T09 · Insecure Skill Coding Practices
Error
- Location
index.js:6- Finding
Arbitrary Shell Command Injection Through CLI Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Security Scanner
Security checks for vulnerabilities and agentic risk
Overview
This skill is a security scanner, but it has unsafe scanner implementation flaws that could let crafted scan targets run commands, escape extraction limits, or bypass scanning.
Use this only in an isolated environment and avoid scanning untrusted URLs or paths through the Node wrapper. Do not rely on its pass/fail result for high-stakes decisions until command argument handling, archive extraction containment, raw LLM prompt generation, and whitelist trust logic are fixed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scan.sh:268- Finding
Unsafe Extraction of Remotely Supplied ZIP Archives
- Content
View full analysis
/dev/null) if [[ "$http_code" == "200" ]] && [[ -s "$TARGET_DIR/s.zip" ]]; then echo "[INFO] HTTP 下载成功 (${http_code})" unzip -q "$TARGET_DIR/s.zip" -d "$TARGET_DIR" 2>/dev/null && rm -f "$TARGET_DIR/s.zip" ``` ### Technical Analysis The scanner downloads an archive from a remote source and immediately extracts it without first validating the archive entries. There is no explicit rejection of: - Absolute paths. - Paths containing parent-directory traversal components. - Entries whose normalized destination falls outside `TARGET_DIR`. - Symbolic or hard links targeting locations outside the extraction directory. - Special filesystem entries. Although some `unzip` implementations provide partial traversal protection, the code relies entirely on unspecified external-tool behavior. A security scanner processing hostile packages should enforce its own containment policy before extraction. The archive is processed before the contained files are statically scanned, so malicious extraction behavior occurs outside the scanner's detection phase. ### Attack Path 1. An attacker publishes or causes the scanner to retrieve a crafted ZIP archive. 2. The archive contains an entry with an unsafe destination or link target. 3. The scanner downloads the archive into its temporary directory. 4. `unzip` processes the hostile metadata before any source-code inspection occurs. 5. If the installed extractor accepts the crafted entry, data is written outside `TARGET_DIR`. 6. A targeted configuration, script, startup file, or executable may be overwritten. ### Impact Assessment The exact impact depends on the behavior of the installed `unzip` ...[truncated 560 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/scan.sh:609- Finding
Name-Based Whitelist Allows Complete Scanner Bypass
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
scripts/scan.sh:528- Finding
Attacker-Controlled Source Is Embedded Verbatim Into an LLM Prompt
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scan.sh:633- Finding
Whitespace-Sensitive File Enumeration Allows Static Scan Evasion
- Content
View full analysis
/dev/null) if [[ -z "$SCAN_FILES" ]]; then echo "[WARN] 未找到任何可扫描的文件 (.js/.ts/.py/.sh)" echo "[WARN] Skill 可能只包含文档或非脚本文件" fi for f in $SCAN_FILES; do scan_file "$f" done ``` ### Technical Analysis The output of `find` is captured in a shell variable and later expanded without quotes in `for f in $SCAN_FILES`. Shell word splitting divides the output on spaces, tabs, and newlines. As a result, a supported source file whose path contains whitespace is not passed to `scan_file` as one path. It is split into multiple invalid path fragments. Because `scan_file` silently returns when a fragment is not a regular file, the real source file can be omitted without a visible scanning error. Newline-delimited `find` output is also fundamentally unable to represent every valid Unix filename safely. ### Attack Path 1. An attacker creates a malicious supported source file with a name such as `payload hidden.js`. 2. The file is included in the newline output produced by `find`. 3. Unquoted expansion splits the path into separate words. 4. `scan_file` receives nonexistent path fragments rather than the original filename. 5. The function returns without reading the malicious file. 6. The final report understates both the file count and the detected risks. ### Impact Assessment This flaw allows malicious code to evade all regex-based detection by using specially formed filenames. It can produce an inaccurate high score and mislead users into trusting a package whose executable source was never inspected. The bypass affects local scans and extracted remote packages. It does not itself execute code or provide additional operating-system privileges, but it weakens the sc ...[truncated 35 chars]- Remediation
View remediation
/dev/null ) ``` Additional hardening should include: 1. Preserve paths as quoted values throughout processing. 2. Test filenames containing spaces, tabs, newlines, wildcard characters, and leading dashes. 3. Report unreadable or skipped files rather than silently ignoring them. 4. Track the number of files discovered separately from the number successfully scanned. 5. Treat any supported file that cannot be read as an incomplete scan and lower confidence in the final verdict. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (47)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/scan.sh https://clawhub.ai/owner/skill-name
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | 命令 | 风险描述 | 检测文件 | |------|----------|----------| | `rm -rf /` | 根目录删除，毁灭性操作 | .sh, .bash | | `rm -rf ~` | 用户主目录删除，丢失所有数据 | .sh, .bash | | `rm -rf $HOME` | 同上，使用环境变量 | .sh, .bash | | `curl \| bash` | 远程脚本执行，完全不可控 | .sh, .bash |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | 命令 | 风险描述 | 检测文件 | |------|----------|----------| | `rm -rf /` | 根目录删除，毁灭性操作 | .sh, .bash | | `rm -rf ~` | 用户主目录删除，丢失所有数据 | .sh, .bash | | `rm -rf $HOME` | 同上，使用环境变量 | .sh, .bash | | `curl \| bash` | 远程脚本执行，完全不可控 | .sh, .bash |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | 命令 | 风险描述 | 检测文件 | |------|----------|----------| | `rm -rf /` | 根目录删除，毁灭性操作 | .sh, .bash | | `rm -rf ~` | 用户主目录删除，丢失所有数据 | .sh, .bash | | `rm -rf $HOME` | 同上，使用环境变量 | .sh, .bash | | `curl \| bash` | 远程脚本执行，完全不可控 | .sh, .bash | | `wget -O- \| sh` | 远程脚本执行，完全不可控 | .sh, .bash |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md | `rm -rf /` | 根目录删除，毁灭性操作 | .sh, .bash | | `rm -rf ~` | 用户主目录删除，丢失所有数据 | .sh, .bash | | `rm -rf $HOME` | 同上，使用环境变量 | .sh, .bash | | `curl \| bash` | 远程脚本执行，完全不可控 | .sh, .bash | | `wget -O- \| sh` | 远程脚本执行，完全不可控 | .sh, .bash | | `curl https://... \| sh` | 同上 | .sh, .bash | | `wget https://... \| bash` | 同上 | .sh, .bash |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md | `rm -rf ~` | 用户主目录删除，丢失所有数据 | .sh, .bash | | `rm -rf $HOME` | 同上，使用环境变量 | .sh, .bash | | `curl \| bash` | 远程脚本执行，完全不可控 | .sh, .bash | | `wget -O- \| sh` | 远程脚本执行，完全不可控 | .sh, .bash | | `curl https://... \| sh` | 同上 | .sh, .bash | | `wget https://... \| bash` | 同上 | .sh, .bash | | `passwd` | 修改用户密码 | .sh, .py, .js |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md | `rm -rf $HOME` | 同上，使用环境变量 | .sh, .bash | | `curl \| bash` | 远程脚本执行，完全不可控 | .sh, .bash | | `wget -O- \| sh` | 远程脚本执行，完全不可控 | .sh, .bash | | `curl https://... \| sh` | 同上 | .sh, .bash | | `wget https://... \| bash` | 同上 | .sh, .bash | | `passwd` | 修改用户密码 | .sh, .py, .js |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md | `curl \| bash` | 远程脚本执行，完全不可控 | .sh, .bash | | `wget -O- \| sh` | 远程脚本执行，完全不可控 | .sh, .bash | | `curl https://... \| sh` | 同上 | .sh, .bash | | `wget https://... \| bash` | 同上 | .sh, .bash | | `passwd` | 修改用户密码 | .sh, .py, .js | ## 🟠 高风险 (扣 20 分)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | 命令/模式 | 风险描述 | 检测文件 | |-----------|----------|----------| | `chmod 777` | 权限过于宽松 | .sh, .bash | | `eval $var` | 动态代码执行 | .sh, .bash | | `eval "$(...)"` | 同上 | .sh, .bash | | `elevated: true` | 要求 root 权限 | .yaml, .yml, SKILL.md |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `curl -X POST` | 同上 | .sh, .bash | | `.env` | 环境变量文件 | 所有 | | `~/.ssh/` | SSH 密钥目录 | 所有 | | `/etc/passwd` | 系统用户文件 | .sh, .bash | | `$VAR` / `${VAR}` | 环境变量读取 | .sh, .bash | | `curl` / `wget` | 网络请求 | .sh, .bash | | `fetch` / `axios` | HTTP 请求 | .js, .mjs |
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md | I04 | `new Function\(` | critical | Function 构造器 | | I05 | `ignore.*previous.*instructions` | high | 提示注入 | | I06 | `jailbreak\|bypass.*safety` | critical | 越狱攻击 | | I07 | `DAN\|do anything now` | critical | DAN 越狱模式 | | I08 | `curl.*http` | high | 远程下载执行 | ### OBFUSCATION（混淆隐藏）
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md | 规则 ID | 规则 | 风险 | 说明 | |---------|------|------|------| | S01 | `curl/wget \| bash` | critical | 远程脚本执行 | | S02 | `curl.*\.sh$`, `wget.*-O-` | critical | 下载执行远程脚本 | | S03 | `eval $()` | critical | 动态命令执行 | | S04 | `exec <cmd>` | critical | 命令替换执行 |
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
sh echo "$c" | grep -qE "eval\(" && add_issue "INJECTION" "dynamic-exec" "critical" 25 "$f" "eval" echo "$c" | grep -qE "new Function\(|Function\(" && add_issue "INJECTION" "dynamic-exec" "critical" 25 "$f" "Function" echo "$c" | grep -qE "ignore previous|ignore prior" && add_issue "INJECTION" "prompt-injection" "high" 20 "$f" "ignore" echo "$c" | grep -qE "jailbreak|bypass safety" && add_issue "INJECTION" "jailbreak" "critical" 25 "$f" "jailbreak" # 反引号命令注入 echo "$c" | grep -qE "\`[^\`]*\`" && add_issue "INJECTION" "backtick-injection" "critical" 25 "$f" "backtick"
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
sh echo "$c" | grep -qE "eval\(" && add_issue "INJECTION" "dynamic-exec" "critical" 25 "$f" "eval" echo "$c" | grep -qE "new Function\(|Function\(" && add_issue "INJECTION" "dynamic-exec" "critical" 25 "$f" "Function" echo "$c" | grep -qE "ignore previous|ignore prior" && add_issue "INJECTION" "prompt-injection" "high" 20 "$f" "ignore" echo "$c" | grep -qE "jailbreak|bypass safety" && add_issue "INJECTION" "jailbreak" "critical" 25 "$f" "jailbreak" # 反引号命令注入 echo "$c" | grep -qE "\`[^\`]*\`" && add_issue "INJECTION" "backtick-injection" "critical" 25 "$f" "backtick"
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
sh l" 25 "$f" "npx" echo "$c" | grep -qE "eval\(" && add_issue "INJECTION" "dynamic-exec" "critical" 25 "$f" "eval" echo "$c" | grep -qE "new Function\(|Function\(" && add_issue "INJECTION" "dynamic-exec" "critical" 25 "$f" "Function" echo "$c" | grep -qE "ignore previous|ignore prior" && add_issue "INJECTION" "prompt-injection" "high" 20 "$f" "ignore" echo "$c" | grep -qE "jailbreak|bypass safety" && add_issue "INJECTION" "jailbreak" "critical" 25 "$f" "jailbreak" # 反引号命令注入 echo "$c" | grep -qE "\`[^\`]*\`" && add_issue "INJECTION" "backtick-injection" "critical" 25 "$f" "backtick" # 加密操作（可能用于恶意行为） echo "$c" | grep -qE "crypto.*createCipher|crypto.*createDecipher" && add_issue "INJECTION" "crypto-operation" "medium" 15 "$f" "crypto" } check_obfuscation() { local c=$1 f=$2 echo "$c" | grep -qE "Buffer\.from|atob\(|btoa\(" && add_issue "OBFUSCATION" "base64" "high" 20 "$f" "Base64" echo "$c" |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh http_code=$(curl -sL -o "$TARGET_DIR/s.zip" -w "%{http_code}" "$zip_url" 2>/dev/null) if [[ "$http_code" == "200" ]] && [[ -s "$TARGET_DIR/s.zip" ]]; then echo "[INFO] HTTP 下载成功 (${http_code})" unzip -q "$TARGET_DIR/s.zip" -d "$TARGET_DIR" 2>/dev/null && rm -f "$TARGET_DIR/s.zip" # 处理嵌套目录 (clawhub 打包会多一层目录) local first_dir first_dir=$(ls -d "$TARGET_DIR"/*/ 2>/dev/null | head -1)
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- index.js:8