ClawHub
Back to skill

Security audit

Overllm

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently helps users run a local linter to find unnecessary LLM calls, with no evidence of hidden behavior or data exfiltration.

Install only from a trusted package index, preferably in a virtual environment or container, and review before using opt-in write modes like `--fix` or `--write-baseline`. Normal documented scans are intended to read user-selected source files and report findings locally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:61
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–66
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash
overllm --version || pip install "overllm[js]"
markdown
`overllm[js]` adds JavaScript/TypeScript support; plain `pip install overllm`
covers Python only.

Technical Analysis

The documented fallback installs the latest available overllm package and its optional JavaScript dependency set from pip's configured package index. Neither an exact package version nor integrity hashes are specified. Consequently, the installed code may differ from the version reviewed when this Skill was published.

Because the installed overllm executable is subsequently run against user-selected source trees, a compromised package release, transitive dependency, or configured package index could cause attacker-controlled code to execute with the invoking user's permissions. The audit found no evidence that the current package is malicious; the issue is the mutable and insufficiently verified dependency installation process.

Attack Path

  1. An attacker compromises the overllm package, one of its transitive dependencies, or a package index configured in the target environment.
  2. The target system does not already have the overllm command, causing overllm --version to fail.
  3. The shell executes the fallback command, pip install "overllm[js]".
  4. Pip resolves and installs an unpinned, attacker-controlled release or dependency.
  5. The user follows the Skill instructions and invokes overllm against a source repository.
  6. The compromised component executes with the user's privileges and can access resources available to that process.

Impact Assessment

Successful supply-chain exploitation could provide arbitrary code execution under the account performing the installation or scan. The resulting access may include reading or mod ...[truncated 407 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin overllm to a reviewed exact version rather than resolving the latest release.
  • Use a lock file or requirements file containing cryptographic hashes and install with pip's --require-hashes option.
  • Pin and review transitive dependencies, including those introduced by the js extra.
  • Specify or document an approved, trusted package index and prevent unintended fallback to untrusted indexes.
  • Separate dependency installation from the scan command so users can inspect and approve the installation step before execution.
  • Prefer installation in an isolated virtual environment or container with minimal filesystem, credential, and network access.
  • Add a documented verification process for package provenance and integrity before invoking the installed executable.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.