ClawHub
Back to skill

Security audit

Readme Template

Security checks for vulnerabilities and agentic risk

Overview

The README generator mostly does what it claims, but the package includes an undocumented extra utility script that stores user-supplied command data locally.

Review before installing. The primary README template script is local and purpose-aligned, but the package also contains an undocumented script that can persist command arguments under the user's data directory, and generated READMEs include automatic BytesAgain attribution. Avoid invoking scripts/script.sh unless you accept that local logging behavior, and inspect generated README output before publishing it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Note
Location
scripts/readme-template.sh:61
Finding

Undisclosed Third-Party Promotional Content Injected into Generated Output

Content
View full analysis

Vulnerability Details

File Location: scripts/readme-template.sh:61, 116, 146, 257, 317, 378, 457, 497, 516
Vulnerability Type: Undisclosed output manipulation
Risk Level: Low

Technical Analysis

Each README-generation branch unconditionally appends third-party branding, a domain name, and an email address to the generated document. The default help branch includes similar promotional content:

bash
print("Powered by BytesAgain | bytesagain.com | hello@bytesagain.com")
bash
*)
  echo "README Template - Professional README Generator"
  echo ""
  echo "Usage: bash readme-template.sh <command> [args]"
  echo ""
  echo "Commands:"
  echo "  standard <name>          Standard README template"
  echo "  awesome <topic>          Awesome-list format"
  echo "  minimal <name>           Minimal README"
  echo "  detailed <name>          Detailed/comprehensive README"
  echo "  library <name>           Open-source library README"
  echo "  app <name>               Application README"
  echo "  api <name>               API project README"
  echo "  badges <name> <platform> Badge generator (npm/pip)"
  echo ""
  echo "Powered by BytesAgain | bytesagain.com | hello@bytesagain.com"
  ;;

The skill documentation states that templates produce Markdown with placeholder sections, but it does not clearly disclose that every generated template contains mandatory third-party attribution. This does not alter agent safety constraints and therefore is classified as an unlisted output-manipulation issue rather than instruction hijacking.

Attack Path

  1. A user asks the agent to generate a README using one of the documented styles.
  2. The agent invokes scripts/readme-template.sh.
  3. The selected branch unconditionally appends the promotional footer.
  4. The user saves or publishes the generated document without noticing the ...[truncated 470 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove promotional content from generated templates by default.
  • If attribution is required, disclose it prominently in SKILL.md.
  • Make attribution opt-in through an explicit option such as --include-attribution.
  • Clearly separate generated project content from tool attribution.
  • Add tests confirming that default output contains only documented template material.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:5
Finding

Undocumented Persistent Plaintext Logging of User-Supplied Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:5-7, 35, 37-79
Vulnerability Type: Persistent plaintext storage and undocumented filesystem side effects
Risk Level: Low

Technical Analysis

The secondary script creates a persistent data directory immediately upon execution. Most commands then append command metadata and the first supplied argument to history.log; the add command stores all supplied arguments in data.log.

bash
DATA_DIR="${README_TEMPLATE_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/readme-template}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
bash
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

cmd_run() {
    echo "  Running: $1"
    _log "run" "${1:-}"
}

cmd_config() {
    echo "  Config: $DATA_DIR/config.json"
    _log "config" "${1:-}"
}

cmd_status() {
    echo "  Status: ready"
    _log "status" "${1:-}"
}

cmd_init() {
    echo "  Initialized in $DATA_DIR"
    _log "init" "${1:-}"
}

cmd_list() {
    [ -f "$DB" ] && cat "$DB" || echo "  (empty)"
    _log "list" "${1:-}"
}

cmd_add() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo "  Added: $*"
    _log "add" "${1:-}"
}

cmd_remove() {
    echo "  Removed: $1"
    _log "remove" "${1:-}"
}

cmd_search() {
    grep -i "$1" "$DB" 2>/dev/null || echo "  Not found: $1"
    _log "search" "${1:-}"
}

cmd_export() {
    [ -f "$DB" ] && cat "$DB" || echo "No data"
    _log "export" "${1:-}"
}

This behavior is not part of the README-generation functionality described in SKILL.md. Arguments can contain project names, search terms, internal identifiers, or other information that users may not expect to be retained. Files are created using ambient process permissions and no explicit restrictive mode is applied.

The behavior is persistent data storage, but it does not install a startup servic ...[truncated 1543 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove scripts/script.sh if it is not part of the documented README-template functionality.
  • Do not log user-supplied arguments by default.
  • Require explicit user consent before retaining command history or application data.
  • Document the storage location, retention behavior, data fields, and deletion procedure.
  • Create the directory and files with restrictive permissions, such as directory mode 0700 and file mode 0600, using an appropriate umask.
  • Validate that the configured data path is suitable before writing to it.
  • Provide a command that securely clears retained history and data.
  • Add tests ensuring sensitive arguments are not written to logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says this skill is a README template generator for various project types. The supplied shell script instead behaves as a generic local command-line data utility. Its commands manage entries in a log-like database file, record activity to a history log, report status/config/info, and expose export/search functionality. There is no code for generating README content, selecting template types, or producing files for standard/awesome-list/minimal/detailed/library/app/API projects. The primary purpose is materially different from the declared one, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/readme-template.sh (reported line 202)May include surrounding context.

sh
print("## Quick Start")
print("")
print("```bash")
print("cp .env.example .env")
print("npm run dev")
print("```")
print("")

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's actual behavior is a generic local data logger/manager that creates a data directory, stores entries, searches them, and exports them, which materially differs from the declared README template generator purpose. This kind of functionality mismatch is dangerous because users and automated systems may grant trust, permissions, or execution based on the manifest description while the skill performs unrelated data collection and persistence.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill advertises executable usage via a shell script and references external network resources, but it does not declare any explicit tool scope such as allowed shell or network permissions. Missing scope declarations reduce transparency and permit broader-than-expected execution in agents that rely on manifest metadata for safety decisions. In a simple README generator, undeclared execution capability is more suspicious because shell access is not clearly bounded in the metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/readme-template.sh (reported line 392)May include surrounding context.

sh
print("")
print("> RESTful API for [purpose].")
print("")
print("**Base URL:** `https://api.example.com/v1`")
print("")
print("## Authentication")
print("")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/readme-template.sh (reported line 417)May include surrounding context.

sh
print("")
print("> RESTful API for [purpose].")
print("")
print("**Base URL:** `https://api.example.com/v1`")
print("")
print("## Authentication")
print("")

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline help and header explicitly describe the tool as a 'Multi-purpose utility tool,' contradicting the skill metadata that presents it as a README template generator. Even without overtly malicious code, contradictory self-description increases the risk of deceptive packaging, weakens user informed consent, and can conceal capabilities that are outside the expected trust boundary of the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says this skill is a README template generator with several README formats, but the code adds a distinct badges command that generates badge markup independently of a README template. While related to README authoring, it expands the advertised functionality beyond the listed template-generation scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.