ClawHub
Back to skill

Security audit

Undo

Security checks for vulnerabilities and agentic risk

Overview

This undo skill is purpose-aligned but needs Review because it can make automatic host package changes, persist broad project snapshots outside the project, and contains local command-injection and symlink-copying risks.

Review before installing. Use only in projects where persistent local snapshots of source files are acceptable, avoid tracking repositories containing secrets or untrusted symlinks, and do not run initialization in privileged or production environments unless automatic package installation is removed or explicitly gated. Require confirmation before undo operations and prefer a patched version that uses safe Git argument arrays and strict checkpoint-name validation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
lib/git.js:72
Finding

Shell Command Injection Through Unvalidated Checkpoint Names

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
lib/git.js:92
Finding

Project Snapshots Dereference Symbolic Links Outside the Project Boundary

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/init.js:35
Finding

Initialization Automatically Executes System Package Managers Without Explicit Approval

Content
View full analysis
i.name), manual_install: getManualInstallHint(platform) }; for (const installer of installers) { try { execSync(installer.cmd, { encodi ...[truncated 3228 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to auto-install Git via package managers during initialization, which introduces system-level side effects outside the stated core purpose of file undo/history. Automatic package installation can modify the host environment, invoke privileged operations, and create supply-chain risk, especially when triggered in contexts where the user only expected project-local change tracking.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to auto-install Git via package managers during initialization, which introduces system-level side effects outside the stated core purpose of file undo/history. Automatic package installation can modify the host environment, invoke privileged operations, and create supply-chain risk, especially when triggered in contexts where the user only expected project-local change tracking.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to auto-install Git via package managers during initialization, which introduces system-level side effects outside the stated core purpose of file undo/history. Automatic package installation can modify the host environment, invoke privileged operations, and create supply-chain risk, especially when triggered in contexts where the user only expected project-local change tracking.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The --noconfirm parameter is an abuse-prone tool option because it disables the normal confirmation barrier for package installation, enabling unattended changes to the system. Combined with automatic execution by the skill, this turns a dependency check into an unreviewed host-modification action.

Content

Scanner excerpt · scripts/init.js (reported line 70)May include surrounding context.

js
// Arch
    if (fs.existsSync('/usr/bin/pacman')) {
      installers.push({
        cmd: 'pacman -S --noconfirm git',
        name: 'pacman'
      });
    }

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

If Git is not found, the script immediately calls tryInstall() and proceeds to execute package-manager commands without any confirmation, warning, or authorization gate. This creates an unsafe escalation from a simple file-tracking feature into autonomous system modification, which is particularly dangerous for agent-driven workflows where users may not expect dependency installation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.MD (reported line 18)May include surrounding context.

md
## 🌟 Why You Need This

Today's AI agents **write files but can't undo**. One hallucinated edit → broken app → hours of debugging.

With `undo-skill`:
- 🔙 Revert the last 3 changes with `/undo --steps 3`

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation phrases include generic terms like 'undo', 'revert', 'go back', 'restore', and 'show history', which commonly appear in ordinary conversation. Overly broad triggers can cause the skill to activate unexpectedly and run file-reset or history-manipulation workflows when the user may have meant something else, increasing the chance of unintended destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill describes undo/reset operations but does not prominently warn that restoring a previous state will overwrite the current working tree. In a file-editing context, missing this warning is dangerous because an agent may perform a destructive reset based on a casual request, causing data loss or loss of uncommitted user work even if prior states are checkpointed elsewhere.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest describes a file-edit time machine that snapshots and restores file states. While using git internally is reasonable, this helper is a generic shell-backed command executor for arbitrary git argument strings, enabling subprocess execution as a reusable capability beyond the narrow intent described in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The undo flow deletes files from the project directory and overwrites others in place, and the public undo functions invoke this behavior to roll back the working project state. Although comments describe the mechanics, there is no user-facing confirmation prompt, log/print disclosure, or inline warning that these operations will remove or replace local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The undo functions update the repository by force-pushing rewritten history to the main branch, which is a destructive and potentially irreversible operation for repository state. The code contains no user-facing warning, confirmation, or explicit exported-function documentation disclosing that undo rewrites branch history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The watcher functionality continuously snapshots project files, and the API reference states that all snapshot data is stored in an external location under the user's home directory. That means project contents may be copied outside the target workspace without an explicit user-facing warning or consent flow, which can expose sensitive source code, secrets, or regulated data to locations the user does not expect to be populated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script attempts to install Git by directly invoking system package managers during initialization, which causes side effects outside the skill's stated purpose and can modify the host environment without explicit user approval. In an agent context, this is especially risky because merely enabling an undo feature can trigger privileged package-management operations on Linux/macOS hosts or containers.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

Using pacman with --noconfirm suppresses interactive safeguards and makes installation fully autonomous, preventing a user or operator from reviewing what will be changed. In agent environments, this increases the chance of unexpected package changes, repository trust issues, or breakage occurring without visibility or intervention.

Content

Scanner excerpt · scripts/init.js (reported line 70)May include surrounding context.

js
// Arch
    if (fs.existsSync('/usr/bin/pacman')) {
      installers.push({
        cmd: 'pacman -S --noconfirm git',
        name: 'pacman'
      });
    }

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/init.js (reported line 160)May include surrounding context.

js
package_managers_found: d.tried,
        auto_install: 'all_failed',
        manual_install_hint: d.manual_install,
        llm_hint: 'Install git before running this skill. Try: sudo apt-get install git, or brew install git, or pkg install git (Termux). If in a container, ensure the base image includes git.'
      }
    }));
    process.exit(1);

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The markdown explains that the skill automatically snapshots every AI file modification and stores structured history in an external repository, and also runs a background watcher. While the behavior is described, there is no explicit warning that file contents and change summaries will be persistently recorded outside the project directory, which could affect user data/privacy expectations.

Content

No source excerpt is available for this finding.