ClawHub
Back to skill

Security audit

Chemical Storage Sorter

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it gives safety-critical chemical storage advice with under-scoped warnings and demonstrably unsafe classification behavior.

Install only for rough demonstration or non-operational triage. Do not use it to make real lab storage, inspection, relocation, or training decisions unless its output is independently checked against SDS data, institutional SOPs, and qualified EHS review; also treat inventory files as local data that may be read or transformed by the skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/main.py:15
Finding

Unsafe First-Match Chemical Classification Produces False Compatibility Results

Content
View full analysis

Vulnerability Details

File Location: scripts/main.py:15-94
Vulnerability Type: Unsafe classification and fail-open compatibility logic
Risk Level: High

Vulnerable Code

python
COMPATIBILITY_GROUPS = {
    "acids": {
        "compatible": ["acids"],
        "incompatible": ["bases", "oxidizers", "cyanides", "sulfides"],
        "examples": ["HCl", "H2SO4", "HNO3", "acetic acid"]
    },
    "bases": {
        "compatible": ["bases"],
        "incompatible": ["acids", "oxidizers", "halogenated"],
        "examples": ["NaOH", "KOH", "ammonia", "Trizma"]
    },
    "flammables": {
        "compatible": ["flammables"],
        "incompatible": ["oxidizers", "acids"],
        "examples": ["ethanol", "methanol", "acetone", "hexane"]
    },
    "oxidizers": {
        "compatible": ["oxidizers"],
        "incompatible": ["flammables", "acids", "bases", "reducing"],
        "examples": ["H2O2", "KMnO4", "sodium hypochlorite", "nitric acid"]
    },
    "toxics": {
        "compatible": ["toxics"],
        "incompatible": ["acids", "oxidizers"],
        "examples": ["cyanide salts", "arsenic compounds", "mercury"]
    },
    "general": {
        "compatible": ["general", "salts", "buffers"],
        "incompatible": [],
        "examples": ["NaCl", "PBS", "sucrose", "glycerol"]
    }
}

def classify_chemical(self, name):
    """Classify chemical into storage group."""
    name_lower = name.lower()

    for group, data in self.COMPATIBILITY_GROUPS.items():
        for example in data["examples"]:
            if example.lower() in name_lower:
                return group

    # Check keywords
    acid_keywords = ["acid", "hcl", "sulfuric", "nitric", "acetic"]
    base_keywords = ["hydroxide", "naoh", "koh", "ammonia", "amine"]
    flammable_keywords = ["ethanol", "methanol", "acetone", "ether", "hexane"]
    oxidizer_keywords = ["peroxide", "permanganate", "
...[truncated 4085 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the single-value classifier with a model that returns every applicable hazard class, such as {"acids", "oxidizers"}.
  2. Evaluate compatibility across all hazard-class combinations. Any incompatible combination should make the overall result incompatible.
  3. Remove the assumption that equal broad groups are automatically compatible. Require explicit chemical-specific or reviewed compatibility data.
  4. Return an unknown or review_required status for unrecognized chemicals instead of silently assigning them to general.
  5. Require manual SDS or EHS verification for unknown names, mixtures, proprietary products, ambiguous matches, and multi-hazard chemicals.
  6. Use normalized identifiers such as CAS numbers or a curated chemical database instead of unrestricted substring matching.
  7. Add explicit precedence and multi-hazard rules for oxidizing acids and other overlapping categories.
  8. Distinguish definitive compatibility results from advisory results and display a prominent warning that automated classification is not a substitute for SDS review.
  9. Add regression tests covering:
    • Nitric acid as both an acid and an oxidizer.
    • Chemicals with multiple hazard classes.
    • Two chemicals in the same broad group that are not automatically compatible.
    • Unsupported hazardous names.
    • Ambiguous substrings and mixtures.
    • Empty and malformed input.
  10. Prevent storage-plan generation from placing unknown or review_required substances into ordinary storage groups until a qualified reviewer approves them.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
70% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md
demo_inventory = [
    "HCl (concentrated)",
    "NaOH pellets",
    "Ethanol",
    "Hydrogen peroxide",
    "Sodium cyanide",
    "PBS",
    "Acetone"
]

groups = sorter.sort_chemicals(demo_inventory)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill produces laboratory chemical storage recommendations in a safety-critical domain using simple substring heuristics and compatibility groupings, but it does not explicitly warn users that the output is only an aid and must not be relied on as the sole basis for storage decisions. Misclassification or over-trust could cause incompatible chemicals to be co-stored, creating risks of fire, toxic gas release, or violent reaction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill’s Security Checklist and Risk Assessment claim there is no file system access, but earlier examples explicitly open and read inventory files and describe generating output files. This mismatch can mislead operators, reviewers, or policy engines into granting broader trust than warranted and may cause unintended local data exposure when users run file-based workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description and security section understate operational side effects by omitting that example workflows may read inventory files and create output files. In an agent setting, incomplete disclosure reduces informed consent and can lead users to expose local inventory data or allow writes they would otherwise deny.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The document uses Chinese labels 上游 and 下游 alongside English in an otherwise English-language skill description, without offering a language choice or explaining a locale-specific requirement. This can conflict with a language/locale policy that requires user opt-in before forcing or introducing a different language context.

Content

No source excerpt is available for this finding.