ClawHub
Back to skill

Security audit

password-auditor

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for password auditing, but its generated reports can unsafely render vault entry names and should be reviewed before use.

Install only if you are comfortable handling plaintext vault exports locally and protecting generated reports. Avoid opening HTML reports from vault exports you do not fully trust, delete plaintext exports after use, and prefer running the offline mode unless you intentionally want the HIBP prefix check.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/password_auditor.py:591
Finding

Stored HTML Injection in Generated Dashboard

Content
View full analysis
{f['entry']}{sev}" f"{kind}{f['title']} " f"{tagcls}" f"{f['action']}") prows = "".join( f"{p['priority']}#{p['entry']} {p['title']}" f"{p['dimension']}{p['action']}" for p in res["plan"][:15]) return HTML_TEMPLATE.format( date=datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC"), entries=res["total_entries"], score=res["score"], ``` ### Technical Analysis The HTML report generator directly interpolates vault-controlled entry titles into HTML without contextual escaping. Entry titles originate from CSV or JSON vault exports and therefore cannot be assumed to be trusted. A malicious title containing HTML elements or event-handler attributes is preserved in the generated dashboard. When the user opens the report in a browser, that content is parsed as active markup rather than displayed as text. For example, a crafted title could contain an image element with an `onerror` handler. Depending on browser restrictions and the payload used, injected JavaScript could: - Modify or conceal legitimate audit findings. - Display deceptive remediation instructions or phishing content. - Create outbound requests containing report information. - Read other information rendered in the dashboard. - Redirect the user to an attacker-controlled page. The report is described as self-contained and safe to open, which increases the likelihood that users will trust and open it without treating it as attacker-controlled content. ### Attack Path 1. An attacker causes a crafted title to be stored in a password-vault entry, or supplies ...[truncated 1070 chars]
Remediation
View remediation
``` 5. Avoid inline scripts and event handlers so that a strict `script-src 'none'` policy remains viable. 6. Add regression tests using payloads containing: - `

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/password_auditor.py:526
Finding

Terminal Escape-Sequence Injection Through Vault Entry Titles

Content
View full analysis
2}. {tier_tag} #{p['entry']} {p['title'][:34]:<34} " f"→ {p['action'][:52]}") ``` ### Technical Analysis The terminal report writes vault-controlled titles directly to standard output. Truncating a Python string to 34 characters does not remove control characters or ANSI escape sequences. A crafted entry title can contain terminal control sequences such as: - CSI sequences that clear the screen, move the cursor, or change formatting. - Carriage returns and backspaces that overwrite previously printed text. - OSC 8 sequences that create deceptive hyperlinks. - OSC 52 sequences that attempt clipboard manipulation in supporting terminals. - Embedded newlines that inject fabricated report entries or instructions. These sequences are interpreted by the terminal emulator rather than displayed literally. This allows untrusted vault metadata to alter the visible audit output. ### Attack Path 1. An attacker places terminal control characters in a vault entry title or creates a crafted export containing such a title. 2. The affected entry produces a finding included in the remediation plan. 3. The user runs the auditor in an interactive terminal. 4. `render_report()` concatenates the untrusted title into the output without sanitization. 5. The terminal interprets the embedded control sequences. 6. Legitimate findings are hidden, overwritten, or visually replaced with attacker-controlled content. 7. The user or a supervising Agent may act on the forged output. ### Impact Assessment The primary impact is loss of report integrity and user-interface trust. An attacker can visually suppress warnings, forge remediation actions, or present dec ...[truncated 311 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README suggests a natural-language trigger phrase like "how bad are my passwords?" to invoke the skill, which is broad enough to overlap with ordinary conversation. In an agent environment, this can cause unintended activation on unrelated user messages about password hygiene, potentially prompting the agent to request or process sensitive vault exports when the user did not explicitly intend to run this skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises capabilities that involve reading sensitive vault exports, writing reports, invoking shell commands, and optionally making network requests, but it does not declare an explicit tool scope or permission boundary. In a password-auditing context this is especially sensitive because the input data is highly confidential, so undeclared file, shell, or network access increases the chance of over-broad execution, accidental data exposure, or misuse by the runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module claims it is read-only and never writes credentials anywhere, but the program can write JSON and HTML audit reports to disk. Even though plaintext passwords are omitted, report contents such as account titles, breach status, reuse indicators, and security posture are sensitive metadata that could expose a user's services, high-value accounts, and remediation priorities if the files are accessed by others.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/risk-model.md (reported line 43)May include surrounding context.

md
for prefix, members in by_prefix.items():
        try:
            req = urllib.request.Request(
                f"https://api.pwnedpasswords.com/range/{prefix}",
                headers={"User-Agent": "password-auditor-skill"})
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                body = resp.read().decode()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/password_auditor.py (reported line 384)May include surrounding context.

python
for prefix, members in by_prefix.items():
        try:
            req = urllib.request.Request(
                f"https://api.pwnedpasswords.com/range/{prefix}",
                headers={"User-Agent": "password-auditor-skill"})
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                body = resp.read().decode()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_password_auditor.py (reported line 15)May include surrounding context.

python
def run(*args):
    return subprocess.run([sys.executable, str(SCRIPT), *args],
                          capture_output=True, text=True)

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest frames the skill as an auditor that avoids storing or transmitting plaintext passwords, which is accurate for passwords themselves, but the code also persists derived audit results to JSON and HTML files on disk. While these reports are password-free, they still store sensitive vault metadata and findings beyond a purely ephemeral audit workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.