ClawHub
Back to skill

Security audit

Bash Themes

Security checks for vulnerabilities and agentic risk

Overview

This package is not overtly destructive, but it is packaged as an Oh My Bash configuration skill while the bundled scripts are placeholders or an unrelated developer workflow tool that writes local history logs.

Review this package before installing. It does not currently provide the advertised Oh My Bash configuration framework, and one bundled script is an unrelated developer workflow CLI that creates a local data directory and logs command usage. Install only if you are comfortable with that mismatch and local state creation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a functional Bash configuration framework with features like configuration management, themes, and auto-update. The supplied code does not implement those capabilities. It only parses a command argument and responds with static help, info, status, or a TODO message for run. This is a material description-to-behavior mismatch because the primary promised functionality is absent from the code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description says this skill is for managing Bash configuration and themes, with auto-update behavior implied. The code does not manage shell configuration files, themes, plugins, or updates. Instead, it exposes project-oriented commands such as init, check, build, test, deploy, template, docs, and clean, which are characteristic of a developer workflow tool. It also creates a data directory and writes usage history logs there. This is a materially different primary purpose from the declared description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill metadata claims to provide an Oh My Bash/bash configuration framework, but the script actually exposes an unrelated developer workflow tool branded as 'bash-themes'. This kind of capability/identity mismatch is dangerous because it misleads users and reviewers about what is being installed or executed, undermines trust boundaries, and can conceal unexpected behavior even if this specific script is not overtly destructive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill advertises auto-update behavior affecting Bash configuration/themes without warning users that local shell files or configuration may be changed. In a shell-management context, undisclosed modification of dotfiles or local state can create persistence, break environments, or introduce unreviewed code into startup scripts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The command triggers help, run, info, and status are overly generic and likely to collide with normal user intent or other tools. In an agent environment, broad triggers can cause accidental invocation of this skill in unrelated contexts, leading to unintended command execution paths or confusing tool selection.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The usage text explicitly states 'Run any command,' which signals unrestricted command forwarding through bash-themes <command> [args] without visible validation or limitation. In an agent setting, this can become an arbitrary command execution surface, enabling destructive filesystem actions, data exfiltration, persistence, or execution of untrusted binaries if the skill is invoked with attacker-influenced arguments.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
## Usage

Run any command: `bash-themes <command> [args]`
---
💬 Feedback & Feature Requests: https://bytesagain.com/feedback
Powered by BytesAgain | bytesagain.com

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline comments and help text present the program as 'bash-themes' and a 'Developer workflow automation tool', directly contradicting the stated Oh My Bash purpose. In skill ecosystems, contradictory self-description increases the risk of deceptive packaging, user confusion, and accidental execution of tooling outside the expected scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.