ClawHub
Back to skill

Security audit

dice-roller

Security checks for vulnerabilities and agentic risk

Overview

This is a small local dice-rolling skill with a real input-size hardening gap but no hidden access, persistence, network behavior, or data exposure.

Reasonable to install for local dice rolling. Avoid using extremely large dice expressions, and the publisher should add explicit limits for spec length, dice count, and die sides before exposing it to untrusted users.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/roll.py:11
Finding

Unbounded Dice Count Permits Resource Exhaustion

Content
View full analysis

Vulnerability Details

File Location: scripts/roll.py, lines 11–26
Vulnerability Type: Uncontrolled resource consumption
Risk Level: Medium

Vulnerable Code:

python
count, sides = int(m.group(1)), int(m.group(2))
sign = m.group(3)
mod = int(m.group(4)) if m.group(4) else 0
if sign == "-":
    mod = -mod
keep = int(m.group(5)) if m.group(5) else None

if count < 1 or sides < 2:
    raise ValueError("Need at least 1 die and 2 sides.")
if keep and keep > count:
    raise ValueError("Cannot keep more dice than rolled.")

rng = random.Random(seed)
rolls = [rng.randint(1, sides) for _ in range(count)]

Technical Analysis

The dice count is derived directly from user-controlled notation and has no upper bound. Although the code verifies that at least one die is requested, it does not impose a practical maximum before using count to construct the rolls list.

A sufficiently large count causes the list comprehension to perform excessive iterations and allocate substantial memory. Extremely long numeric fields may also consume computational resources during integer conversion before the rolling loop begins. This creates a local denial-of-service condition through uncontrolled CPU and memory consumption.

Attack Path

  1. An attacker submits dice notation containing an extremely large count, such as a value conceptually equivalent to 999999999d6.
  2. The regular expression accepts the count because \d+ has no maximum length.
  3. The application converts the captured value to an integer without enforcing an upper bound.
  4. The list comprehension attempts to generate and retain count random values.
  5. The process experiences excessive CPU and memory consumption and may become unresponsive or be terminated by the operating system.

Impact Assessment

Exploitation does not grant additional privileges, access to sensitive data, or code execution. Its impact is limit ...[truncated 229 chars]

Remediation
View remediation

Remediation Suggestions

Enforce explicit limits before allocating or iterating. The limits should reflect the legitimate use case and execution environment. For example:

python
MAX_SPEC_LENGTH = 100
MAX_DICE = 10_000
MAX_SIDES = 1_000_000

if len(spec) > MAX_SPEC_LENGTH:
    raise ValueError("Dice notation is too long.")

if not 1 <= count <= MAX_DICE:
    raise ValueError(f"Dice count must be between 1 and {MAX_DICE}.")
if not 2 <= sides <= MAX_SIDES:
    raise ValueError(f"Die sides must be between 2 and {MAX_SIDES}.")

Apply the input-length check before regular-expression matching and integer conversion. Also consider execution-level CPU and memory limits as defense in depth when the Skill is exposed to untrusted requests. Add tests confirming that oversized counts, side values, and notation strings are rejected without starting roll generation.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description says to use the skill when the user "needs reproducible random rolls via a seed," which is broader than a clear dice-rolling trigger and could overlap with general requests for random-number generation. While the rest of the description is fairly specific, this phrase lacks boundaries or negative examples clarifying when non-dice randomness requests should not invoke the skill.

Content

No source excerpt is available for this finding.