functionality, but executing database-controlled tests with unrestricted host privileges exceeds the minimum privileges necessary. AI-generated tests, imported databases, or locally modified database records therefore become arbitrary code-execution channels.

Attack Path

  1. An attacker or compromised generation process inserts malicious Python into unit_tests.test_code.
  2. The associated M ...[truncated 1383 chars]
Remediation
View remediation

Remediation Suggestions

  1. Execute generated tests in an ephemeral sandbox or container rather than directly on the host.
  2. Use a dedicated unprivileged account with no access to user credentials or unrelated projects.
  3. Disable network access by default and permit it only through an explicit, documented policy.
  4. Mount only the required project files, preferably read-only except for a dedicated temporary output directory.
  5. Remove secrets and unnecessary variables from the subprocess environment.
  6. Apply CPU, memory, process-count, file-size, and execution-time limits.
  7. Require explicit human approval before executing newly generated or externally supplied test code.
  8. Record the test-content hash and approval identity so the approved code can be verified immediately before execution.
  9. Treat the SQLite database as a sensitive executable-content store and restrict its filesystem permissions.
  10. Do not rely on source-text filtering as the primary defense; Python code cannot be safely sandboxed using a simple import or keyword denylist.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/ai_worker.py:433
Finding

Project Path Traversal Combined with Repository-Wide Git Staging

Content
View full analysis

Vulnerability Details

File Location: scripts/ai_worker.py, lines 433-442; repository-wide staging at line 164
Vulnerability Type: Unvalidated filesystem path and excessive Git operation scope
Risk Level: Medium

Vulnerable Code

python
parser.add_argument("--workspace", default=None, help="Working directory")
parser.add_argument("--project", help="Project ID")
parser.add_argument("--tool", default="python3", help="Toolchain (moon/python/node)")
parser.add_argument("--cycle", action="store_true", help="Run full cycle")

args = parser.parse_args()

worker = AIWorker(args.db, args.workspace)

if args.project and args.cycle:
    project_dir = os.path.join(args.workspace, f"project_{args.project}")
    os.makedirs(project_dir, exist_ok=True)
    worker.run_full_cycle(args.project, args.tool, project_dir)

The selected directory is subsequently used for repository-wide staging:

python
subprocess.run(
    ["git", "add", "-A"],
    cwd=project_dir,
    check=True,
    capture_output=True
)

Technical Analysis

The --project argument is incorporated into a filesystem path without validating that it follows the generated DT-N identifier format. The resulting path is not canonicalized and is not checked to ensure that it remains beneath the configured workspace.

A project value containing path separators and traversal components can therefore make the resolved project directory escape the intended workspace after path normalization. The worker may then create directories, initialize a Git repository, write generated files, run database-supplied tests, and perform Git operations in an unintended location.

The risk is amplified by git add -A, which stages every tracked and untracked change visible to the selected repository rather than only files produced for the current MUF. This may include unrelated source changes, deleted files, configuration data, or secrets. The au ...[truncated 1743 chars]

Remediation
View remediation

Remediation Suggestions

  1. Validate project identifiers against a strict allowlist such as ^DT-[0-9]+$.
  2. Verify that the supplied project ID exists in SQLite before constructing or using its directory.
  3. Resolve the workspace and project paths with os.path.realpath() or pathlib.Path.resolve().
  4. Confirm containment before any filesystem operation, for example by using os.path.commonpath() and rejecting paths outside the resolved workspace.
  5. Reject absolute paths, path separators, null bytes, . components, and .. components in project identifiers.
  6. Stage only files explicitly generated or modified for the current MUF instead of using git add -A.
  7. Inspect the candidate staged-file list and reject files outside an approved project-relative allowlist.
  8. Require human confirmation if a commit would include pre-existing changes or files not produced during the current execution.
  9. Refuse to operate on an existing repository unless it is explicitly registered to the selected project.
  10. Add automated tests covering traversal attempts, symlink escapes, absolute paths, malformed identifiers, and unrelated working-tree changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (33)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior does not cleanly match the implemented or described capabilities: it claims a full AI-to-UT-to-auto-commit workflow while also mentioning local binary execution, repository inspection, and reset operations that are not clearly disclosed as primary behavior. Mismatched declarations undermine informed consent and security review, because operators may approve a task-management skill without realizing it can invoke local tools and mutate project state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documented behavior does not cleanly match the implemented or described capabilities: it claims a full AI-to-UT-to-auto-commit workflow while also mentioning local binary execution, repository inspection, and reset operations that are not clearly disclosed as primary behavior. Mismatched declarations undermine informed consent and security review, because operators may approve a task-management skill without realizing it can invoke local tools and mutate project state.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and documents shell execution, file writes, and repository operations, but the manifest shown in SKILL.md does not declare any explicit tool scope such as permissions or allowed-tools. That creates a transparency and authorization gap: a user or host system cannot easily tell that running the skill may execute local commands, modify files, and interact with Git, increasing the chance of unexpected code execution and workspace modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation repeatedly describes automatic code generation, file writes, Git initialization, and Git commits, yet it does not present a strong upfront warning that repository contents will be modified. In a developer environment, automatic write-and-commit behavior can permanently alter source history, commit sensitive files, or create misleading audit trails if users launch the workflow without realizing the side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The quick-start section gives executable commands for the full cycle but does not explicitly warn that running them may write source files and create Git commits automatically. Because these examples are copy-paste ready, they materially increase the risk of accidental repository mutation, especially in an existing workspace containing unrelated or sensitive changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The title and all instructional content are written in Chinese, which imposes a specific language on users without any opt-in or alternative language option. Under the policy, language-only guidance is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The entire schema document is written only in Chinese, including headings, field descriptions, and status explanations, with no indication that language selection is optional or that the document is intended only for a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The module docstring states the worker's core flow includes AI project/session/subtask/MUF decomposition and AI generation of unit tests, implying this file implements that end-to-end process. In reality, the executable flow in this file starts much later: it checks tooling, initializes git, runs tests, writes code, and updates status, but contains no decomposition or UT-generation logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language description and runtime messages are entirely in Chinese, indicating a fixed language experience. There is no indication that users can choose another language or that the locale restriction is intentional and documented as a region-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 46)May include surrounding context.

python
try:
            # MoonBit 使用 `moon version` 而不是 `moon --version`
            if tool_name == "moon":
                result = subprocess.run([tool_name, "version"], 
                                        capture_output=True, text=True, timeout=10)
            else:
                result = subprocess.run([tool_name, "--version"],

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 49)May include surrounding context.

python
result = subprocess.run([tool_name, "version"], 
                                        capture_output=True, text=True, timeout=10)
            else:
                result = subprocess.run([tool_name, "--version"], 
                                        capture_output=True, text=True, timeout=10)
            if result.returncode == 0:
                return True, f"版本：{result.stdout.strip().split(chr(10))[0]}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 84)May include surrounding context.

python
with open(os.path.join(tmpdir, "src", "test", "main.mbt"), "w") as f:
                    f.write('fn main { println("hello") }')
                
                result = subprocess.run(
                    ["moon", "build"],
                    cwd=tmpdir,
                    capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 103)May include surrounding context.

python
def _hello_world_python(self) -> Tuple[bool, str]:
        """测试 Python Hello World"""
        try:
            result = subprocess.run(
                ["python3", "-c", "print('hello')"],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 119)May include surrounding context.

python
def _hello_world_node(self) -> Tuple[bool, str]:
        """测试 Node.js Hello World"""
        try:
            result = subprocess.run(
                ["node", "-e", "console.log('hello')"],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 136)May include surrounding context.

python
"""初始化 git 仓库"""
        try:
            if not os.path.exists(os.path.join(project_dir, ".git")):
                subprocess.run(["git", "init"], cwd=project_dir, check=True, capture_output=True)
                print(f"✅ Git 仓库已初始化：{project_dir}")
            return True
        except Exception as e:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 152)May include surrounding context.

python
"""
        try:
            # 1. 检查是否有更改
            result = subprocess.run(
                ["git", "status", "--porcelain"],
                cwd=project_dir,
                capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill automatically stages and commits all repository changes without user confirmation. Given that this workflow also executes AI-generated tests/code in the same workspace, a malicious or erroneous task can alter unrelated files, inject backdoors, or commit secrets, and the commit step then legitimizes those changes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The worker blindly stages all changes in the repository with 'git add -A' after automated task execution. In this skill's context, AI-generated code and tests run inside the project directory, so this can persist unintended, sensitive, or malicious modifications without human review.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 164)May include surrounding context.

python
return True
            
            # 2. Add all changes
            subprocess.run(["git", "add", "-A"], cwd=project_dir, check=True, capture_output=True)
            
            # 3. Commit with standardized message
            commit_msg = f"SE_ID:{se_id}, ST_ID:{st_id}, MUF_ID:{muf_id}, UT_ID:{ut_id}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

This auto-commit persists repository changes immediately after UT success, creating a durable audit artifact for whatever code or file changes were introduced. In combination with untrusted/generated test execution, passing tests can be used as a weak gate to legitimize and preserve malicious or accidental changes.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 168)May include surrounding context.

python
# 3. Commit with standardized message
            commit_msg = f"SE_ID:{se_id}, ST_ID:{st_id}, MUF_ID:{muf_id}, UT_ID:{ut_id}"
            result = subprocess.run(
                ["git", "commit", "-m", commit_msg],
                cwd=project_dir,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 190)May include surrounding context.

python
"""验证 git 历史中是否存在对应的 commit"""
        try:
            commit_msg = f"SE_ID:{se_id}, ST_ID:{st_id}, MUF_ID:{muf_id}, UT_ID:{ut_id}"
            result = subprocess.run(
                ["git", "log", "--oneline", "--grep", commit_msg],
                cwd=project_dir,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
100% confidence
Finding

The code executes unit test content pulled from the database via 'python3 -c test_code', which is effectively arbitrary Python code execution. In this skill's context, UTs are AI-generated and associated with automated workflow steps, so a poisoned test can read secrets, modify files, make network calls, or tamper with the repo before the auto-commit step.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 290)May include surrounding context.

python
def _run_python_test(self, test_code: str, project_dir: str) -> bool:
        """运行 Python 测试"""
        try:
            result = subprocess.run(
                ["python3", "-c", test_code],
                cwd=project_dir,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
78% confidence
Finding

Running 'moon test' executes project test code from the workspace, which may be AI-generated or otherwise untrusted. While less explicit than the Python '-c' case, it still allows arbitrary code in the test suite to run with the worker's privileges.

Content

Scanner excerpt · scripts/ai_worker.py (reported line 305)May include surrounding context.

python
def _run_moon_test(self, project_dir: str) -> bool:
        """运行 MoonBit 测试"""
        try:
            result = subprocess.run(
                ["moon", "test"],
                cwd=project_dir,
                capture_output=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest and module documentation describe an AI worker that automatically decomposes requirements and executes MUF implementation, but this code does not perform any AI-driven implementation here. Instead, it writes a fixed demo snippet (print('Hello from ...')) for each pending MUF, which does not match the claimed end-to-end AI execution behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The environment-check feature goes beyond inspecting configuration and actively executes local tool binaries and sample programs. In an agent-skill context this materially expands capability from task management into host code execution, which can be abused through PATH hijacking, trojanized developer tools, or simply unsafe use on sensitive hosts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
87% confidence
Finding

The CLI accepts a user-supplied tool name and then executes that binary locally via subprocess.run([tool, "--version"]). Although shell injection is avoided by using an argument list, this still permits execution of arbitrary local binaries discoverable in PATH, which exceeds simple task-management behavior and can trigger unintended or malicious code execution if a trojanized binary is present. In this skill context, an agent skill that can run local executables is more dangerous because it broadens host interaction beyond database/project management.

Content

Scanner excerpt · scripts/cli.py (reported line 195)May include surrounding context.

python
print(f"✅ {tool} 已安装：{tool_path}")
    
    try:
        result = subprocess.run([tool, "--version"], 
                                capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            print(f"✅ 版本：{result.stdout.strip().split(chr(10))[0]}")

Static analysis

No suspicious patterns detected.