ClawHub
Back to skill

Security audit

slim

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed local command-output filter with an optional user-invoked wrapper, and I found no hidden persistence, credential access, exfiltration, or destructive behavior.

Install only if you want a local CLI tool that can filter command output. Prefer pipe mode for pure filtering, and use wrapper mode only with commands you would already be comfortable running yourself because it executes them locally and may hide middle sections of long output.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The skill is described primarily as a pipe filter, but its documented `-- git log -p -8` wrapper mode indicates it can execute arbitrary subprocess commands rather than only transform supplied stdin. That mismatch is dangerous because users or agents may trust it as a passive sanitizer while it actually expands authority to command execution and local filesystem access, increasing the blast radius if invoked in an automated environment.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill is described primarily as a pipe filter, but this file also supports executing arbitrary commands and capturing both stdout and stderr before passing them through the filter. In an agent setting, that materially expands capability from passive transformation to active command execution, which can expose secrets or permit unintended side effects if the agent invokes the wrapper mode.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
Arbitrary subprocess execution is broader than what is justified by an output-slimming skill and creates a mismatch between stated purpose and actual power. In an LLM-agent environment, such capability creep is dangerous because a caller may treat the tool as a harmless filter while it can instead run commands and return sensitive output.

Static analysis

No suspicious patterns detected.