ClawHub
Back to skill

Security audit

debug-assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local debugging helper that prints diagnostic explanations and suggestions, with no evidence of hidden execution, persistence, exfiltration, or credential access.

This skill is reasonable to install for local debugging. Be cautious when piping logs or error text from untrusted sources because crafted terminal control characters could make the output misleading in some terminals; review suggested commands before running them manually, especially any involving sudo or permission changes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:336
Finding

Terminal Control-Sequence Injection Through Unsanitized Diagnostic Input

Content
View full analysis
Remediation
View remediation
= 0x20 else f"\\x{ord(ch):02x}" for ch in value ) ``` 2. Apply the sanitizer before substituting captured groups: ```python safe_group = sanitize_terminal(g or "") f = f.replace(f"{{match{j}}}", safe_group) ``` 3. Sanitize direct output: ```python print(f" Detected keyword: {CYAN}{sanitize_terminal(line.strip())}{RESET}") print(f"\n{BOLD}📖 Error Code: {sanitize_terminal(text)}{RESET}") ``` 4. Consider replacing ESC (`0x1b`), C0/C1 controls, DEL, carriage returns, and other non-printable characters with explicit escaped representations. A production implementation should account for complete CSI and OSC sequence forms rather than relying only on a narrow regular expression. 5. Enable color output only when `sys.stdout.isatty()` is true, and provide a `--no-color` or safe plain-text mode. 6. Add regression tests using ANSI CSI sequences, OSC title changes, OSC 8 hyperlinks, OSC 52 clipboard sequences, carriage returns, backspaces, and mixed multiline input to verify that attacker-controlled bytes are displayed literally rather than interpreted. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/script.sh (reported line 209)May include surrounding context.

sh
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/script.sh (reported line 211)May include surrounding context.

sh
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/script.sh (reported line 236)May include surrounding context.

sh
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

  1. Verify the port is correct and the service is bound to it: ss -tlnp | grep 5432
  2. Check firewall rules: sudo ufw status
  3. Confirm connection string in your config/env
text

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/script.sh (reported line 238)May include surrounding context.

sh
"Check file permissions:\n      ls -la /path/to/file",
            "For system files, use sudo (carefully)",
            "Fix ownership:\n      chown $USER /path/to/file",
            "Fix permissions:\n      chmod 644 /path/to/file",
        ]
    },
    {

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.