ClawHub
Back to skill

Security audit

Aider

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Aider usage guide with disclosed code-editing behavior, but users should be mindful of package installation and sharing code with AI providers.

Install in an isolated environment such as pipx or a virtual environment, consider pinning a known aider-chat version, work on a branch, review diffs before keeping changes, and do not send secrets, private code, or sensitive test output to remote AI providers unless that is acceptable for your project.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:97
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 97-100
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install aider-chat
# Or install it in isolation with pipx
pipx install aider-chat

Technical Analysis

The installation instructions retrieve and install the latest available aider-chat package without pinning a reviewed version or verifying its integrity. Package installation can execute package-controlled build or installation logic. Consequently, the effective code installed by these commands may change after this Skill has been reviewed.

This is a supply-chain weakness rather than evidence that the named package is currently malicious. Exploitation would require compromise of the package's distribution channel, maintainer account, or a future release. Isolation through pipx reduces dependency conflicts but does not establish package authenticity or prevent malicious installation-time behavior.

Attack Path

  1. An attacker compromises the dependency's publishing account or another relevant distribution component.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented unversioned pip or pipx installation command.
  4. The package manager resolves the dependency to the attacker-controlled release.
  5. Package-controlled code executes during installation or when the installed application is launched.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. The affected scope may include local source repositories, files accessible to that user, environment variables, API credentials, Git credentials, and other developer resources. These instructions do not independently grant administrative privileges, so system-wide impact depends on the installer's existing permissions and envi ...[truncated 8 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin aider-chat to a specifically reviewed version instead of implicitly installing the latest release.
  • Prefer an isolated environment such as pipx or a dedicated virtual environment to limit dependency conflicts.
  • Generate and retain a lock file containing exact transitive dependency versions.
  • Require cryptographic hashes for downloaded distributions where the installation workflow supports them.
  • Document the trusted package index and official project source, and avoid untrusted or additional package indexes.
  • Review release provenance, signatures or attestations when available, and update the pinned version only after security validation.
  • Perform installation with a non-privileged user and avoid sudo or administrator-level package installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes Aider's capabilities but does not clearly warn users that it can directly modify repository files and automatically create Git commits. In a developer-tools context, this omission can lead users to invoke the tool without understanding that it performs state-changing actions on local codebases, increasing the chance of unintended code changes or commits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation includes /run and model-backed workflows but does not warn that command output, code context, tests, or other repository data may be transmitted to external AI providers. In this skill's context, users may unintentionally expose sensitive source code, secrets, internal paths, or test output to third-party services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language content throughout the skill file is Chinese, and there is no indication that this language choice is optional or required for a region-specific reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.