ClawHub
Back to skill

Security audit

casadi-ipopt-nlp

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward CasADi/IPOPT optimization guide with only ordinary dependency-installation risk.

Install the dependencies in a dedicated virtual environment or container, avoid running pip as root, and use trusted APT and Python package indexes. The skill itself is instructional and does not appear to request hidden access or perform unrelated actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Third-Party Dependencies Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-15
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
apt-get update -qq && apt-get install -y -qq libgfortran5
pip install numpy==1.26.4 casadi==3.6.7

Technical Analysis

The installation instructions pin the Python package versions, which improves reproducibility, but they do not verify package hashes or constrain installation to a specifically trusted package index. Version pinning alone does not protect against a compromised repository, substituted artifact, dependency-confusion condition, or malicious package served through a user-controlled pip configuration.

The system package command likewise relies on the configured APT repositories and their trust configuration. Although APT ordinarily validates signed repository metadata, the instructions do not require users to verify repository configuration before installing the package.

Python package installation can process source distributions containing build logic. Installed binary packages also introduce native code that executes when loaded. Consequently, substituting a malicious artifact could result in attacker-controlled code running during installation, build, or subsequent import.

Attack Path

  1. An attacker compromises a configured package repository, manipulates local package-index configuration, or causes the requested artifact to be resolved through an unsafe mirror.
  2. A user follows the documented quick-start instructions.
  3. pip downloads packages without checking them against project-maintained cryptographic hashes.
  4. A substituted source distribution may execute malicious build logic, or a malicious installed package may execute code when imported.
  5. The payload runs with the permissions of the identity performing the installation.

Impact Assessment

Successful exploitation could perm ...[truncated 616 chars]

Remediation
View remediation

Remediation Suggestions

  1. Place Python dependencies in a reviewed requirements or lock file with cryptographic hashes for every permitted artifact.
  2. Install with hash enforcement, for example:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Explicitly document the approved package index and disable unintended fallback indexes where appropriate.
  4. Generate and review hashes separately for every supported platform and Python version.
  5. Perform installation inside a dedicated virtual environment or minimally privileged container rather than a system-wide Python environment.
  6. Avoid running pip as root and separate privileged operating-system package installation from unprivileged Python dependency installation.
  7. Retain APT signature verification and advise users to use only authenticated, reviewed repositories.
  8. Integrate dependency scanning and periodic lock-file review into project maintenance.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep