ClawHub
Back to skill

Security audit

python-dev

Security checks for vulnerabilities and agentic risk

Overview

This Python setup skill is mostly coherent, but users should review it because some copied templates can execute mutable tooling and one Justfile test helper can run unsafe shell input if arguments are untrusted.

Install only if you are comfortable with the agent creating Python project config, installing dev dependencies, and adding repository git hooks. Before copying the templates into CI or shared tooling, fix the Justfile test argument handling, prefer locked or exact dependency versions, pin CI actions more strictly where required, and review any cleanup or migration command before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:166
Finding

Command Injection Through Unquoted Justfile Argument Interpolation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:87
Finding

Executable Dependencies and CI Actions Use Mutable References

Content
View full analysis
=0.16.6", "ty>=0.0.79", "pytest>=9.1.1", "pytest-asyncio>=1.4.0", "lefthook>=2.1.12", ] ``` ```yaml - uses: actions/checkout@v7 - uses: astral-sh/setup-uv@v10.0.1 ``` The reference guide also recommends a mutable VCS branch: ```bash uv add git+https://github.com/encode/httpx --branch main ``` ### Technical Analysis The package constraints specify only minimum versions, allowing future releases to be selected when a new lockfile is created or dependencies are upgraded. The GitHub Actions references are tags rather than immutable commit hashes, while the VCS example explicitly follows the mutable `main` branch. These components execute code in developer or CI environments. A committed lockfile reduces ordinary Python dependency drift after initial resolution, but it does not protect new projects, explicit upgrades, lockfile regeneration, mutable VCS branches, or GitHub Action tags. There is no evidence that the named upstream projects are malicious. The vulnerability is the absence of immutable references at execution boundaries, which increases impact if an upstream release channel, repository, maintainer account, or tag is compromised. ### Attack Path 1. A project copies the dependency or CI templates. 2. An upstream account, release process, package release, action tag, or tracked VCS branch is compromised or maliciously modified. 3. A developer regenerates the lockfile, runs the documented upgrade recipe, initializes a new project, or triggers the CI workflow. 4. The package manager or GitHub Actions runner retrieves the altered component because the configured ...[truncated 736 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (17)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

Clean build artifacts

clean: rm -rf dist/ build/ .pytest_cache/ .ruff_cache/ htmlcov/ find . -type d -name pycache -exec rm -rf {} + 2>/dev/null || true

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/justfile-reference.md (reported line 253)May include surrounding context.

Clean build artifacts

clean: rm -rf dist/ build/ .pytest_cache/ .ruff_cache/ htmlcov/ find . -type d -name pycache -exec rm -rf {} + 2>/dev/null || true

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/justfile-reference.md (reported line 98)May include surrounding context.

Settings

just
# Load .env file
set dotenv-load

# Export all variables as env vars

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/ruff-reference.md (reported line 229)May include surrounding context.

ruff clean # Clear cache ruff check --show-settings # Show resolved config ruff check --show-files # Show files to be checked ruff check --statistics # Show rule violation counts

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/justfile-reference.md (reported line 131)May include surrounding context.

md
# Platform-specific
[linux]
install:
    sudo apt install libfoo-dev

[macos]
install:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/justfile-reference.md (reported line 169)May include surrounding context.

md
# dependencies = ["httpx"]
    # ///
    import httpx
    r = httpx.get("https://api.example.com/health")
    print(f"Status: {r.status_code}")

# Bash with strict mode

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The documentation recommends uvx ty check without pinning a specific version, which causes execution of the latest available ty package at runtime. Because ty is explicitly described as beta with behavior changing across minor releases, this creates a supply-chain and reproducibility risk: users may run unexpected code or experience breaking behavior simply by following the docs.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/ty-reference.md (reported line 239)May include surrounding context.

For untyped code, ty uses Unknown instead of Any to avoid false positives:

python
max_retries = None       # ty infers: Unknown | None (not just None)
max_retries = 3          # no error - Unknown allows this

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The example uvx ruff check . invokes a tool without pinning a version, so future executions may resolve to a newer or compromised release than the author intended. In a development/setup skill, users may copy commands directly into terminals or CI, making this a real supply-chain risk through nondeterministic tool selection.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The command uvx --with mkdocs-material mkdocs build pulls an unpinned package at execution time, which can lead to unexpected or malicious dependency resolution if upstream packages change. Because this skill is specifically for developer environment and CI setup, readers are likely to reuse this pattern in automation, increasing supply-chain exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The troubleshooting example rm -rf .venv && uv sync contains a destructive deletion command without an explicit warning, which can cause accidental data loss if copied carelessly or adapted incorrectly. While limited here to a conventional virtualenv path, shell deletion patterns are inherently risky in documentation because users may modify or mis-execute them.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 27)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 31)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 54)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 147)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown includes a clean task that recursively deletes directories and cache artifacts using rm -rf and find ... -exec rm -rf, but the surrounding documentation does not explicitly warn that running it removes local files. Because markdown files should disclose behaviors that affect user data or system state, this destructive operation should be called out clearly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The migration section instructs users to run rm .pre-commit-config.yaml, which deletes an existing project file, but the instructions do not clearly warn that this is a destructive change. Although the later note mentions leftover hook handling, it does not disclose the deletion risk of this config removal step itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.