ClawHub
Back to skill

Security audit

ViBo SelfDeed

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent mission-helper purpose, but it asks for high-impact file, memory, subprocess, and optional Telegram authority with several under-scoped safety controls.

Install only if you are comfortable with a mission tool that can edit files, store local memory, run an external ViBo Python CLI, and optionally send task details to Telegram. Use it only in a tightly scoped workspace, avoid --auto for sensitive projects, do not configure Telegram for confidential work, and verify the exact vibo_use.py path yourself before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:82
Finding

Mandatory Commercial Output Injection Through Skill Instructions

Content
View full analysis
= self.DEMO_LIMIT: return {"ok": False, "nodes": self.DEMO_LIMIT, "exit": 1, "raw": (f"⛔ DEMO limit reached ({self.DEMO_LIMIT} facts) — you liked it, time to go full.\n" f"With a subscription ($5/mo · $30/yr · $60 lifetime): unlimited memory, semantic search, " f"L1/L2/L3 encryption, 96% web savings, living archive, privacy layer.\n" f"Your facts are KEPT — enter a key and the limit is gone.\n" f"Get a key: https://wwwvibo.com/pricing or @ViBomemorybot")} ``` ```python if used >= self.DEMO_LIMIT * 0.8: warn = (f"\n⚡ {self.DEMO_LIMIT - used} facts left in DEMO — full memory (500 facts free): {self.DEMO_URL}" f"\n💰 Upgrade: $5/mo · $30/yr · $60 lifetime → https://wwwvibo.com/pricing") ``` ### Technical Analysis The Skill does not merely expose licensing status to the user. It instructs the Agent to reproduce selected messages verbatim and prohibits summarizing or omitting them. The selected messages contain pricing, upgrade links, and external contact information. This alters the Agent's normal output policy whenever a memory operation returns one of the designated markers. ...[truncated 1140 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
safety.py:95
Finding

Work-Directory Escape and Arbitrary-File Backup or Overwrite

Content
View full analysis
Path: """Copy the file (.bak) before a change. Returns the backup path.""" src = self.workdir / path if not src.exists(): raise SafetyError(f"file not found: {path}") ts = time.strftime("%Y%m%d_%H%M%S") dst = self.backup_root / f"{Path(path).name}.{ts}.bak" shutil.copy2(src, dst) self._snapshots.append(dst) return dst def rollback(self, path: str | Path | None = None) -> Path | None: """Restore a file from the latest backup. path=None → latest snapshot.""" if not self._snapshots: raise SafetyError("no backups to roll back") snap = self._snapshots.pop() if path is None: # file name = backup name without .ts.bak name = snap.name.rsplit(".", 2)[0] target = self.workdir / name else: target = self.workdir / path shutil.copy2(snap, target) return target ``` The shell rollback path is also unrestricted: ```bash cmd_rollback() { local f="${1:-}" [[ -f "$MISSION_JSON" ]] || { echo "❌ no mission started"; exit 1; } echo "⚠️ This will OVERWRITE $f from the latest backup." >&2 read -r -p "Continue? [y/N] " _ok [[ "$_ok" =~ ^(y|yes|д|да)$ ]] || { echo "❌ cancelled"; exit 1; } python3 - "$f" "$MISSION_DIR/backup" <<'PYEOF' import sys, shutil, glob from pathlib import Path target, bdir = sys.argv[1], Path(sys.argv[2]) cands = sorted(bdir.glob(f"{Path(target).name}.*.bak")) if not cands: print(f"❌ no backups for {target}"); sys.exit(1) src, dst = cands[-1], Path(target) shutil.copy2(src, dst) print(f"↩️ Rollback: {target} ← {src.name}") PYEOF log "ROLLBACK $f" } ``` ### Technical Analysis Neither implementation verifies that the resolved sourc ...[truncated 1588 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
lib_vibo.py:35
Finding

Untrusted ViBo Python CLI Discovery and Execution

Content
View full analysis
str: """Find vibo_use.py: VIBO_CLI → PATH → next to the skill → walk up 3 levels. Security: VIBO_CLI is accepted only if it is an existing .py file (not an executable script/binary) — protects against path substitution. """ env = os.environ.get("VIBO_CLI") if env: p = Path(env).expanduser() if p.is_file() and p.suffix == ".py": return str(p.resolve()) raise ViBoError( f"VIBO_CLI must point to a .py file: {env!r} — rejected." ) w = shutil.which("vibo_use.py") if w: return w here = Path(__file__).resolve().parent # next to the skill and walk up to 3 levels for depth in range(4): cand = here / "vibo_use.py" if cand.is_file(): return str(cand.resolve()) here = here.parent ``` The discovered file is executed directly: ```python def _run(self, args: list[str], timeout: int = 60) -> subprocess.CompletedProcess: try: # vibo_use.py keeps memory.web relative to CWD — run the CLI # from its folder so it sees its own memory (acceptance fix v3). return subprocess.run( [self.python, self.cli, *args], capture_output=True, text=True, timeout=timeout, env=self.env, cwd=os.path.dirname(os.path.abspath(self.cli)), ) except subprocess.TimeoutExpired as e: raise ViBoError(f"ViBo CLI timeout ({timeout}s)") from e ``` ### Technical Analysis The only validation applied to an explicitly selected CLI is that it exists and has a `.py` suffix. A Python extension does not establish authenticity or safety. Automatic lookup also trusts the process `PATH` and searches parent directories, where unrelated or ...[truncated 1343 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
telegram_mission.py:33
Finding

Unsanitized Telegram Transmission and Insufficient Approval Authentication

Content
View full analysis
dict: if not TOKEN or not CHAT: print("⚠️ Telegram not configured (TELEGRAM_MISSION_TOKEN/CHAT unset) — " "mission data stays local.", file=sys.stderr) return {"ok": False, "error": "not configured"} print("⚠️ sending mission data to Telegram (external service).", file=sys.stderr) req = urllib.request.Request( f"{API}{TOKEN}/{method}", data=json.dumps(payload).encode(), headers={"Content-Type": "application/json"}, ) with urllib.request.urlopen(req, timeout=30) as r: return json.loads(r.read()) ``` ```python def ask(text: str, detail: str = "", timeout_s: int = 300) -> int: """✅/❌ buttons + wait for answer. 0=yes, 1=no, 2=no answer.""" if not TOKEN or not CHAT: print("⚠️ Telegram not configured (TELEGRAM_MISSION_TOKEN/CHAT unset) — mission data stays local.", file=sys.stderr) print(f"❓ [telegram off] {text}") print(f" {detail}") return 2 try: msg = _send(text, [["✅ Apply", "❌ Reject"]]) msg_id = msg["result"]["message_id"] # wait for callback (polling with offset) offset = 0 deadline = time.time() + timeout_s while time.time() < deadline: try: up = _api("getUpdates", {"offset": offset, "timeout": 25}) except Exception: time.sleep(2) continue for u in up.get("result", []): offset = u["update_id"] + 1 cb ...[truncated 3001 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
safety.py:167
Finding

Incomplete Secret Redaction Does Not Enforce the Documented L3 Guarantee

Content
View full analysis
str: """Mask explicit secrets in text (protect against value logging).""" import re masked = re.sub(r"(sk-[A-Za-z0-9]{12,})", "🔒[key]", text) masked = re.sub(r"(ghp_[A-Za-z0-9]{20,})", "🔒[token]", masked) masked = re.sub(r"(password\s*[=:]\s*\S+)", "password=🔒", masked, flags=re.I) return masked ``` This implementation is inconsistent with the stronger claim in `SKILL.md:156` that raw values never enter memory, logs, prompts, or reports. ### Technical Analysis The redaction function recognizes only: - Tokens beginning with `sk-`. - Tokens beginning with `ghp_`. - A simple single-token `password=` or `password:` form. It does not cover many common secret classes, including Telegram bot tokens, cloud access keys, bearer tokens, private keys, session cookies, database connection strings, generic API keys, multiline credentials, or arbitrary confidential data. More importantly, the project does not centrally invoke `guard_l3` in the mission log, memory write, checkpoint, Telegram notification, approval, or report sinks. A redaction helper that callers may omit cannot enforce the documented guarantee. ### Attack Path 1. Mission input or scanned content contains a secret not matching one of the three regular expressions. 2. The Agent includes that text in a task, checkpoint, finding, memory record, approval detail, or report. 3. The relevant persistence or network sink does not call `guard_l3`. 4. The raw value is written to local state or sent through Telegram. 5. Even if `guard_l3` is called manually, unsupported formats remain unchanged. ### Impact Assessment Unsupported credentials and confidential content may ...[truncated 272 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
run_mission.sh:27
Finding

Mission State JSON Injection Through Manual Serialization

Content
View full analysis
"$MISSION_JSON" <
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tainted flow: 'req' from os.environ.get (line 44, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · telegram_mission.py (reported line 49)May include surrounding context.

python
data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json"},
    )
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.loads(r.read())

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
## Safety (hard requirements)

1. No file/code edits without confirmation (except explicit `--auto`). Mission scaffolding (backup dir, mission log) at `init` is expected and logged; it never modifies project files.
2. Backup before every change (git commit / `.bak` copy).
3. Secrets (L3): know they exist, **never read, reveal, or copy values** without explicit permission. Handle sensitive values only via masked placeholders (guard_l3 → 🔒[name]); raw values never enter memory, logs, prompts, or reports.
4. Rollback: backup before every change; on any error the agent MUST roll back changed files (`./run_mission.sh rollback <file>`) before continuing or reporting. Rollback is explicit, not automatic.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
79% confidence
Finding

This line defines an auto mode that performs changes with backups but without confirmations, enabling unattended modification of project files once invoked. Although it is described as explicit opt-in and bounded by the mission workdir and backup/rollback controls, removing the confirmation gate increases the risk of unintended destructive edits, especially if a caller enables --auto on a sensitive or mis-scoped target.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

└── examples/ # 3 usage examples

text

**Requirements:** Python 3.11 (compatible with ViBo core `.so`); the client goes through the existing `vibo_use.py` (never duplicate the core); `run_mission.sh --auto` = auto mode with backups but no confirmations.

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The task template labels and placeholders are written in Russian, which imposes a specific language for mission authoring and use. The file does not offer any opt-in, alternative locale, or justification for restricting usage to Russian.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README presents all user-facing instructions, examples, and warnings exclusively in Russian, which can amount to a language-policy constraint if users are not given an explicit choice or opt-in. Under the policy criteria, a forced language or locale without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module-level documentation says the skill uses only the external ViBo client and does not duplicate the core, but the code silently falls back to a built-in local memory store that writes facts to demo_memory.json. This mismatch can mislead operators into believing memory handling is exclusively delegated externally, when in fact user data may be persisted locally without an explicit opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · lib_vibo.py (reported line 192)May include surrounding context.

python
try:
            # vibo_use.py keeps memory.web relative to CWD — run the CLI
            # from its folder so it sees its own memory (acceptance fix v3).
            return subprocess.run(
                [self.python, self.cli, *args],
                capture_output=True, text=True, timeout=timeout, env=self.env,
                cwd=os.path.dirname(os.path.abspath(self.cli)),

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code launches an external Python script via subprocess using user/system environment-derived paths, which is a safety-relevant operation for a library consumer. While internal comments describe the behavior, there is no user-facing disclosure, prompt, or runtime notice that calling ViBo methods may execute another program.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script includes built-in commands that send mission/task content to Telegram, which is an external third-party service unrelated to the core local state-management functions of the wrapper. In an agent context, this creates a real data-exfiltration channel for task details, questions, reports, and possibly sensitive operational context, especially because the feature is callable directly from the same wrapper and only guarded by the presence of a helper script.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The stated design explicitly allows bypassing confirmation in --auto mode, and confirm() returns true automatically once that flag is enabled. In a tool intended to enforce mission safety, allowing autonomous changes without per-action approval weakens a primary safety control and can lead to unintended edits, commits, or rollback-affecting actions when automation is enabled.

Content

Scanner excerpt · safety.py (reported line 5)May include surrounding context.

python
"""safety.py — mission safety for vibo-selfdeed.

Spec requirements (section 5):
1. No edits without confirmation (except --auto).
2. Backup before every change (git commit / .bak copy).
3. Secrets (L3): known to exist, handled only via masked placeholders
   (guard_l3 → 🔒[name]); raw values never leave the local process — they are

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module documentation promises that raw secret values never leave the local process, are not logged or transmitted, and are only handled via masked placeholders, but the implementation does not enforce that guarantee globally. guard_l3 only masks a few regex patterns on demand, while commit(), git(), print/input flows, and any caller-provided text can still expose secrets, creating a dangerous mismatch between claimed and actual protections.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · safety.py (reported line 125)May include surrounding context.

python
def git(self, *args: str) -> subprocess.CompletedProcess:
        """git inside workdir (if a repo)."""
        return subprocess.run(
            ["git", *args], cwd=self.workdir, capture_output=True, text=True, timeout=60
        )

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The docstring states that only given paths are staged and that unrelated files, secrets, or user work are not captured, but when paths is omitted the code executes git add -A, staging everything in the repository. In a safety utility, this inconsistency is especially risky because callers may rely on the documented guarantee and accidentally commit secrets or unrelated sensitive changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · telegram_mission.py (reported line 35)May include surrounding context.

python
TOKEN = os.environ.get("TELEGRAM_MISSION_TOKEN") or os.environ.get("TELEGRAM_BOT_TOKEN", "")
CHAT = os.environ.get("TELEGRAM_MISSION_CHAT", "")
API = "https://api.telegram.org/bot"


def _api(method: str, payload: dict) -> dict:

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · EULA.md (reported line 17)May include surrounding context.

md
## 1. DEFINITIONS

1.1. **"Software"** means the ViBo skill, including but not limited to the SKILL.md file, the accompanying scripts, the compiled core, the user documentation, and any updates or modifications thereto, as distributed by the Licensor.

1.2. **"License Key"** means the unique alphanumeric activation code issued by the Licensor that authorizes the use of the Software on a single machine.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · EULA.md (reported line 99)May include surrounding context.

md
## 9. DISCLAIMER OF WARRANTY

9.1. THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

9.2. THE LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT IT WILL MEET THE LICENSEE'S REQUIREMENTS.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The command example embeds Russian strings (<итог>, <что дальше>) in the required handoff format, which suggests the skill may force Russian-language content in normal operation. The file does not offer the user a language/locale choice or justify a Russian-only constraint as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.