ClawHub
Back to skill

Security audit

storm-ready

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed household emergency-preparedness planner with local profile storage and no evidence of hidden, deceptive, destructive, or exfiltrating behavior.

Before installing, understand that this stores household preparedness details locally in ~/.storm-ready.json unless you use --file, and it should supplement official weather alerts, evacuation orders, and emergency services rather than replace them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Harmful Content Injection

Critical
Category
Prompt Injection
Content
---
name: storm-ready
description: "Use when a hurricane/typhoon, ice storm, tornado outbreak, atmospheric river, wildfire season, or blizzard is approaching your area, when building a household emergency kit, when deciding how much water and food to store, when sizing a generator or power station for outages, when an advisory or watch is issued and you don't know what to do in what order, or annually to audit family preparedness — profiles your region's real hazards (gulf-coast hurricanes demand 14-day supplies, tornado country demands shelter kits, wildfire WUI demands go-bags), sizes water/food/power for YOUR people and pets with real math, runs a gap audit against your inventory, and prints phase-by-phase countdown checklists from T-72h through the storm to recovery, with the life-safety rules (CO, flood water, downed lines) that kill people every year."
version: 1.0.0
author: Denis Voronin
license: MIT
tags: [emergency, preparedness, hurricane, storm, outage, generator, water-storage, family-safety]
---
Confidence
95% confidence
Finding
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation advertises shell execution and persistent profile storage in the user's home directory, but the manifest declares no explicit tool scope such as allowed-tools or permissions. That mismatch weakens least-privilege boundaries and can cause an agent runtime to grant broader-than-expected file or shell access when using this skill.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print("cli round-trip:")
with tempfile.TemporaryDirectory() as td:
    pf = os.path.join(td, "profile.json")
    r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
                        "profile", "--file", pf, "--region", "ice-storm",
                        "--people", "3", "--pets", "dog:45"],
                       capture_output=True, text=True)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
saved = json.load(f)
    check("pets parsed", saved["pets"][0]["kind"] == "dog"
          and saved["pets"][0]["weight_lb"] == 45)
    r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
                        "profile", "--file", pf, "--mark-have", "radio",
                        "first-aid"], capture_output=True, text=True)
    check("mark-have works", r.returncode == 0 and "2 marked have" in r.stdout)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"profile", "--file", pf, "--mark-have", "radio",
                        "first-aid"], capture_output=True, text=True)
    check("mark-have works", r.returncode == 0 and "2 marked have" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
                        "audit", "--file", pf], capture_output=True, text=True)
    check("audit shows ✓ for marked items", "✓" in r.stdout)
    check("audit flags P0 gaps", "P0 prep gaps" in r.stdout)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"audit", "--file", pf], capture_output=True, text=True)
    check("audit shows ✓ for marked items", "✓" in r.stdout)
    check("audit flags P0 gaps", "P0 prep gaps" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
                        "timeline", "--region", "wildfire-wui"],
                       capture_output=True, text=True)
    check("timeline renders phases", "T-72 h" in r.stdout and "after the storm" in r.stdout)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"timeline", "--region", "wildfire-wui"],
                       capture_output=True, text=True)
    check("timeline renders phases", "T-72 h" in r.stdout and "after the storm" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
                        "power", "--list"], capture_output=True, text=True)
    check("power --list shows loads", "oxygen-conc" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
                        "power", "--list"], capture_output=True, text=True)
    check("power --list shows loads", "oxygen-conc" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "storm_ready.py"),
                        "example"], capture_output=True, text=True)
    check("example runs end-to-end", r.returncode == 0
          and "Preparedness audit" in r.stdout)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/test_storm_ready.py:16