ClawHub
Back to skill

Security audit

Path-Dispatch

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local workflow graph helper, but its default cache loading can execute code if a crafted .cache file is placed beside the user's workflow file.

Install only if you can manage the cache risk. Use it in directories you control, delete existing .cache files before running on downloaded or shared workflow files, and set PATH_DISPATCH_NO_CACHE=1 for untrusted, CI, or multi-user environments. Prefer a future version that replaces pickle with a non-executable cache format and pins dependencies.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code unpickles data from a cache file derived directly from a user-supplied input path using pickle.load(), which can execute arbitrary code during deserialization. Because the cache is trusted based only on file existence and modification time, an attacker who can place or replace the .cache file can achieve code execution when the script runs. In this graph-dispatch context, pickle is unnecessary for core functionality, so this capability is unrelated and especially risky.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
scipy.sparse
Confidence
98% confidence
Finding
The dependency list is unpinned, so installs may resolve to different versions over time, reducing reproducibility and increasing supply-chain risk. In a security-sensitive or production environment, this can unexpectedly introduce vulnerable or incompatible releases without any code change in the skill itself.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
94% confidence
Finding
Referencing numpy without a version constraint allows installation of versions affected by known advisories, making the environment potentially vulnerable depending on what resolver selects. Although exploitation often depends on how the package is used, permitting any vulnerable NumPy release is a real supply-chain exposure and is made worse by the unpinned dependency.

Static analysis

No suspicious patterns detected.