ClawHub
Back to skill

Security audit

Skill Security Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent security-scanner skill, but its HTML report path and unescaped report contents create real review-worthy risks when scanning untrusted skills.

Install only if you are comfortable reviewing or fixing the report-generation issues first. Avoid HTML output on untrusted skills, do not scan directories containing sensitive .env or config values unless you can protect the reports, and be aware that the CLI installer adds a symlink under ~/.local/bin.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
source/reporter.py:318
Finding

Stored HTML and JavaScript Injection in Generated Security Reports

Content
View full analysis
{icon} {issue['type'].replace('_', ' ').title()}
{severity}
📁 {issue['file']}:{issue['line']}
{issue['message']}
text
{issue['snippet']}
''' ``` ### Technical Analysis The HTML report generator interpolates finding data directly into HTML without context-appropriate escaping. In particular, `issue['snippet']` contains source text taken from the untrusted project being scanned. The file name and other finding properties are also inserted without escaping. An attacker can place HTML markup in a source line that triggers a scanner finding. For example, a syntactically valid Python line containing an insecure URL can include an HTML payload in its comment: ```python url = "http://example.invalid" # ``` The HTTP rule records this complete line as the finding snippet. When HTML output is generated, the injected `` closes the intended code element and the following `script` element becomes active markup. The report includes executable inline JavaScript and does not define a restrictive Content Security Policy, so the injected script can execute when a user opens the generated report. The same underlying issue ...[truncated 1536 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
source/cli.py:57
Finding

Arbitrary Writable File Clobbering Through a Crafted Report Symlink

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

md
### 危险函数
- `eval()`, `exec()`, `compile()`
- `__import__()` (动态导入)
- `subprocess.Popen(..., shell=True)`
- `os.system()` (外部命令执行)
- `pickle.loads()` (反序列化风险)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
### 危险函数
- `eval()`, `exec()`, `compile()`
- `__import__()` (动态导入)
- `subprocess.Popen(..., shell=True)`
- `os.system()` (外部命令执行)
- `pickle.loads()` (反序列化风险)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

md
### 危险函数
- `eval()`, `exec()`, `compile()`
- `__import__()` (动态导入)
- `subprocess.Popen(..., shell=True)`
- `os.system()` (外部命令执行)
- `pickle.loads()` (反序列化风险)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
### 危险函数
- `eval()`, `exec()`, `compile()`
- `__import__()` (动态导入)
- `subprocess.Popen(..., shell=True)`
- `os.system()` (外部命令执行)
- `pickle.loads()` (反序列化风险)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
./install.sh

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

Including .env files in recursive text-file scanning enables the tool to read credentials and tokens that are commonly stored there. Although the apparent purpose is defensive secret detection, this increases exposure because those credentials are loaded into process memory and could be echoed into findings, snippets, logs, or any caller that receives the generated report.

Content

Scanner excerpt · source/scanner.py (reported line 51)May include surrounding context.

python
self._scan_config_file(cfg_file)

        # Check for hardcoded secrets in any text file
        text_files = [f for f in self.skill_path.rglob("*") if f.is_file() and f.suffix in ['.txt', '.md', '.sh', '.env', '.cfg', '.ini']]
        for txt_file in text_files[:10]:  # Limit to avoid scanning too many files
            self._scan_text_file(txt_file)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test_scanner.py (reported line 70)May include surrounding context.

python
def test_detects_subprocess_shell_true(self):
        """Test subprocess.Popen with shell=True"""
        skill = self.create_skill("test_subprocess", {
            "source/main.py": "subprocess.Popen('ls', shell=True)"
        })
        scanner = SecurityScanner(str(skill))
        results = scanner.scan()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test_scanner.py (reported line 70)May include surrounding context.

python
def test_detects_subprocess_shell_true(self):
        """Test subprocess.Popen with shell=True"""
        skill = self.create_skill("test_subprocess", {
            "source/main.py": "subprocess.Popen('ls', shell=True)"
        })
        scanner = SecurityScanner(str(skill))
        results = scanner.scan()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test_scanner.py (reported line 79)May include surrounding context.

python
def test_detects_os_system(self):
        """Test os.system detection"""
        skill = self.create_skill("test_os_system", {
            "source/main.py": "os.system('rm -rf /')"
        })
        scanner = SecurityScanner(str(skill))
        results = scanner.scan()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/test_scanner.py (reported line 79)May include surrounding context.

python
def test_detects_os_system(self):
        """Test os.system detection"""
        skill = self.create_skill("test_os_system", {
            "source/main.py": "os.system('rm -rf /')"
        })
        scanner = SecurityScanner(str(skill))
        results = scanner.scan()

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_scanner.py (reported line 108)May include surrounding context.

python
def test_detects_path_traversal(self):
        """Test path traversal patterns"""
        skill = self.create_skill("test_traversal", {
            "source/io.py": 'open("../../../etc/passwd")'
        })
        scanner = SecurityScanner(str(skill))
        results = scanner.scan()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The primary skill description is written in Chinese and the rest of the README continues in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises optional VirusTotal scanning of skill files without clearly warning that file contents, hashes, or derived metadata may be sent to a third-party service. For source code and unpublished skills, this can expose proprietary or sensitive material and create an unintended data-sharing/privacy risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 15)May include surrounding context.

sh
exit 1
fi

# Create virtual environment (optional, use system Python if venv not desired)
# python3 -m venv ~/.skill-security-scanner-venv
# source ~/.skill-security-scanner-venv/bin/activate

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script creates a symlink named "skill-secure-checker" at L24-L36, but its usage and test instructions at L43 and L46 tell the user to invoke "skill-security-scanner". This is an active contradiction in the script's inline documentation and output, not merely omitted detail, because following the documented command would not match what was installed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The command-line description and several help strings are written in Chinese, which imposes a specific language on users without any visible opt-in or locale selection. This is a natural-language policy issue because the interface does not offer a choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The HTML report interpolates untrusted scan data such as skill name, timestamps, issue fields, and code snippets directly into HTML and JavaScript-visible content without escaping. If any scanned content contains HTML or script payloads, opening the generated report can trigger stored XSS in the viewer’s browser, potentially executing arbitrary JavaScript, stealing local data available to the page context, or misleading analysts reviewing results.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The generated HTML sets the document language to "zh-CN", which forces a specific locale for all report consumers. There is no visible option for users to choose their preferred language/locale and no indication that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The scanner recursively reads Python, config, and selected text files under the provided skill path, including potentially sensitive files such as .env, .ini, and .cfg, without any consent prompt, allowlist, or user-facing disclosure. In a security-scanning context this behavior is functionally expected, but it still creates a real confidentiality risk because secrets may be ingested and exposed in findings, logs, or downstream report consumers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

All user-facing documentation in this file is presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicit and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README says '零外部依赖 - 纯Python标准库' at L013, which conveys that the skill has no external dependencies. However, later documentation states HTML reporting can rely on the separately installed 'frontend-design' skill (L159, L189-L191), which contradicts that claim rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest presents core user-facing descriptions in Chinese on L04 while other operational details remain in English on L05, but it does not state any language preference, opt-in, or region-specific scope. This can violate a language/locale policy when users are not given a choice and the skill implicitly assumes bilingual comprehension.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code writes a new file, security_report.html, into the user-supplied skill directory, which is a filesystem-modifying operation. While the filename is apparent in code, there is no confirmation prompt or prior user-facing warning attached to the write operation itself; the message is only printed after the file has already been created.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_scanner.py:38

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
source/cli.py:42

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
source/scanner.py:28

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
tests/test_scanner.py:89