ClawHub
Back to skill

Security audit

Workflow Essentials

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an automation-methodology guide, but it requests command execution and file writing and includes poorly scoped operational instructions that users should review before enabling.

Install only if you are comfortable with a workflow guide that may be treated as able to execute commands and write files. Prefer running it in a sandbox, deny command execution unless explicitly needed, and review any suggested ping, export, posting, SaaS-account, or file-writing action before allowing it.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:22
Finding

Excessive Command-Execution and File-Write Privileges

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:22-25, with related execution instructions at SKILL.md:638 and SKILL.md:708-709
Vulnerability Type: Violation of least privilege through unnecessary shell-execution and file-write capabilities
Risk Level: Medium

Vulnerable Code

yaml
tools:
  - read
  - exec
  - write

Related instructions:

text
If required input parameters are missing, prompt the user to provide them, then execute a ping command to test network connectivity and check firewall and proxy settings before rerunning the command.
text
- Classification: MD+EXEC (pure Markdown instructions; some functions require exec command-line execution capability)
- Description: A Markdown-based AI Skill that uses natural-language instructions to guide the Agent in designing and maintaining automation workflows

Technical Analysis

The Skill's declared purpose is to provide workflow methodology, configuration guidance, maintenance advice, and troubleshooting documentation. These functions can be fulfilled through textual responses and do not inherently require unrestricted command execution or filesystem modification.

Nevertheless, the Skill requests both exec and write. It also directs the Agent to run a network diagnostic command when a required input parameter is absent. Missing input is an application-level validation error and has no necessary relationship to network connectivity, firewall configuration, or proxy configuration.

This creates an unnecessary privilege boundary violation. If user-controlled workflow content is interpreted as an operational instruction, the broadly available tools could allow the Agent to execute commands or modify files beyond the Skill's documentation-oriented purpose. No direct malicious payload was identified, but the excessive permissions create an avoidable exploitation surface.

Attack Path

  1. The Skill is loaded with ...[truncated 1419 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove exec and write from the declared tool list. Retain only read if document access is required.
  2. Remove the instruction to execute ping when required input is missing. Handle missing input exclusively through parameter validation and a request for the absent value.
  3. If future functionality genuinely requires execution, replace unrestricted exec with narrowly scoped operations that use:
    • Fixed executable allowlists.
    • Structured arguments rather than shell command strings.
    • Strict validation of paths, hosts, URLs, and user-controlled values.
    • Shell metacharacter rejection.
    • Explicit user confirmation before execution.
    • Restricted working directories and filesystem permissions.
    • Network egress controls.
  4. If file output becomes necessary, restrict writes to a dedicated workspace, reject path traversal and absolute paths, and prevent overwriting existing files without confirmation.
  5. Document each privileged operation and explain why it is necessary for the declared Skill function.
  6. Run the Skill in a sandbox with minimal operating-system privileges, no sensitive environment variables, and no access to unrelated user files.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The troubleshooting guidance tells the agent to run a network diagnostic command after missing input, which is unrelated to the stated methodology purpose and introduces real system-side effects. This is dangerous because a simple documentation-driven invocation could trigger command execution on the host, normalize shell access, and create a path for broader command abuse or environmental probing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as a methodology/guide, but its input contract introduces operational fields such as callback_url and implies runtime handling of external destinations. That mismatch can cause an agent or integrator to treat documentation as authority to perform real actions, expanding the skill from advisory content into execution-oriented behavior without clear safety boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The statement that the skill supports create/query/export operations turns a general workflow guide into something that appears capable of manipulating or exfiltrating data. In an agent ecosystem, this kind of ambiguous expansion is dangerous because downstream systems may authorize actions based on the skill text alone, even though the skill lacks narrowly defined guards and approval requirements.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims applicability across a very broad set of generic keywords instead of narrowly scoped triggers, increasing the chance of accidental or opportunistic invocation in unrelated contexts. Broad invocation scope is risky because it can cause this exec-capable skill to be selected when a user merely discusses automation concepts, unnecessarily exposing write/exec pathways.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The troubleshooting text recommends running a network test command without any user-facing warning, confirmation step, or explanation of system impact. In agent contexts, undocumented command execution is especially risky because natural-language instructions can be operationalized automatically, leading to unexpected probing of the local environment or network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The dependency section explicitly categorizes the skill as MD+EXEC and notes that some functions require exec, but it does not provide a clear user-facing warning about host command execution or its risks. This is dangerous because users and orchestrators may enable the skill under the assumption it is a documentation helper, while it silently expands into system-impacting capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The license section states the content was '完全中文化全部内容，针对中文用户重写', indicating a fixed language/locale orientation. There is no indication elsewhere that users may opt into another language or that the locale restriction is required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example includes a shell command block in a skill that is primarily framed as methodology guidance, which can condition agent platforms to interpret examples as executable instructions. Even a harmless example like echo lowers the barrier for later substitution with impactful commands and blurs the distinction between illustrative text and permitted execution.

Content

No source excerpt is available for this finding.