ClawHub
Back to skill

Security audit

Chrome Extension Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chrome extension template generator, but its script can write outside the intended folder or overwrite files because inputs are not safely constrained.

Review this skill before installing. It does not appear to exfiltrate data or install persistence, but only run it in a disposable or clearly chosen output folder, avoid untrusted extension names/descriptions, and check for existing files because the generator can overwrite files or create output outside the intended directory if given crafted input.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
chrome-extension-generator.sh:43
Finding

Unvalidated input permits path traversal, file overwrite, and generated extension content injection

Content
View full analysis
"$OUTPUT_PATH/manifest.json" << MANIFEST { "manifest_version": 3, "name": "$NAME", "version": "1.0.0", "description": "$DESCRIPTION", "permissions": ["storage"], "action": { "default_popup": "popup.html", "default_icon": "icon.png" }, "background": { "service_worker": "background.js" }, "icons": { "16": "icon.png", "48": "icon.png", "128": "icon.png" } } MANIFEST ``` ```bash cat > "$OUTPUT_PATH/popup.html" << POPUP $NAME body { width: 300px; padding: 16px; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; } h1 { font-size: 16px; margin: 0 0 12px; } button { width: 100%; padding: 10px; background: #4285f4; color: white; border: none; border-radius: 4px; cursor: pointer; } button:hover { background: #3367d6; }

$NAME

$DESCRIPTION

Click Me POPUP ``` ```bash cat > "$OUTPUT_PATH/README.md" << README # $NAME $DESCRIPTION ``` ### Technical Analysis The extension name is converted to lowercase and spaces are replaced with hyphens, but directory separators, `..` path compon ...[truncated 2677 chars]
Remediation
View remediation
`, `

`, and `

`. - Keep user-controlled values out of raw markup and script contexts. 6. **Add negative security tests** - Test names containing `../`, absolute paths, slashes, quotes, newlines, JSON fragments, and HTML tags. - Verify that existing files are never replaced without explicit confirmation. - Verify that generated manifests remain valid JSON for all accepted input. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

描述的核心卖点是“一键生成 Chrome 扩展程序模板”，并且明确强调支持 Popup、Background Script、Content Script、Options 页面等多种类型。代码确实属于 Chrome 扩展脚手架生成器，这一点与总体方向一致；它会创建一个 Manifest V3 扩展骨架，并生成 popup、background、README 等基础文件。但关键不符之处在于：脚本无论输入什么 template/stack 参数，实际都只输出一个固定模板；没有生成 content.js，也没有在 manifest.json 中声明 content_scripts；没有生成 options.html/options.js，也没有 options_page/options_ui 配置。因此其实际能力显著弱于声明，尤其是“支持多种类型”这一主要功能没有真正实现，构成描述与行为不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description and the entire user-facing documentation are written in Chinese, with no indication that other languages are supported or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description is written as a Chinese-only user-facing instruction ('一键生成 Chrome 扩展程序模板'), which suggests a fixed language presentation without any indication of user opt-in or that the skill is intentionally region-specific. The policy requires avoiding language/locale constraints unless the skill offers a choice or clearly documents a justified locale limitation.

Content

No source excerpt is available for this finding.