ClawHub
Back to skill

Security audit

代码执行工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it documents broad AI-driven code execution with automatic confirmations, write-back to projects, sudo/root guidance, and unsupported safety claims.

Install only after reviewing the missing runner implementation and running it in an isolated, least-privilege environment. Do not run it with sudo/root, avoid recursive ownership changes on real project trees, pin and verify external CLI dependencies, and require explicit approval before destructive, deployment, permission, or dependency-management actions are synced back.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:61
Finding

Indiscriminate Automatic Approval of Security-Sensitive Prompts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-73
Vulnerability Type: Generic confirmation bypass in a PTY-based command executor
Risk Level: High

Vulnerable code:

python
if b'Do you want to' in output:
    os.write(master_fd, b'y\n')
if b'Are you sure' in output:
    os.write(master_fd, b'y\n')
if b'Continue?' in output:
    os.write(master_fd, b'y\n')

Technical Analysis

The documented implementation detects generic text fragments in process output and responds affirmatively without determining which command generated the prompt or what operation is awaiting approval. These strings are used by many security-sensitive and destructive operations, including package installation, file deletion, deployment, permission changes, and overwriting files.

The mechanism therefore removes an important interactive safety boundary. It also does not bind an approval to a specific command, expected program, predefined argument list, or known low-risk operation. A malicious repository, dependency, subprocess, or agent-generated command could deliberately print one of these strings and consume the injected affirmative response.

Attack Path

  1. An attacker places malicious instructions, code, or build scripts in a project processed by the skill.
  2. The coding agent or project tooling launches a command that requests confirmation before performing a destructive or security-sensitive operation.
  3. The command emits a generic prompt such as Are you sure.
  4. The PTY handler matches the text without validating the pending operation.
  5. The handler writes y to the subprocess.
  6. The destructive operation proceeds without informed user consent.
  7. If the runner was started with elevated privileges, the operation executes with those elevated privileges.

Impact Assessment

An attacker could bypass confirmation controls and cause unintended file modification or deletion, dependency i ...[truncated 298 chars]

Remediation
View remediation

Remediation Suggestions

  • Disable automatic affirmative responses by default.
  • Require explicit user approval for destructive, privileged, deployment, authentication, and dependency-management operations.
  • Bind any permitted automatic response to an exact executable, normalized argument list, expected prompt, and narrowly defined operation.
  • Maintain a denylist for destructive commands in addition to a minimal allowlist.
  • Display the exact pending command, working directory, execution user, and expected effects before requesting approval.
  • Reject prompts generated by unknown child processes.
  • Record approval decisions and executed commands in tamper-resistant audit logs.
  • Add tests proving that generic prompt text cannot independently trigger approval.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:257
Finding

Privileged AI-Driven Execution and Unsafe Recursive Ownership Changes

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 257-268; additional privileged execution guidance at lines 293-299 and 340-345
Vulnerability Type: Excessive privilege and unsafe recursive filesystem permission modification
Risk Level: Critical

Vulnerable code:

bash
sudo useradd -m -s /bin/sh code-runner

sudo chown -R code-runner:code-runner /path/to/projects

export CODE_RUNNER_USER="code-runner"

Related privileged execution command:

bash
sudo python3 scripts/run_code.py /path/to/project "task description"

Technical Analysis

The documentation recommends recursively changing ownership of a project tree and separately advises running an AI-driven code execution script through sudo. Ordinary source-code editing does not require root privileges. Executing model-selected or repository-influenced commands as root violates least privilege and magnifies every command-generation, prompt-injection, path-validation, and automatic-approval failure.

Recursive chown is also hazardous when applied to an incorrect, overly broad, symlink-influenced, or attacker-controlled path. The artifact does not provide implementation code demonstrating path canonicalization, workspace-boundary validation, symlink protections, privilege dropping, or isolation.

Attack Path

  1. A user follows the documentation and starts the task runner with sudo, or grants the execution account ownership over a broad project tree.
  2. The target repository contains attacker-controlled instructions, scripts, configuration, or build hooks.
  3. The coding agent processes that content and invokes an attacker-influenced command.
  4. The command runs under root privileges or under an account that owns more files than required.
  5. The automatic confirmation mechanism may approve any generated safety prompt.
  6. The attacker modifies protected files, changes permissions, installs software, accesses credentials, ...[truncated 692 chars]
Remediation
View remediation

Remediation Suggestions

  • Prohibit running the task runner as root or through sudo.
  • Create an unprivileged, dedicated execution account with no login access and no supplementary privileged groups.
  • Grant access only to a single isolated workspace rather than recursively changing ownership of a shared project hierarchy.
  • Canonicalize the requested workspace path and verify that it remains beneath an administrator-configured root.
  • Reject symlinks, path traversal, mount-point escapes, device files, and paths outside the approved workspace.
  • Use a disposable container or sandbox with a read-only root filesystem, dropped Linux capabilities, resource limits, and no host socket access.
  • Mount only required files and expose output through a separate controlled directory.
  • If setup requires privileged preparation, use a small audited launcher that creates the sandbox and irreversibly drops privileges before processing any project or prompt data.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:303
Finding

Unpinned Global Installation of a Third-Party CLI Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 303-309; repeated in the dependency table at lines 347-352
Vulnerability Type: Mutable and globally installed third-party dependency
Risk Level: Medium

Vulnerable code:

bash
which claude
npm install -g @anthropic-ai/claude-code

Technical Analysis

The installation command does not pin a reviewed package version and does not verify package integrity. It therefore resolves whichever release is current when the command runs. The use of global installation expands the package's effect beyond an isolated project environment and may permit installation lifecycle scripts to execute with significant user or system privileges.

The scoped package name is consistent with the stated vendor, and the audited artifact does not demonstrate that the package itself is malicious. The confirmed weakness is the unsafe dependency acquisition process: mutable version selection, absent integrity verification, and global installation.

Attack Path

  1. A user follows the setup instructions, potentially from a privileged shell.
  2. npm resolves the current package release rather than a previously reviewed version.
  3. A compromised, unexpectedly changed, or maliciously published release is downloaded.
  4. Package installation or lifecycle logic executes with the privileges available to npm.
  5. The installed global executable is subsequently trusted by the skill and receives project content and API access.

Impact Assessment

A compromised dependency could execute commands with the installing user's privileges, modify globally accessible tooling, read source code and environment variables, or intercept API credentials used by the CLI. If npm is run with elevated privileges, the impact can extend to system-wide modification.

Remediation
View remediation

Remediation Suggestions

  • Pin an explicitly reviewed package version.
  • Verify registry provenance and package integrity before installation.
  • Use a lockfile or equivalent reproducible dependency manifest.
  • Install the CLI inside a dedicated container, virtual environment, or project-local tool directory rather than globally.
  • Never perform the installation as root.
  • Disable installation scripts where feasible, or audit required lifecycle scripts before enabling them.
  • Establish a controlled update process that reviews release notes, package contents, signatures, and dependency changes before version upgrades.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:136
Finding

Security Controls Are Claimed but Their Implementations Are Missing

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 136-165; safety claims at lines 390-406
Vulnerability Type: Unverifiable sandbox, command allowlist, path handling, and synchronization controls
Risk Level: Medium

Referenced commands:

bash
chmod +x scripts/run_code.py
python3 scripts/run_code.py /path/to/project "implement a health-check endpoint"

Referenced API:

python
from code_runner import run_code_task

Technical Analysis

The project contains only SKILL.md. The referenced scripts/run_code.py file and code_runner module are not included. Consequently, the audit cannot verify command construction, argument handling, path canonicalization, temporary-directory creation, symlink defenses, file synchronization, privilege dropping, timeout handling, output redaction, command allowlisting, or sandbox enforcement.

The document states that commands execute in a secure sandbox and that only allowlisted commands should run, but no implementation is present to enforce those controls. Users may therefore rely on security properties that this artifact does not supply or demonstrate.

Attack Path

  1. A user trusts the documented sandbox and command-allowlist claims.
  2. The user obtains, generates, or substitutes the missing runner from an unaudited source.
  3. The runner processes attacker-controlled repository content or natural-language prompts.
  4. Missing or defective validation permits command injection, workspace escape, unsafe synchronization, or unrestricted subprocess execution.
  5. The runner modifies the original project or host with the privileges assigned to it.

This finding does not establish that a particular missing implementation is malicious. It establishes that the security-critical behavior cannot be verified from the supplied project and that the documented workflow depends on absent code.

Impact Assessment

The potential scope includes arbitr ...[truncated 347 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the complete runner implementation and all imported modules in the audited package.
  • Implement and test command allowlisting, sandboxing, path validation, symlink protections, privilege dropping, and safe synchronization in code rather than relying on documentation.
  • Fail closed when any required isolation mechanism is unavailable.
  • Publish a precise trust model describing network access, mounted paths, subprocess permissions, credential exposure, and synchronization behavior.
  • Add security tests for shell metacharacters, malicious filenames, path traversal, symlink races, unsafe temporary files, prompt injection, timeout termination, and output secret redaction.
  • Do not describe execution as sandboxed until the supplied and auditable implementation enforces that property.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documents automatic confirmation of prompts and syncing file changes back to the original directory, but does not prominently warn users that destructive or security-sensitive actions may be auto-approved. In a code execution context, this can turn ambiguous prompts, install scripts, deletes, or permission changes into unintended host modifications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The safety section says only whitelisted commands are executed, but the rest of the skill describes arbitrary natural-language-driven programming tasks via an external CLI with automatic prompt handling. Without documented and enforced command restrictions, users may incorrectly assume dangerous commands cannot run when in fact broad command execution is possible.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document claims commands run in a 'safe sandbox', but elsewhere describes root/sudo execution, chown/user switching, PTY command execution, and syncing changes back into the original project. This is a misleading security claim that may cause operators to over-trust the tool and run high-risk actions on sensitive systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says to use the skill whenever there is code generation, programming assistance, debugging, testing, or deployment, which is a very wide set of ordinary developer requests rather than a narrowly scoped trigger. Although it excludes vague non-technical needs, it still does not define specific trigger phrases or clear boundaries for when this skill should or should not activate among many common coding tasks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill instructs use of sudo to create a dedicated execution user. While administrative setup is sometimes legitimate, normalizing sudo-based setup around a powerful code-execution tool increases the chance of unsafe deployment and accidental over-privileging.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

bash
# 创建专用执行用户(推荐)
sudo useradd -m -s /bin/sh code-runner

# 已知限制
sudo chown -R code-runner:code-runner /path/to/projects

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The instruction to recursively chown project trees with sudo can alter ownership of sensitive files and weaken operational safeguards. In the context of a tool that copies, edits, and syncs files, this expands the writable surface and can enable accidental or malicious tampering.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md
sudo useradd -m -s /bin/sh code-runner

# 已知限制
sudo chown -R code-runner:code-runner /path/to/projects

# 使用该用户执行
export CODE_RUNNER_USER="code-runner"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples advise running with root or sudo to resolve permission issues, but do not prominently warn that privileged execution magnifies the impact of any prompt injection, unsafe command generation, or sync-back bug. In a tool designed to execute coding tasks, encouraging elevation materially increases blast radius.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The FAQ explicitly advises running the script as root or via sudo to handle permissions. Because the skill executes natural-language-driven coding tasks, auto-responds to prompts, and syncs changes back, elevated execution can convert ordinary mistakes or unsafe generated commands into full host compromise or destructive system changes.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

确保脚本有足够权限创建临时目录、切换文件所有权、切换用户:

bash
# 以 root 或 sudo 运行
sudo python3 scripts/run_code.py /path/to/project "任务描述"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

This line continues the explicit recommendation to run the code-execution script with sudo. In this skill's context, privileged execution is especially dangerous because the tool can perform arbitrary development tasks, auto-confirm prompts, and write modifications back to the source directory.

Content

Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.

bash
# 以 root 或 sudo 运行
sudo python3 scripts/run_code.py /path/to/project "任务描述"

Q2: 找不到代码 CLI 怎么办?

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is presented primarily as a local PTY-based runner, but the dependency section states it requires Claude Code and external LLM/API connectivity. This mismatch can cause users to trust the tool as local-only while it may transmit prompts, code, file contents, or metadata to third-party services, creating hidden data-exposure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The description foregrounds Chinese interaction and much of the document is written only in Chinese, while the skill is presented as usable by arbitrary AI agents and teams. There is no explicit statement that users may choose another language or that Chinese is an optional locale, which can be read as a default language constraint without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.