ClawHub
Back to skill

Security audit

border-buddy

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill runs a local offline rules calculator and does not show hidden data access, persistence, or exfiltration behavior.

Before relying on the answers, treat them as a planning snapshot and verify visa, passport, transit, customs, and health rules with the named official authorities, especially close to travel dates.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill explicitly instructs use of shell commands (python3 scripts/border_buddy.py ...) but does not declare any tool scope such as permissions or allowed-tools. That creates a governance gap where an agent may execute local commands without an explicit least-privilege boundary, increasing the chance of unintended command execution or misuse if surrounding files/scripts are modified or malicious.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_border_buddy.py (reported line 95)May include surrounding context.

python
# ── CLI end-to-end ───────────────────────────────────────────────────────────
print("cli:")
r = subprocess.run([sys.executable, os.path.join(HERE, "border_buddy.py"), "check",
                    "--nationality", "BR", "--destination", "PT", "--transit", "DE",
                    "--stay-days", "42", "--passport-expiry", "2027-03-01",
                    "--entry-date", "2026-09-01"], capture_output=True, text=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_border_buddy.py (reported line 107)May include surrounding context.

python
tf = tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False)
json.dump(visits, tf)
tf.close()
r = subprocess.run([sys.executable, os.path.join(HERE, "border_buddy.py"), "schengen",
                    "--visits", tf.name, "--on", "2026-06-20", "--plan-days", "20"],
                   capture_output=True, text=True)
os.unlink(tf.name)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_border_buddy.py (reported line 115)May include surrounding context.

python
check("schengen cmd reports remaining days", "remaining" in r.stdout)
check("schengen cmd gives safe entry", "safe entry" in r.stdout)

r = subprocess.run([sys.executable, os.path.join(HERE, "border_buddy.py"), "rules",
                    "--destination", "JP"], capture_output=True, text=True)
check("rules cmd dumps JSON", r.returncode == 0 and '"Japan"' in r.stdout)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_border_buddy.py (reported line 119)May include surrounding context.

python
"--destination", "JP"], capture_output=True, text=True)
check("rules cmd dumps JSON", r.returncode == 0 and '"Japan"' in r.stdout)

r = subprocess.run([sys.executable, os.path.join(HERE, "border_buddy.py"), "demo"],
                   capture_output=True, text=True)
check("demo runs clean", r.returncode == 0 and "DEMO 4" in r.stdout)