ClawHub
Back to skill

Security audit

conditioning

Security checks for vulnerabilities and agentic risk

Overview

This skill provides straightforward gravitational-wave data conditioning guidance, with only a routine PyCBC dependency note to handle carefully.

Install PyCBC in a virtual environment, avoid running pip as administrator, and pin or review dependency versions if you need reproducible or higher-assurance analysis.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:120
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 120-124
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

markdown
## Dependencies

```bash
pip install pycbc
text

### Technical Analysis

The installation instruction retrieves the latest available `pycbc` package and its transitive dependencies from pip's configured package index. It does not specify a reviewed version, validate package hashes, use a lock file, or require an isolated environment.

Because dependency resolution remains mutable after the Skill has been audited, a compromised package release, compromised transitive dependency, or unsafe package-index configuration could introduce attacker-controlled code. Python packages may execute code during installation, and imported package modules execute under the privileges of the invoking process.

This finding concerns supply-chain integrity. The audited file does not itself contain malicious code, and successful exploitation requires compromise or manipulation of the dependency delivery chain.

### Attack Path

1. A user follows the documented `pip install pycbc` instruction.
2. pip queries the user's configured package index and resolves the current `pycbc` release and transitive dependencies.
3. An attacker compromises a resolved release, a transitive dependency, or the configured package source.
4. pip downloads and installs the attacker-controlled package without enforcing a reviewed version or expected cryptographic hash.
5. Malicious code executes during package installation or when the package is subsequently imported by the documented Python examples.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running pip or the Python process. Depending on those privileges and the environment, the attacker could access or modify files available to that user, read environment variables and credentials
...[truncated 330 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin PyCBC to a specifically reviewed version rather than installing the latest available release.
  2. Store direct and transitive dependencies in a version-controlled requirements or lock file.
  3. Record and enforce cryptographic hashes using pip's --require-hashes option.
  4. Install dependencies in a dedicated virtual environment or disposable container with least-privilege permissions.
  5. Explicitly document the trusted package index and prevent unintended fallback to untrusted indexes.
  6. Review dependency updates before changing pinned versions and use automated vulnerability scanning for the resolved dependency set.
  7. Avoid running pip with administrator or root privileges.

A hardened installation workflow should resemble:

bash
python -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

The associated requirements.txt should pin reviewed versions and include expected hashes for every resolved package.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.