ClawHub
Back to skill

Security audit

smart-storage-triage

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local search/indexing helper that discloses its file indexing behavior and includes reasonable local privacy safeguards.

Install only if you want an agent to create local searchable indexes of directories you choose. Confirm the exact directory before indexing, avoid broad personal or shared drives unless needed, and periodically remove generated storage_rag.db or tree.json.gz files if they are no longer wanted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The description overstates the functionality relative to the provided code. The script is a narrow search helper over an existing tree.json.gz snapshot, not a full smart search/triage system. Its actual behavior is limited to locating a snapshot file from CLI/env/config/default locations, loading JSON from gzip, extracting path strings from supported record formats, and matching those paths by regex or substring with optional extension and limit filters. There is no SQLite usage, no FTS5/BM25 ranking, no directory indexing, no confirmation gate, and no direct searching of local files, documents, or archive contents. This is a material description-behavior mismatch.

Credential Access

High
Category
Privilege Escalation
Content
## Security & Privacy (Safety First)

1. **Automatic Secret & Credential Exclusion:**
   - Files matching `.env*`, `credentials.json`, `token.json`, `auth.json`, `secrets.json`, `id_rsa*`, `id_ed25519*`, `*.pem`, `*.key`, `*.kdbx`, `*.pfx`, `*.p12` are strictly excluded from **both** full-text indexing and directory tree snapshots (`tree.json.gz`).
   - Sensitive directories (`.ssh`, `.aws`, `.gnupg`, `.azure`, `.kube`, `.secrets`, `secrets`) are completely skipped.
2. **Symlink Boundary Protection:**
   - Directory symlinks are pruned to prevent directory traversal loops.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Security & Privacy (Safety First)

1. **Automatic Secret & Credential Exclusion:**
   - Files matching `.env*`, `credentials.json`, `token.json`, `auth.json`, `secrets.json`, `id_rsa*`, `id_ed25519*`, `*.pem`, `*.key`, `*.kdbx`, `*.pfx`, `*.p12` are strictly excluded from **both** full-text indexing and directory tree snapshots (`tree.json.gz`).
   - Sensitive directories (`.ssh`, `.aws`, `.gnupg`, `.azure`, `.kube`, `.secrets`, `secrets`) are completely skipped.
2. **Symlink Boundary Protection:**
   - Directory symlinks are pruned to prevent directory traversal loops.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Security & Privacy (Safety First)

1. **Automatic Secret & Credential Exclusion:**
   - Files matching `.env*`, `credentials.json`, `token.json`, `auth.json`, `secrets.json`, `id_rsa*`, `id_ed25519*`, `*.pem`, `*.key`, `*.kdbx`, `*.pfx`, `*.p12` are strictly excluded from **both** full-text indexing and directory tree snapshots (`tree.json.gz`).
   - Sensitive directories (`.ssh`, `.aws`, `.gnupg`, `.azure`, `.kube`, `.secrets`, `secrets`) are completely skipped.
2. **Symlink Boundary Protection:**
   - Directory symlinks are pruned to prevent directory traversal loops.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Security & Privacy (Safety First)

1. **Automatic Secret & Credential Exclusion:**
   - Files matching `.env*`, `credentials.json`, `token.json`, `auth.json`, `secrets.json`, `id_rsa*`, `id_ed25519*`, `*.pem`, `*.key`, `*.kdbx`, `*.pfx`, `*.p12` are strictly excluded from **both** full-text indexing and directory tree snapshots (`tree.json.gz`).
   - Sensitive directories (`.ssh`, `.aws`, `.gnupg`, `.azure`, `.kube`, `.secrets`, `secrets`) are completely skipped.
2. **Symlink Boundary Protection:**
   - Directory symlinks are pruned to prevent directory traversal loops.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Security & Privacy (Safety First)

1. **Automatic Secret & Credential Exclusion:**
   - Files matching `.env*`, `credentials.json`, `token.json`, `auth.json`, `secrets.json`, `id_rsa*`, `id_ed25519*`, `*.pem`, `*.key`, `*.kdbx`, `*.pfx`, `*.p12` are strictly excluded from **both** full-text indexing and directory tree snapshots (`tree.json.gz`).
   - Sensitive directories (`.ssh`, `.aws`, `.gnupg`, `.azure`, `.kube`, `.secrets`, `secrets`) are completely skipped.
2. **Symlink Boundary Protection:**
   - Directory symlinks are pruned to prevent directory traversal loops.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Credential Access

High
Category
Privilege Escalation
Content
}

SENSITIVE_FILE_EXACT = {
    ".env", "credentials.json", "token.json", "auth.json", "secrets.json",
    "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa"
}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
}

SENSITIVE_FILE_EXACT = {
    ".env", "credentials.json", "token.json", "auth.json", "secrets.json",
    "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa"
}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

Low
Confidence
76% confidence
Finding
The manifest describes smart search and storage triage over codebases, files, documents, and archives, but this script also inspects the user's home-directory config and process environment to locate a database. While not highly sensitive by itself, consulting ~/.config and environment variables is a broader host-context access pattern than the manifest describes for a search tool.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The sanitizer documentation asserts 'bulletproof query sanitization' and says it prevents syntax crashes, but the script still relies on catch-all exception handling around MATCH queries and falls back to alternate query strategies when they fail. That is not just incomplete documentation; it overstates what the sanitizer guarantees compared with the actual behavior.

Static analysis

No suspicious patterns detected.