ClawHub
Back to skill

Security audit

Fluid Network Solver

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local fluid-network solver that reads TOML network files and writes requested reports or templates in a disclosed, purpose-aligned way.

Installers should be aware that this skill can read TOML and markdown template files from paths supplied to it and can overwrite/create files at requested output paths. Prefer running it on project-specific inputs, write outputs to a dedicated directory, and consider pinning dependencies for reproducible installs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill exposes operational guidance for running local scripts that read arbitrary TOML inputs and can write reports, JSON outputs, and generated templates, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens containment and review because an agent may infer broader file access than intended, increasing the risk of unintended reads or writes when handling user-supplied paths.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency is specified with a lower bound only (scipy>=1.11), which allows future, unreviewed releases to be installed. This weakens build reproducibility and can expose the skill to supply-chain risk or accidental adoption of a newly vulnerable or breaking version.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
scipy>=1.11
networkx>=3.2
tomli>=2.0; python_version < "3.11"

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency is unpinned (networkx>=3.2), so installations may resolve to different versions over time. This creates reproducibility and supply-chain risk because a compromised or vulnerable future release could be pulled in without review.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
scipy>=1.11
networkx>=3.2
tomli>=2.0; python_version < "3.11"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code creates directories and writes content to resolved output paths provided by --json-out or --report-out, which can modify the filesystem. While the CLI arguments imply output behavior, there is no confirmation prompt, logging, print statement, or explanatory comment/docstring at the write site to disclose that files and parent directories will be created or overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.