ClawHub
Back to skill

Security audit

splitsym

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple local comment/symbol extraction tool with disclosed file-reading behavior and no evidence of hidden network access, persistence, credential handling, or destructive actions.

Install from a trusted source, prefer a pinned or verified package version, and run it only on files you intend to inspect. Be cautious with custom symbols.json configs because they define the regex patterns used to extract and print file content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
README.md:58
Finding

Unpinned Package Installation May Resolve Unreviewed Code

Content
View full analysis

Vulnerability Details

File Location: README.md:58
Vulnerability Type: Unpinned third-party package installation
Risk Level: Low

Complete Code Snippet:

bash
# Installation
uv pip install splitsym

Technical Analysis

The documented installation command retrieves splitsym from the package registry configured for uv without specifying an exact version or verifying an integrity hash. The project does not include a lockfile or package metadata that cryptographically binds this registry artifact to the code reviewed in this audit.

Consequently, the command may install code that differs from the audited repository. This creates a supply-chain risk if the registry package, its publisher account, the configured package index, or the resolution process is compromised. The finding concerns the documented installation path; no malicious dependency or malicious code was identified in the audited project itself.

Attack Path

  1. An attacker gains control of the package publisher account, compromises the configured package registry, or otherwise influences package resolution.
  2. The attacker publishes a malicious version under the resolved splitsym package name.
  3. A user follows the README and runs uv pip install splitsym.
  4. Because no version or hash is pinned, uv resolves and installs the attacker-controlled release.
  5. Malicious package installation hooks, imported modules, or executable entry points run with the privileges of the installing or invoking user.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user who installs or runs the resolved package. Depending on those privileges, the malicious package could access user-readable files, modify the user's environment, steal credentials available to that account, or establish persistence. The scope is limited by the installing user's permissions and environment isolation.

Remediation
View remediation

Remediation Suggestions

  • Pin the installation command to a specific, audited release, for example:
    bash
    uv pip install splitsym==1.0.0
  • Publish and document cryptographic hashes for release artifacts, and install with hash verification where supported.
  • Provide a lockfile or a hash-pinned requirements file and require integrity validation during installation.
  • Document package provenance and ensure the registry release is built reproducibly from the corresponding reviewed source tag.
  • Consider documenting a repository-bound installation method using an immutable commit or signed release artifact.
  • Protect the publisher account with multi-factor authentication and trusted publishing.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill is presented as a comment/docstring extractor, but the documented '--config' option allows behavior to be driven by an external symbols.json file, enabling generic pattern extraction from arbitrary file contents. That mismatch is dangerous because users or agents may trust it with sensitive source files under the assumption that it only parses comments, while it can be repurposed to extract secrets, tokens, or other structured data from any readable file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation is entirely in Chinese, including the title, descriptions, and usage guidance, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill advertises file-reading behavior but does not declare any explicit tool scope or permissions, which weakens policy enforcement and makes it harder for a host agent to constrain what files may be accessed. In a security-sensitive agent environment, undeclared file access increases the risk of overbroad reads, accidental data exposure, or misuse by downstream orchestration.

Content

No source excerpt is available for this finding.