Skill Trust Decision
cmd-execution-test
A system diagnostic tool with powerful arbitrary shell execution capabilities that could be exploited for malicious purposes despite legitimate declared use cases.
Most direct threat evidence
01
LLM agent loaded with cmd-executor skill Entry · SKILL.md
02
Attacker injects malicious command via prompt injection targeting --cmd parameter manipulation · cmd-executor.mjs
03
Execute arbitrary command via execSync (whoami /priv, net user, etc.) Escalation · cmd-executor.mjs
Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 5 attack-chain steps and 0 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
LLM agent loaded with cmd-executor skill
Entry · SKILL.md:1
02
Attacker injects malicious command via prompt injection targeting --cmd parameter
manipulation · cmd-executor.mjs:41
03
Execute arbitrary command via execSync (whoami /priv, net user, etc.)
Escalation · cmd-executor.mjs:43
04
Collect sensitive system information for further attacks
reconnaissance · examples/test-commands.json:165
05
Credential access or privilege escalation depending on command executed
Impact · examples/test-commands.json:170
What drove the risk score up
Unrestricted arbitrary command execution +20
--cmd parameter allows any shell command without validation
Sensitive system information exposure +10
systeminfo reveals Windows product keys and detailed hardware info
External network connectivity tests +5
Hardcoded 8.8.8.8 (Google DNS) used for ping/traceroute tests
No credential harvesting detected +-5
No explicit credential theft code found
No data exfiltration detected +-5
No external data transmission beyond stdout
Documentation matches implementation +-10
Behaviors are declared in SKILL.md and skill-card.md
Most important evidence
Medium RCE
Unrestricted Custom Command Execution
The --cmd parameter allows execution of arbitrary shell commands without validation or restrictions. This is a significant attack vector if the LLM agent is subject to prompt injection.
cmd-executor.mjs:41 Remove or restrict the --cmd parameter. If needed, implement a whitelist of allowed commands.
Medium Sensitive Access
Verbose System Information Collection
systeminfo command can expose Windows product keys, hotfixes, network cards, domain membership, and other sensitive configuration details.
cmd-executor.mjs:75 Limit the scope of systeminfo collection or redact sensitive fields from output.
Medium Doc Mismatch
Hidden Malicious Test Scenarios
test-commands.json contains a 'malicious_tests' section with commands like 'whoami /priv' and 'systeminfo | findstr domain admin' that suggest potential use for privilege escalation and Active Directory reconnaissance.
examples/test-commands.json:158 Remove malicious test scenarios from the skill or document them clearly as penetration testing examples.
Low Priv Escalation
Directory Listing with Hidden Files
Commands 'ls -la' and 'dir /a' list hidden files which may include sensitive files like .ssh, .aws, or .env.
cmd-executor.mjs:127 Consider excluding hidden files from default listings or adding warnings about sensitive data.
Low Sensitive Access
External Network Connectivity Tests
Hardcoded 8.8.8.8 (Google DNS) used for ping and traceroute tests. While legitimate for diagnostics, this represents outbound network activity.
cmd-executor.mjs:98 This is benign but could be made configurable or use a local test target instead.
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
cmd-executor.mjs:5 - execSync from child_process Filesystem Pass
Declared READ
→ Inferred READ
cmd-executor.mjs:127-131 - ls/dir commands for directory listing Network Pass
Declared READ
→ Inferred READ
cmd-executor.mjs:91-99 - ping, netstat, traceroute to 8.8.8.8 Environment Pass
Declared NONE
→ Inferred READ
Indirectly exposed via systeminfo and system commands output Suspicious artifacts and egress
High IP Address
8.8.8.8 cmd-executor.mjs:98
Medium External URL
https://clawhub.ai/user/qiqi704 skill-card.md:7
Medium External URL
https://clawhub.ai/qiqi704/cs1111 skill-card.md:27
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| Node.js built-in modules only | N/A | builtin | No | No external dependencies - uses only child_process, os, and fs from Node.js standard library |
File composition
5 files · 689 lines
JavaScript 1 files · 260 linesMarkdown 2 files · 249 linesJSON 2 files · 180 lines
Files of concern · 3
cmd-executor.mjs Unrestricted Custom Command Execution · Verbose System Information Collection · Directory Listing with Hidden Files · External Network Connectivity Tests · 8.8.8.8
examples/test-commands.json Hidden Malicious Test Scenarios
skill-card.md https://clawhub.ai/user/qiqi704 · https://clawhub.ai/qiqi704/cs1111
Other files · SKILL.md · _meta.json
Security positives
Skill-card.md explicitly acknowledges the unrestricted shell execution risk with mitigations
SKILL.md accurately describes all implemented functionality
No base64 encoding, obfuscation, or anti-analysis techniques detected
No data exfiltration to external servers beyond stdout
Uses only Node.js built-in modules (no external dependencies)
All commands are standard diagnostic tools, no custom malicious payloads