ClawHub
Back to skill

Security audit

Device Assistant

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent device-tracking skill, but it needs review because a search-query bug can expose the handler environment and it stores or deletes personal device records.

Review before installing. Use it only in a workspace where storing device serial numbers, purchase details, warranty dates, and maintenance notes is acceptable. Avoid putting secrets in the handler environment until the jq search-query bug is fixed, be cautious with generated Google links because they include device details, and confirm carefully before removing records because deletion is immediate.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/handler.sh:572
Finding

jq Expression Injection Through the Device Search Query

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/handler.sh (reported line 240)May include surrounding context.

sh
json_data="${1:-}"
        
        if [[ -z "$json_data" || "$json_data" == "$WORKSPACE" ]]; then
            # Interactive mode - return prompt
            echo '{"status":"ok","action":"prompt","message":"Gerätedaten benötigt","required":["name","manufacturer","model"],"optional":["serialNumber","purchaseDate","purchasePrice","warranty","manualUrl","location","category","nickname"]}'
            exit 0
        fi

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The remove command irreversibly deletes a device entry from persistent storage immediately after matching an identifier, without confirmation, undo support, or soft-delete behavior. In an agentic context, ambiguous identifiers or accidental invocation could cause silent loss of warranty, model, and maintenance records.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents shell-capable handler commands and external network use (curl) but does not declare any explicit tool scope or permissions boundary. This creates a least-privilege and transparency problem: a host system may expose shell execution more broadly than users expect, increasing the blast radius if the handler or its inputs are later abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises broad natural-language triggers like device problems, appliance issues, and generic phrases in multiple languages, which can cause accidental invocation during unrelated conversations. Unintended activation matters here because the skill stores persistent device data and may perform web lookups, so a casual mention of an appliance error could trigger data handling or external queries without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The feature list and command descriptions encourage storing serial numbers, purchase information, warranty dates, notes, and maintenance logs, but they do not warn users that this information will be persisted in workspace files. That omission can lead users to disclose sensitive household inventory and ownership data without informed consent, which could aid profiling, fraud, or targeted attacks if the workspace is exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that error lookup may use web search for model and error code data, but it does not warn users that device manufacturer, model, and fault details may be transmitted to external services. In this context, those lookups can leak a user’s device inventory and operational issues to third parties, which is especially sensitive for routers, NAS devices, computers, and other identifiable equipment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script creates a persistent data directory and initializes JSON files in the provided workspace, then later stores device metadata there. This is a file-writing behavior affecting user data, but the file provides no user-facing disclosure beyond internal comments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill builds external Google search URLs containing manufacturer, model, and error code data derived from the user's devices. Even though it does not perform the network request itself, returning third-party search links can leak potentially sensitive device inventory details when followed, and there is no disclosure or safer privacy-preserving alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script hardcodes German terms such as 'Fehler' and 'Lösung' into generated search queries, and many returned messages are also only in German. This imposes a specific language/locale behavior without offering the user a choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The status response exposes command help text exclusively in German, which is a natural-language locale constraint visible to users. The file does not provide opt-in, fallback language behavior, or justification for restricting outputs to German.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Multiple commands write or overwrite persistent JSON files containing device inventory, history, and maintenance data. Although the commands return success messages after the fact, there is no prior warning or confirmation about these state-changing operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.