ClawHub
Back to skill

Security audit

errand-router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local errand-planning helper that runs a bundled Python script and does not show hidden access, persistence, network use, or data exfiltration behavior.

Installers should expect this skill to run local Python for route calculations and to read only the errand data file or stop details they provide. Review the input JSON before running if it contains private location details, but the artifact does not show network sharing or persistent storage of that data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill documentation advertises shell-based execution (python3 scripts/errand_router.py ...) but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, undeclared shell capability can cause the skill to run with broader execution privileges than reviewers or policy expect, increasing the risk of command execution misuse or unintended file/system access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_errand_router.py (reported line 23)May include surrounding context.

python
def run(args):
    r = subprocess.run([sys.executable, SCRIPT] + args,
                       capture_output=True, text=True, timeout=60)
    return r.returncode, r.stdout, r.stderr

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest says to use the skill when someone asks 'what order to run errands in' or how to 'route a day of pickups and deliveries,' which is fairly broad natural language and may match many ordinary planning requests. Although examples are provided, there is no explicit trigger boundary or negative examples in the manifest section itself to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.