ClawHub
Back to skill

Security audit

fuzzy-match

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow fuzzy string matching guide with no hidden execution behavior, though it mentions an optional unpinned Python package install.

This skill is reasonable to install as documentation for fuzzy matching. If you choose to use rapidfuzz, install it in a project virtual environment and consider pinning the version or using your normal dependency review process.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:58
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-63
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

python
### rapidfuzz (Recommended for Performance)

If `rapidfuzz` is available (pip install rapidfuzz), it is much faster and offers more metrics.

```python
from rapidfuzz import fuzz, process

Technical Analysis

The guide recommends installing rapidfuzz without specifying a reviewed version, cryptographic hashes, a lock file, or an explicitly trusted package index. Consequently, the package version and source resolved by pip may vary over time and between environments.

Python packages can execute code during installation and when imported. If the package distribution, an account authorized to publish it, the configured package index, or the dependency-resolution path is compromised, following this instruction could cause attacker-controlled code to execute. This is a supply-chain risk rather than evidence that rapidfuzz itself is malicious.

Attack Path

  1. An attacker compromises a relevant package release, publishing account, package index, mirror, or dependency-resolution configuration.
  2. A user follows the documented pip install rapidfuzz instruction.
  3. pip resolves and installs the attacker-controlled distribution because no version or hash is enforced.
  4. Malicious code executes during installation or when the documented import is performed.
  5. The payload operates with the permissions of the user or automation process that performed the installation.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the process running pip or importing the package. Depending on that process's permissions, the attacker could access project files and environment variables, alter user-writable files, steal credentials available to the process, or compromise build artifacts. The projec ...[truncated 182 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin rapidfuzz to a specifically reviewed version rather than allowing unrestricted resolution.
  • Provide a lock file or requirements file containing cryptographic hashes, and install with hash verification, such as pip install --require-hashes -r requirements.txt.
  • Require installation from an explicitly approved HTTPS package index and review any configured mirrors.
  • Run dependency installation in an isolated virtual environment with least privilege; never recommend privileged or system-wide installation.
  • Use automated dependency and provenance scanning, and periodically review pinned versions before updating them.
  • Prefer the documented standard-library difflib implementation where its performance is sufficient, avoiding the optional dependency entirely.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.