T01 · Skill Instruction Hijacking
Error
- Location
scripts/analyze.sh:38- Finding
Untrusted source code can hijack LLM analysis and inject content into the generated report
- Content
View full analysis
"' fi cat <- Remediation
View remediation
Security audit
vibe-check
Security checks for vulnerabilities and agentic risk
Overview
This code-review skill mostly does what it says, but it can automatically send source files to LLM services and directly render untrusted model output in reports.
Review before installing. Use it only on code you are comfortable sending to configured LLM providers, or run it in an environment without ANTHROPIC_API_KEY, OPENAI_API_KEY, or openclaw llm for local heuristic mode. Scope scans narrowly and treat generated findings and fixes as untrusted suggestions that need human review.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.sh:119- Finding
Ambient API credentials trigger automatic disclosure of complete source files to external LLM services
- Content
View full analysis
/dev/null) if [ -z "$result" ] && [ -n "${ANTHROPIC_API_KEY:-}" ]; then result=$(curl -sf --max-time 60 \ -H "x-api-key: ${ANTHROPIC_API_KEY}" \ -H "anthropic-version: 2023-06-01" \ -H "content-type: application/json" \ -d "{\"model\":\"claude-sonnet-4-20250514\",\"max_tokens\":4096,\"messages\":[{\"role\":\"user\",\"content\":${escaped_prompt}}]}" \ https://api.anthropic.com/v1/messages 2>/dev/null | python3 -c " import json, sys resp = json.load(sys.stdin) print(resp['content'][0]['text']) " 2>/dev/null) || result="" fi if [ -z "$result" ] && [ -n "${OPENAI_API_KEY:-}" ]; then result=$(curl -sf --max-time 60 \ -H "Authorization: Bearer ${OPENAI_API_KEY}" \ -H "content-type: application/json" \ -d "{\"model\":\"gpt-4o\",\"messages\":[{\"role\":\"user\",\"content\":${escaped_prompt}}],\"max_tokens\":4096}" \ https://api.openai.com/v1/chat/completions 2>/dev/null | python3 -c " import json, sys resp = json.load(sys.stdin) print(resp['choices'][0]['message']['content']) " 2>/dev/null) || result="" fi ``` Remote analysis is enabled solely by ambient environment state: ```bash HAS_LLM="false" if [ -n "${ANTHROPIC_API_KEY:-}" ] || [ -n "${OPENAI_API_KEY:-}" ] || command -v openclaw &>/dev/null; then HAS_LLM="true" fi ``` The complete file is read and added to the transmitted prompt: ```bash LANGUAGE=$(detec ...[truncated 2937 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill audits code quality/review issues and returns a scored report card. The supplied code instead implements backend application behavior for user management. Its primary purpose is operational request processing, not static analysis or reporting. It also performs undeclared sensitive capabilities: executing user-supplied expressions with eval, reading/writing/deleting records in SQLite, and sending email using hardcoded credentials. These are materially different from the declared purpose and resources, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is a code-auditing skill that analyzes code quality patterns and generates a report card. The supplied code does not inspect code, score anything, detect AI-generated patterns, or produce recommendations. Instead, it implements unrelated application utilities for validation, hashing, retries, and parsing. This is a clear description-behavior mismatch with a materially different primary purpose.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Output File Mode
bash rm -f /tmp/vibe-check-report.md bash scripts/vibe-check.sh --output /tmp/vibe-check-report.md test_samples test -s /tmp/vibe-check-report.md && echo "PASS: report file written"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Output File Mode
bash rm -f /tmp/vibe-check-report.md bash scripts/vibe-check.sh --output /tmp/vibe-check-report.md test_samples test -s /tmp/vibe-check-report.md && echo "PASS: report file written"
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script reads source files and transmits their full contents to third-party LLM providers using API keys from the environment, which creates a real data exfiltration/privacy risk. This is more dangerous in skill context because users would reasonably expect a local code-auditing tool, not silent off-box transmission of potentially proprietary or secret-bearing files.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # Method 1: Anthropic API if [ -z "$result" ] && [ -n "${ANTHROPIC_API_KEY:-}" ]; then result=$(curl -sf --max-time 60 \ -H "x-api-key: ${ANTHROPIC_API_KEY}" \ -H "anthropic-version: 2023-06-01" \ -H "content-type: application/json" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # Method 2: OpenAI API if [ -z "$result" ] && [ -n "${OPENAI_API_KEY:-}" ]; then result=$(curl -sf --max-time 60 \ -H "Authorization: Bearer ${OPENAI_API_KEY}" \ -H "content-type: application/json" \ -d "{\"model\":\"gpt-4o\",\"messages\":[{\"role\":\"user\",\"content\":${escaped_prompt}}],\"max_tokens\":4096}" \
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Arbitrary code evaluation is unrelated to generating a code-audit report and gives the skill execution capability far beyond its stated purpose. In context, this makes the finding more dangerous because the mismatch suggests hidden or unjustified execution behavior rather than an accidental implementation detail.
- Content
eval() call detected
High
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The code evaluates attacker-controlled input with eval(data["query"]), enabling arbitrary Python code execution in the process context. In an API-like handler, this can lead to full compromise of the host, data theft, filesystem access, and lateral movement.
- Content
python API_URL = "http://localhost:8080" def process(data): result = eval(data["query"]) return result def get_user(x):
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Database-backed account lookup, insertion, and deletion are unjustified for a local code-auditing skill and create direct opportunities for unauthorized data access or tampering. In this file, those operations are additionally unsafe because they are driven by untrusted input and include destructive actions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements user-management and outbound email behavior despite the skill being described as a code-auditing tool. This mismatch is dangerous because unjustified capabilities expand attack surface, can conceal unauthorized actions, and suggest the skill may perform hidden side effects unrelated to its declared purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read files, inspect environment state, and execute shell scripts, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where the agent may invoke sensitive capabilities without clear limitation or user-visible consent boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases include broad requests such as 'audit code', 'code quality', 'check my code', and 'code review', which overlap with many normal development conversations. Overbroad activation can cause the skill to run unexpectedly, leading to unnecessary file scanning or shell execution in contexts where the user did not specifically request this skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a read-oriented auditing skill that produces scored reports with fix suggestions. In code, the prompt can instruct the LLM to emit unified diff patches, which is more than reporting or suggesting fixes and expands the behavior into patch generation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This curl call sends user file contents embedded in the prompt to Anthropic's API, constituting external data transmission. External transmission is not inherently malicious, but it is security-relevant here because the transferred payload may include proprietary code or secrets.
- Content
sh # Method 1: Anthropic API if [ -z "$result" ] && [ -n "${ANTHROPIC_API_KEY:-}" ]; then result=$(curl -sf --max-time 60 \ -H "x-api-key: ${ANTHROPIC_API_KEY}" \ -H "anthropic-version: 2023-06-01" \ -H "content-type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Source contents are sent to external services without an in-script warning, confirmation, or granular consent, so users may unknowingly disclose confidential code, credentials, or internal logic. In this skill's context, the lack of notice materially increases risk because code auditing commonly handles sensitive repositories.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The hardcoded Anthropic endpoint confirms that analysis data leaves the local environment for a third-party service. While expected for SaaS-backed LLM tooling, it is dangerous when not prominently disclosed because users may assume analysis remains local.
- Content
sh -H "anthropic-version: 2023-06-01" \ -H "content-type: application/json" \ -d "{\"model\":\"claude-sonnet-4-20250514\",\"max_tokens\":4096,\"messages\":[{\"role\":\"user\",\"content\":${escaped_prompt}}]}" \ https://api.anthropic.com/v1/messages 2>/dev/null | python3 -c " import json, sys resp = json.load(sys.stdin) print(resp['content'][0]['text'])
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This curl call sends prompt data containing full file contents to OpenAI's API, exposing local source material to an external provider. In a code-audit skill, that creates confidentiality risk if files contain internal IP, secrets, or regulated data.
- Content
sh # Method 2: OpenAI API if [ -z "$result" ] && [ -n "${OPENAI_API_KEY:-}" ]; then result=$(curl -sf --max-time 60 \ -H "Authorization: Bearer ${OPENAI_API_KEY}" \ -H "content-type: application/json" \ -d "{\"model\":\"gpt-4o\",\"messages\":[{\"role\":\"user\",\"content\":${escaped_prompt}}],\"max_tokens\":4096}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The hardcoded OpenAI endpoint is another explicit outbound data path for analyzed code. The risk stems from confidentiality loss and compliance issues rather than code execution.
- Content
sh -H "Authorization: Bearer ${OPENAI_API_KEY}" \ -H "content-type: application/json" \ -d "{\"model\":\"gpt-4o\",\"messages\":[{\"role\":\"user\",\"content\":${escaped_prompt}}],\"max_tokens\":4096}" \ https://api.openai.com/v1/chat/completions 2>/dev/null | python3 -c " import json, sys resp = json.load(sys.stdin) print(resp['choices'][0]['message']['content'])
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The module docstring claims this is an API handler for user management, directly contradicting the declared skill purpose as a code-auditing tool. Such contradictions are a strong trust and provenance warning because they indicate repurposed or disguised code that may contain hidden behavior inconsistent with user expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code performs a destructive DELETE operation based on input data with no confirmation, authorization checks, or user-facing warning. This increases the likelihood of accidental or unauthorized record deletion, especially in a tool whose stated purpose gives users no reason to expect account-modifying behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Sending email via SMTP is unrelated to local code auditing and introduces external data exfiltration and credential-abuse risk. Because it performs network communication without clear justification, it could be used to leak analyzed code, findings, or environment data off-host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module sends email over the network without visible user disclosure or consent, which can surprise users and enable silent outbound transmission of sensitive data. In a code-auditing skill, undisclosed network activity is especially risky because analyzed source code and findings may be confidential.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill includes an option to write reports to an output file, but the description does not clearly warn users that local files may be created or overwritten. This can surprise users and may lead to accidental data loss, unintended artifact creation, or writing sensitive analysis results to disk without clear consent.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/analyze.sh:60
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- test_samples/bad_api.py:9