ClawHub
Back to skill

Security audit

souvenir-sleuth

Security checks for vulnerabilities and agentic risk

Overview

This skill is a travel shopping helper with scoped local data access and no evidence of hidden credential access, persistence, or exfiltration.

Before installing, expect this skill to run a bundled Python script, read its own travel reference files, and possibly use web research for current shop information. Use the --json output option only with a path you are comfortable creating or overwriting, and verify customs rules on official sites because travel import rules change.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/souvenir_sleuth.py (reported line 44)May include surrounding context.

python
}

TRAP_MARKERS = [
    "snow globe", "fridge magnet", "keychain", "key chain", "t-shirt",
    "shot glass", "mug", "miniature", "souvenir spoon", "logo", "statuette",
    "mini tower", "mini building",
]

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_souvenir_sleuth.py (reported line 60)May include surrounding context.

python
}

TRAP_MARKERS = [
    "snow globe", "fridge magnet", "keychain", "key chain", "t-shirt",
    "shot glass", "mug", "miniature", "souvenir spoon", "logo", "statuette",
    "mini tower", "mini building",
]

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_souvenir_sleuth.py (reported line 68)May include surrounding context.

python
}

TRAP_MARKERS = [
    "snow globe", "fridge magnet", "keychain", "key chain", "t-shirt",
    "shot glass", "mug", "miniature", "souvenir spoon", "logo", "statuette",
    "mini tower", "mini building",
]

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill advertises no explicit tool restrictions, yet its instructions invoke a Python script, JSON output, reference file access, and shell commands in the quick-start examples. That mismatch creates an over-privileged or ambiguous execution model where an agent may permit file and shell operations without the user or platform having a clearly declared scope, increasing the chance of unintended command execution or filesystem access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_souvenir_sleuth.py (reported line 16)May include surrounding context.

python
def run(*args):
    return subprocess.run([sys.executable, str(SCRIPT), *args],
                          capture_output=True, text=True)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This code writes a dossier to a user-specified path, which is a file-modifying operation. Although the CLI flag name suggests output, there is no confirmation prompt and no prior disclosure in comments or docstrings near the write path that the command will create or overwrite a file.

Content

No source excerpt is available for this finding.