ClawHub
Back to skill

Security audit

doubt-driven-develop

Security checks for vulnerabilities and agentic risk

Overview

The skill is not visibly malicious, but it asks for broad file, command, API, and network capabilities without clearly defining what it will do with them.

Review this skill before installing. Only use it in a disposable or tightly scoped workspace, do not provide production credentials, and avoid administrator/root execution unless the publisher documents exact commands, file paths, external services, and consent gates.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:9
Finding

Overly Broad File-Read and Command-Execution Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–11; related privilege and credential guidance appears at lines 150, 163–164, 196, 209–210, and 227–230.
Vulnerability Type: Excessive tool permissions and insufficient least-privilege boundaries
Risk Level: Medium

Vulnerable Code

yaml
tools:
  - read
  - exec

Technical Analysis

The Skill declares both file-reading and command-execution capabilities despite providing no concrete implementation, approved command list, restricted filesystem paths, external-service allowlist, or permission boundaries. Its documentation also directs users to configure API credentials, requires access to unspecified external services and command-line tools, and recommends elevated execution when troubleshooting permission failures.

This combination violates the principle of least privilege. An agent loading the Skill could potentially use read to access files outside the intended workspace and exec to invoke arbitrary local commands. If API keys are present in environment variables, unconstrained commands may also access those credentials. Unspecified network destinations further prevent reviewers from determining where processed data or credentials could be transmitted.

No malicious command, payload, endpoint, or demonstrated exfiltration mechanism is included in the audited file. The risk therefore arises from excessive and undefined permissions rather than confirmed malicious execution.

Attack Path

  1. A user installs or loads the Skill for its advertised development-data processing capability.
  2. The agent receives the declared read and exec tools without documented path or command restrictions.
  3. The user configures an API key or other credential in the environment as instructed.
  4. During processing or troubleshooting, the agent reads unintended local files or executes an unrestricted command.
  5. If the user follows the elevated-permiss ...[truncated 929 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove exec unless command execution is essential to a clearly documented feature.
  2. Replace unrestricted execution with a strict allowlist of commands, fixed executable paths, validated arguments, timeouts, and resource limits.
  3. Restrict file access to explicitly documented workspace directories and deny access to credential stores, home-directory secrets, system files, and unrelated repositories.
  4. Remove the recommendation to run with administrator privileges. Fail safely when required access is unavailable.
  5. Document every external service and enforce a hostname, protocol, and port allowlist.
  6. Use narrowly scoped credentials for a named service. Prevent commands and logs from exposing environment variables or API keys.
  7. Define the exact processing implementation, dependencies, data flows, and output locations so reviewers can verify that each permission is necessary.
  8. Require explicit user confirmation before any command execution, external transmission, or access outside the project workspace.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description claims broad applicability and 'out-of-box' use without meaningful activation boundaries. Overly broad positioning increases the chance the skill is invoked in contexts involving sensitive data or privileged environments where its implied automation authority is inappropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown describes API calls, file operations, and command execution but does not provide prominent user-facing warnings about external transmission, local modification, credential handling, or command side effects. In practice, this can cause users to authorize or trigger risky operations without informed consent, increasing the chance of data leakage or system damage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill presents itself as generic development-process automation, but later introduces API access, file-system interaction, and command execution capabilities that materially expand its privilege and attack surface. This mismatch can mislead users and orchestrators into invoking the skill in higher-risk contexts without appropriate review, enabling unintended data access or system-side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill introduces API-key setup, external connections, and networked behavior without a clear link to its advertised function. This creates avoidable exfiltration and supply-chain risk, especially if user data or repository content can be transmitted to external services under vague operational language.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation normalizes command execution even though the skill's stated purpose does not justify arbitrary shell access. In an agent environment, unnecessary exec capability materially increases the risk of command injection, destructive local actions, and abuse of inherited host permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.