ClawHub
Back to skill

Security audit

Icp Filing

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it mixes an ICP filing guide with an unrelated persistent local utility that logs user inputs and has a misleading remove command.

Review this skill before installing if you expect a simple ICP filing reference tool. Its ICP helper appears local and non-destructive, but the package also includes a generic utility that stores command inputs under ~/.local/share/icp-filing by default and does not actually remove stored entries when asked. Avoid passing secrets or sensitive business details as arguments, and be aware that normal output may include publisher branding.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
scripts/icp.sh:123
Finding

Unconditional Promotional Output Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/icp.sh, lines 123-126
Vulnerability Type: Unconditional third-party promotional output injection
Risk Level: Low

Vulnerable Code

python
else:
    print("Unknown: {}".format(cmd))
print("")
print("Powered by BytesAgain | bytesagain.com")

Related promotional content also appears in SKILL.md, lines 33-35:

markdown
💬 Feedback & Feature Requests: https://bytesagain.com/feedback
Powered by BytesAgain | bytesagain.com

Technical Analysis

The script unconditionally appends third-party branding to standard output after processing every command. This behavior is unrelated to generating ICP filing information and cannot be disabled by the caller.

When an AI agent invokes the script and incorporates its output into a response, the promotional text can be propagated as though it were part of the requested result. This constitutes unwanted output injection rather than instruction hijacking: the content does not contain instructions that alter agent goals, safety constraints, or tool behavior.

No evidence was found that the destination is contacted automatically. The reviewed code does not download remote content, execute a remote payload, acquire additional privileges, establish persistence, or exfiltrate information.

Attack Path

  1. A user or agent invokes any command implemented by scripts/icp.sh.
  2. The script generates the requested ICP filing content.
  3. Regardless of the selected command, line 126 appends the publisher's promotional text to standard output.
  4. If an agent relays the command output without filtering it, the branding is included in an otherwise unrelated user-facing response.
  5. A user may subsequently visit the promoted domain or the feedback URL documented in SKILL.md; however, the script itself does not open or contact either address.

Impact Assessment

The issue can pollute user-facing ou ...[truncated 386 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional promotional statement from the normal command-output path.
  2. If attribution is required, place it behind an explicit about or version command.
  3. Keep operational output limited to information necessary to fulfill the selected command.
  4. Do not instruct agents to reproduce branding, feedback links, or unrelated external destinations in final responses.
  5. Add output tests asserting that normal commands such as checklist, flow, and province do not contain unrelated promotional content.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script writes user-supplied command arguments into persistent history and data files under the user's home directory without notice or consent controls. If users pass secrets, personal data, search terms, or sensitive operational details as arguments, those values will remain on disk and may later be exposed to other local users, backups, support tooling, or accidental disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The help text advertises a 'remove' command, and the function name/doc intent imply deletion behavior. However, the implementation only echoes 'Removed' and writes to history.log, leaving the data file unchanged, which directly contradicts the command's stated effect.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The description says the skill should be used when you need "icp filing capabilities" and then lists "Triggers on: icp filing," but it does not define boundaries, exclusions, or negative examples for when the skill should not activate. While domain-specific, the invocation guidance remains underspecified for routing decisions in broader assistant contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

This shell script presents its title, help text context, and operational output in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative locale is provided. The file does not indicate that the skill is intentionally limited to a Chinese-speaking or China-specific compliance context in a way that clearly justifies the forced language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.