ClawHub
Back to skill

Security audit

debug-assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local debugging helper that prints diagnostic explanations and suggestions, with no evidence of hidden execution, persistence, exfiltration, or credential access.

This skill is reasonable to install for local debugging. Be cautious when piping logs or error text from untrusted sources because crafted terminal control characters could make the output misleading in some terminals; review suggested commands before running them manually, especially any involving sudo or permission changes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:336
Finding
Terminal Control-Sequence Injection Through Unsanitized Diagnostic Input<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:336-345`, `scripts/script.sh:372`, and `scripts/script.sh:418` **Vulnerability Type**: Terminal control-sequence injection **Risk Level**: Medium ### Vulnerable Code At `scripts/script.sh:336-345`, attacker-controlled regular-expression captures are inserted into diagnostic suggestions without sanitization: ```python def format_fixes(fixes, match=None): result = [] for i, fix in enumerate(fixes, 1): f = fix if match: for j, g in enumerate(match.groups(), 1): f = f.replace(f"{{match{j}}}", g or "") result.append(f" {i}. {f}") return "\n".join(result) ``` At `scripts/script.sh:372`, an unrecognized input line containing an error-related keyword is printed directly: ```python print(f" Detected keyword: {CYAN}{line.strip()}{RESET}") ``` At `scripts/script.sh:418`, an unknown error code is printed directly: ```python print(f"\n{BOLD}📖 Error Code: {text}{RESET}") ``` ### Technical Analysis The script accepts untrusted error messages and logs through command-line arguments or standard input. These values, and substrings captured from them by regular expressions, are written directly to the terminal without escaping control characters. Terminal emulators interpret characters such as ESC, ANSI Control Sequence Introducer sequences, and Operating System Command sequences as instructions rather than visible text. An attacker who controls a log entry or error message can therefore embed terminal instructions in otherwise legitimate diagnostic data. Depending on the terminal and its configuration, a malicious sequence can: - Change colors or cursor position to conceal or overwrite diagnostic output. - Clear parts of the screen and forge apparently trustworthy messages. - Change the terminal title. - Create misleading hyperlinks. - Attempt clipboard modification through OSC 52 where that feature is enabled. The script's own ...[truncated 1808 chars]
Remediation
<![CDATA[ ## Remediation Suggestions Sanitize every untrusted value before writing it to a terminal, including the original input, individual log lines, and regular-expression capture groups. 1. Introduce a centralized sanitizer that removes or visibly escapes terminal control characters: ```python def sanitize_terminal(value): # Preserve ordinary text while rendering control bytes harmless. return "".join( ch if ch in "\n\t" or ord(ch) >= 0x20 else f"\\x{ord(ch):02x}" for ch in value ) ``` 2. Apply the sanitizer before substituting captured groups: ```python safe_group = sanitize_terminal(g or "") f = f.replace(f"{{match{j}}}", safe_group) ``` 3. Sanitize direct output: ```python print(f" Detected keyword: {CYAN}{sanitize_terminal(line.strip())}{RESET}") print(f"\n{BOLD}📖 Error Code: {sanitize_terminal(text)}{RESET}") ``` 4. Consider replacing ESC (`0x1b`), C0/C1 controls, DEL, carriage returns, and other non-printable characters with explicit escaped representations. A production implementation should account for complete CSI and OSC sequence forms rather than relying only on a narrow regular expression. 5. Enable color output only when `sys.stdout.isatty()` is true, and provide a `--no-color` or safe plain-text mode. 6. Add regression tests using ANSI CSI sequences, OSC title changes, OSC 8 hyperlinks, OSC 52 clipboard sequences, carriage returns, backspaces, and mixed multiline input to verify that attacker-controlled bytes are displayed literally rather than interpreted. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
Fix Suggestions:
  1. Check if the service is running:
       sudo systemctl status postgresql
  2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
2. Verify the port is correct and the service is bound to it:
       ss -tlnp | grep 5432
  3. Check firewall rules:
       sudo ufw status
  4. Confirm connection string in your config/env
```
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
"Check file permissions:\n      ls -la /path/to/file",
            "For system files, use sudo (carefully)",
            "Fix ownership:\n      chown $USER /path/to/file",
            "Fix permissions:\n      chmod 644 /path/to/file",
        ]
    },
    {
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Static analysis

No suspicious patterns detected.