ClawHub
Back to skill

Security audit

ViBo SelfDeed

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local mission-runner with memory, backups, opt-in auto mode, and optional Telegram notifications, with risks users should understand but no artifact-backed malicious behavior.

Install only if you want a local autonomous task runner that stores progress and lessons. Keep missions scoped to a specific folder, review proposed diffs before applying fixes, avoid --auto for production or secret-adjacent work, and enable Telegram only if you are comfortable sending mission summaries or approval prompts to Telegram.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'req' from os.environ.get (line 44, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json"},
    )
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.loads(r.read())
Confidence
95% confidence
Finding
This code transmits mission content to Telegram using credentials sourced from environment variables, so tainted configuration data directly enables outbound exfiltration of potentially sensitive task details. In this skill's context, mission progress, prompts, and reports may contain user data or secrets from autonomous runs, making the external send materially security-relevant even though it is an advertised feature.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The module-level contract says raw secret values are never echoed, logged, or transmitted, but confirm() prints caller-supplied text verbatim in interactive mode and prints an unmasked warning path in auto mode. If upstream code includes secrets in confirmation text or status messages, those values can be exposed to terminal logs, operator consoles, or captured session transcripts, violating the stated secret-handling guarantee.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Auto mode disables per-action confirmation for operations that can change files, restore backups, and create git commits, weakening the stated safety boundary of 'no edits without confirmation.' In an autonomous mission skill that restores context, iterates on fixes, and persists lessons, this increases the chance of unintended or overly broad modifications being applied without timely owner review.

External Transmission

Medium
Category
Data Exfiltration
Content
TOKEN = os.environ.get("TELEGRAM_MISSION_TOKEN") or os.environ.get("TELEGRAM_BOT_TOKEN", "")
CHAT = os.environ.get("TELEGRAM_MISSION_CHAT", "")
API = "https://api.telegram.org/bot"


def _api(method: str, payload: dict) -> dict:
Confidence
88% confidence
Finding
The file is hardcoded to send data to an external Telegram API endpoint, which creates an intentional external transmission channel. In the context of an autonomous mission skill that may process local context and memory, this increases the risk of data leakage to a third party if sensitive content is included in notifications, approval prompts, or reports.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Safety (hard requirements)

1. No file/code edits without confirmation (except explicit `--auto`). Mission scaffolding (backup dir, mission log) at `init` is expected and logged; it never modifies project files.
2. Backup before every change (git commit / `.bak` copy).
3. Secrets (L3): know they exist, **never read, reveal, or copy values** without explicit permission. Handle sensitive values only via masked placeholders (guard_l3 → 🔒[name]); raw values never enter memory, logs, prompts, or reports.
4. Rollback: backup before every change; on any error the agent MUST roll back changed files (`./run_mission.sh rollback <file>`) before continuing or reporting. Rollback is explicit, not automatic.
Confidence
81% confidence
Finding
The skill permits autonomous execution with explicit `--auto`, allowing file/code changes without an additional confirmation step once the mission starts. Even though this is described as opt-in and bounded by backups, rollback, and scope restrictions, it still creates a path for an agent to make consequential modifications based on its own judgment, which can cause unintended code changes, data loss, or unsafe edits if the task or scope is misunderstood.

Static analysis

No suspicious patterns detected.