ClawHub
Back to skill

Security audit

skill-creator-max

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent skill-building workflow, but one validation step can execute a harness path supplied by generated dossier content without an explicit opt-in, sandbox, or path allowlist.

Install only if you are comfortable with this skill running local validation scripts while building skills. Do not use it on untrusted dossiers or repositories unless harness execution is sandboxed or the harness path is manually verified first.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
else:
        cmd = [resolved]
    try:
        proc = subprocess.run(cmd, cwd=target_dir, capture_output=True, timeout=120)
        return True, proc.returncode, "ran"
    except Exception as e:
        return False, None, f"error running harness: {e}"
Confidence
95% confidence
Finding
The validator re-executes a harness path taken from dossier content or the target directory, so analyzing an untrusted report can trigger arbitrary local code execution. Although subprocess.run is invoked without shell=True, that only prevents shell metacharacter injection; it does not mitigate execution of attacker-controlled executables or scripts.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill orchestrates file reads, file writes, and shell-backed validators/harnesses, but the skill metadata shown here does not declare any permissions or capability boundaries. That creates a real security and governance gap: callers and reviewers cannot reliably assess what the skill may access or execute, and an over-privileged runtime could let a user-triggered build workflow read sensitive files, overwrite repository content, or invoke unsafe subprocesses.

Tp4

High
Category
MCP Tool Poisoning
Confidence
87% confidence
Finding
The description frames this as a skill-authoring orchestrator, but the body also authorizes validation scripts, filesystem traversal, file-existence checks, token measurement, diffing, and harness re-execution via subprocesses. That mismatch is dangerous because users or policy layers may treat it as a simple content-generation skill when it actually has operational code-execution and repository-inspection behavior, increasing the chance of unintended execution against sensitive files or attacker-influenced artifacts.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
This script's purpose is presented as structural validation, but it executes an arbitrary harness from the dossier/target directory. That creates a trust-boundary violation: a user opening or validating an untrusted dossier can be induced to run attacker-controlled code on the host.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The docstring states the tool is 'STRUCTURE-ONLY' while it intentionally re-runs a harness. This mismatch can cause operators to treat the tool as safe for untrusted input when it actually performs code execution, increasing the likelihood of accidental compromise.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The file sets a standing rule that every skill ships a README in Simplified Chinese by default. This can override user or project language expectations and may cause outputs or documentation to be generated in an unintended language without explicit opt-in, which is a policy/compliance and usability risk rather than a code-execution issue.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script executes the harness with no prominent runtime warning, confirmation, or opt-in flag. In practice, that means users may invoke a seemingly routine validation command on untrusted artifacts and unknowingly run attacker code.

Static analysis

No suspicious patterns detected.