T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sync.cjs:250- Finding
Shell Command Injection Through Skill Names and Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Sync
Security checks for vulnerabilities and agentic risk
Overview
This skill can automatically publish local skills and push Git repositories, but its advertised safety controls are incomplete or not enforced.
Review carefully before installing. Use it only in a controlled skills workspace, assume it may publish and push any synchronized skill repository, avoid unattended cron use until confirmation and dry-run controls are implemented, and inspect repositories for secrets before running it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync.cjs:250- Finding
Unrestricted Repository Publication May Expose Sensitive Files
- Content
View full analysis
- Remediation
View remediation
` rather than `git add .`. 6. Package approved files into a controlled temporary staging directory and publish that directory rather than the repository root. 7. Require confirmation for first-time publication and whenever unexpected files appear. 8. Document that ignore rules are a secondary defense and are not a substitute for an outbound allowlist. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync.cjs:391- Finding
Documented and Configured Safety Controls Are Not Enforced
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 包含 `SKILL.md` 文件
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 包含 `SKILL.md` 文件
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 包含 `SKILL.md` 文件
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
json }, "gitSettings": { "autoPush": true, "commitMessageTemplate": "Update skill: {name} v{version}", "branch": "main" }, "clawhubSettings": {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is explicitly designed to auto-publish to ClawHub and auto-commit/push to GitHub, which are external side effects affecting remote systems. Without a prominent upfront warning and explicit consent model, users may enable the skill without appreciating that local changes can be published publicly or pushed to repositories automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The configuration example sets requireConfirmation to false while enabling automatic publishing, creating an unattended publication path to external services. In a skill that scans for changed content and syncs automatically, this increases the chance of accidental, unauthorized, or harmful publication of modified skills, especially if a local skill is tampered with.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The security section asserts the skill only syncs the skills directory, but the same document also states it writes status and log files under a separate memory path outside that directory. This is a documentation-level safety misrepresentation: it can mislead users about the skill's write scope and reduce their ability to assess operational risk accurately.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically publishes skills to ClawHub and pushes commits to GitHub once changes are detected, without any interactive confirmation, dry-run mode, or explicit safety gate immediately before the remote actions. This can cause unintended external publication of modified content, accidental disclosure of local work, or irreversible remote changes if the scan or configuration includes a skill the user did not intend to sync.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The cron example hard-codes a requirement that the report be formatted in Chinese. This is a natural-language locale constraint presented without any indication that the user can choose another language, which conflicts with the policy against forcing a language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code formats the report timestamp using the zh-CN locale and Asia/Shanghai timezone unconditionally. This imposes a specific locale preference on all users without offering a choice or documenting a justified regional restriction.
- Content