Security audit

ClawPlanOps

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate project-planning skill, but it needs Review because an exposed notification helper builds shell commands from user-controlled text while the skill also performs local project scans and calendar actions.

Review the skill before installing. Use it only with project directories you intend it to inspect, confirm calendar imports and any cron setup manually, and avoid letting untrusted task text or project content become notification titles/messages until the shell-escaping issue is fixed.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill description is broad enough to match common project-management and reporting requests, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance that users are funneled into tool-driven workflows involving filesystem, Git, calendar, or cron-capable operations without a clear explicit request for this specific skill.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Trigger phrases like '检查进度' or '今天该做什么' are vague and can occur in ordinary conversation unrelated to this skill's privileged project-inspection behavior. This creates an activation-confusion risk where the assistant may solicit project paths or invoke progress-checking tools on local repositories when the user only wanted lightweight advice.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The daily-review flow includes broad phrases and explicitly supports cron-triggered execution, which raises the risk of unattended or accidental activation. In this context, an over-broad trigger is more dangerous because it can lead to recurring automated inspections and reporting on project directories without sufficiently specific user intent each time.

Vague Triggers

Low

Confidence: 76% confidence
Finding: Phrases such as '准备提交' and '检查一下能不能交了' are somewhat ambiguous and may overlap with normal conversation, but the subsequent flow still expects a project path and plan file. The risk is real but limited because exploitation would usually still require additional user interaction or accessible local context.

Vague Triggers

Low

Confidence: 74% confidence
Finding: Broad triggers for multi-project management can match casual mentions of having multiple projects, causing the assistant to shift into a status-discovery workflow prematurely. The impact is lower than other cases, but it still risks unnecessary project enumeration or confusion about whether local project metadata should be accessed.

Vague Triggers

Low

Confidence: 80% confidence
Finding: A generic trigger like '导入日历' can apply to many benign conversational contexts, yet this skill maps it to a cross-platform calendar import tool. Because calendar import may touch system integrations or create files, an ambiguous trigger increases the chance of unintended side effects from a loosely matched request.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill content is entirely written to steer interaction in Chinese without indicating that language should follow user preference, which can override or conflict with the user's chosen language. This is primarily a safety and usability issue: forced language can impair informed consent, tool confirmation clarity, and the user's ability to notice sensitive actions like cron setup, repo scanning, or calendar import.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/delivery-check.js:12
Evidence: return execFileSync(command, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/calendar/crossPlatformCalendar.ts:107
Evidence: execFileSync('cmd', ['/c', 'start', '', icsPath], { stdio: 'ignore', timeout: 10000 });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/evidence/gitEvidence.ts:214
Evidence: return execSync(`git ${args.join(' ')}`, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/evidence/gitTaskLink.ts:25
Evidence: const output = execSync(

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/notification/pushNotification.ts:38
Evidence: execSync(

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/report/weeklyReport.ts:131
Evidence: const output = execSync(