ClawHub
Back to skill

Security audit

Code Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a local code-scaffolding skill with some quality and privacy caveats, but I found no evidence of exfiltration, destructive behavior, privilege escalation, or hidden agent control.

Install only if you are comfortable with a local template generator. Review generated code before running or deploying it, especially when descriptions or names came from an untrusted source. Avoid passing secrets or confidential project identifiers to the secondary script because it can write local command history, and do not deploy generated Flask debug templates unchanged.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:531
Finding

Undocumented Persistent Plaintext Activity History

Content
View full analysis
> "$DATA_DIR/history.log" } ``` Generator functions pass user-supplied project, class, resource, and model names to `_log`. These values can reveal confidential project identifiers or development activity. The script does not obtain explicit consent, redact sensitive values, impose retention limits, or explicitly establish restrictive permissions. This behavior is not disclosed in `SKILL.md`, which identifies only `scripts/codegen.sh` as the main script. The history file is local and no code was found that transmits it to an external party. ### Attack Path 1. A user invokes `scripts/script.sh` with a confidential project, model, class, or resource name. 2. The corresponding command passes that value to `_log`. 3. `_log` appends the timestamp, command type, and supplied value to `history.log`. 4. The record persists after the command terminates. 5. Another local process or account with sufficient filesystem access can inspect the retained metadata. ### Impact Assessment The issue does not provide privilege escalation, remote code execution, or network exfiltration. Its scope is limited to disclosure of locally retained command metadata to principals that can read the history file. Potentially exposed information includes project names, internal resource names, model names, and other user-supplied identi ...[truncated 141 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/codegen.sh:18
Finding

Generated Source Code Injection Through Unvalidated Descriptions and Names

Content
View full analysis
[framework]}" local fw="${2:-fastapi}" case "$fw" in fastapi|fast) cat << APIEOF from fastapi import FastAPI, HTTPException from pydantic import BaseModel from typing import List, Optional import uuid app = FastAPI(title="${name^} API") cl ...[truncated 1945 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:289
Finding

Generated Flask Application Enables Debug Mode by Default

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A documented-purpose/actual-behavior mismatch is security-relevant because users and reviewers may trust the skill to only generate code, while hidden undeclared behaviors such as local history logging introduce unexpected data handling. Misstated or unimplemented features also undermine transparency and can mask privacy-impacting or policy-bypassing behavior in supporting scripts.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/script.sh (reported line 483)May include surrounding context.

sh
case "$lang" in
        python|py)
            echo "__pycache__/"; echo "*.pyc"; echo ".venv/"; echo "dist/"; echo "*.egg-info/"
            echo ".env"; echo ".pytest_cache/"; echo ".mypy_cache/"
            ;;
        node|js|ts)
            echo "node_modules/"; echo "dist/"; echo ".env"; echo "*.log"; echo "coverage/"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/script.sh (reported line 486)May include surrounding context.

sh
case "$lang" in
        python|py)
            echo "__pycache__/"; echo "*.pyc"; echo ".venv/"; echo "dist/"; echo "*.egg-info/"
            echo ".env"; echo ".pytest_cache/"; echo ".mypy_cache/"
            ;;
        node|js|ts)
            echo "node_modules/"; echo "dist/"; echo ".env"; echo "*.log"; echo "coverage/"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/script.sh (reported line 489)May include surrounding context.

sh
case "$lang" in
        python|py)
            echo "__pycache__/"; echo "*.pyc"; echo ".venv/"; echo "dist/"; echo "*.egg-info/"
            echo ".env"; echo ".pytest_cache/"; echo ".mypy_cache/"
            ;;
        node|js|ts)
            echo "node_modules/"; echo "dist/"; echo ".env"; echo "*.log"; echo "coverage/"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The phrase "Describe what you need, get working code" is a very broad activation-style description without clear boundaries on what kinds of requests should or should not invoke the skill. Because the file does not provide exclusion conditions or negative examples, ordinary conversational requests about coding could unintentionally match this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script persistently logs user-supplied names and arguments to a history file under the user's data directory without notice, consent, retention controls, or sanitization. In this skill context, generated names and model fields may contain proprietary project names, internal API names, dataset labels, or other sensitive development metadata, creating an avoidable privacy and information-disclosure risk on shared systems or in backed-up home directories.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a multi-language code generator that can generate test code, CRUD operations, refactoring suggestions, and language conversion guides. In the command dispatch, test, crud, and snippet are placeholders that only print TODO messages, and there is no implementation for refactoring suggestions or language conversion at all, so the actual behavior does not match the stated skill capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The listed commands are short generic terms like "function", "class", "test", and "convert", which can appear in many ordinary software conversations. Without context constraints or examples distinguishing invocation from normal discussion, the trigger scope is ambiguous for a markdown skill description.

Content

No source excerpt is available for this finding.