ClawHub
Back to skill

Security audit

Proof Card Forge

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a simple local proof-card generator, but its bundled script can create misleading audit badges that contradict the skill's own honesty rules.

Review before installing or using this skill for public trust badges. It is suitable only if you independently verify the audit result and treat generated cards as self-asserted unless the script is hardened to reject do-not-publish audits, invalid schemas, missing authoritative success fields, and conflicting CLI overrides.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/proof_card.py:41
Finding

Audit Results Can Be Overridden to Generate Misleading Proof Cards

Content
View full analysis
= 80 grade = args.grade or audit.get("grade") or ("publish-ready" if ok else "unchecked") status = args.status or ("PASS" if ok else "CHECK") checked_at = args.checked_at or audit.get("checkedAt") or datetime.now(timezone.utc).isoformat() ``` ### Technical Analysis Security-sensitive trust fields are not consistently derived from validated audit results: 1. `--score` takes precedence over the score in the audit. 2. `--grade` and `--status` can replace audit-derived values without consistency checks. 3. If the audit omits `ok`, a score of 80 or higher automatically becomes a successful result. 4. No code detects or rejects a `do-not-publish` result. 5. The audit JSON is checked only to confirm that its top-level value is an object; its schema and trust semantics are not validated. Consequently, the generated SVG, Markdown, and JSON can claim `PASS` or `publish-ready` even when the underlying audit does not support that claim. This is particularly relevant because the output is intended to act as a public trust signal. ### Attack Path 1. An attacker or careless publisher obtains or constructs an audit JSON that represents a failed, incomplete, or `do-not-publish` result. 2. The attacker invokes the generator with one or more conflict ...[truncated 1399 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/proof_card.py (reported line 134)May include surrounding context.

python
out = Path(path).resolve()
    out.parent.mkdir(parents=True, exist_ok=True)
    if out.exists() and not force:
        raise SystemExit(f"Refusing to overwrite existing file without --force: {out}")
    out.write_text(text, encoding="utf-8")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill metadata does not declare any explicit tool scope or permission boundaries, yet the skill instructions direct use of local file reads/writes and reference external URLs/provenance sources, indicating meaningful capabilities without policy guardrails. This is dangerous because an agent may invoke the skill with broader-than-necessary access, increasing the chance of unintended file modification, data exposure, or network access outside the user's expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.