Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because a confirmed finding says environment settings can select a program to run with the agent’s privileges, while some referenced paths were not resolved and the scan is partial.
Treat this as a review-required install. Before installing, check whether untrusted launchers or configuration can influence the DNS_LIST_HCLOUD_BIN or DNS_LIST_HCLOUD_ARGS environment settings, and confirm what permissions the host grants the skill. Skillspector inspected all nine listed components, but marked its analysis partial because several local path-like references did not resolve; the evidence is therefore incomplete. A separate AIG scan completed with no findings, which does not resolve the confirmed TT2 concern.
Without declared permissions the skill's intent is opaque and cannot be validated.
The criteria require Chinese table headers and specific Chinese messages for empty results and permission errors. Line 27 also requires a Chinese file-write error message, but the file provides no user opt-in, language selection, or justification for fixing these outputs to Chinese.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
DNS_LIST_HCLOUD_BIN selects an arbitrary executable and DNS_LIST_HCLOUD_ARGS supplies unchecked arguments outside the operation guard. If a lower-trust launcher or execution configuration can influence the inherited environment, these test hooks permit code execution with the agent's privileges and access to inherited cloud credentials; this is not shell injection and requires that environment-control precondition.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
The manifest describes --output as writing the current table view, and L018–L021 explicitly document that export is additional to the stdout modes. However, both --json and --names-only return successfully at L859 and L866 before export is processed, so these combinations create no Markdown file and provide no warning.