ClawHub
Back to skill

Security audit

MacPowerTools

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review before installation because it overstates its safety, is packaged as a broken script, and includes intended local history storage plus LAN discovery despite claiming zero persistence.

Install only after the publisher fixes the package into valid Python, either implements or removes the advertised maintenance commands, and clearly documents any persistent files and LAN discovery behavior. There is no artifact-backed evidence of malware-level behavior, but the current package is not transparent enough for normal installation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
power_tools.py:2
Finding

Packaged Python entry point is malformed and contains unimplemented command handlers

Content
View full analysis

Vulnerability Details

File Location: power_tools.py:2, power_tools.py:107-108, and power_tools.py:159-164
Vulnerability Type: Malformed executable artifact and misleading command routing
Risk Level: Medium

Vulnerable Code

text
### 2. Full replacement: power_tools.py (replace the entire file)
```python
#!/usr/bin/env python3
python
# (cleanup, process-monitor, self-learn, backup, report, etc. — all your original logic is here and unchanged)
# ... [full original cleanup / monitor / backup / mseries-tune / security-hardening code from v2.5 remains exactly as-is]
python
else:
    # Original commands run exactly as before
    log(f"Command {args.command} executed safely — MacPowerTools v3.1")
    append_run({"command": args.command})

# (the rest of your original command handlers for cleanup, backup, etc. are preserved below this line)

Technical Analysis

The .py artifact contains Markdown wrapper content, including an opening code fence, rather than exclusively valid Python source. Python will reject the file with a syntax error before any command can execute.

In addition, the source asserts that the original cleanup, backup, process-monitoring, and related implementations are present, but those implementations are represented only by comments. The corresponding CLI commands fall through to a generic branch that logs that the command was executed safely and records it in history. No cleanup, backup, or process-monitoring operation is performed.

This creates a fail-open reporting condition: if a user or downstream packager manually removes the Markdown wrapper to make the script syntactically valid, commands can appear to complete without delivering the advertised security or maintenance effect.

Attack Path

  1. A user installs or obtains the skill and invokes power_tools.py.
  2. Python parses the Markdown content at the start of the file and terminat ...[truncated 1155 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all Markdown headings and code fences from power_tools.py, leaving only valid Python source.
  2. Implement each advertised command handler, including cleanup, backup, and process monitoring, or remove the corresponding parser and capability declaration.
  3. Replace the generic success fallback with explicit routing for every command.
  4. Return a nonzero exit status for unimplemented or failed operations.
  5. Emit success messages only after verifying that the requested operation completed.
  6. For backup operations, verify the destination, copy result, expected files, and error status before reporting success.
  7. Add automated tests that run python -m py_compile power_tools.py and invoke every CLI subcommand.
  8. Add integration tests that validate observable effects rather than checking only log output.
  9. Ensure release packaging tests inspect the final artifact so documentation wrappers and placeholder comments cannot enter the executable file.

T09 · Insecure Skill Coding Practices

Note
Location
power_tools.py:22
Finding

Persistent logs and history contradict the declared zero-persistence behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:21 and power_tools.py:22-26, power_tools.py:29-31, power_tools.py:43-51
Vulnerability Type: Undisclosed persistent local state
Risk Level: Low

Vulnerable Code

SKILL.md declares:

markdown
**100% local & ClawHub-safe.** Runs forever on your Mac Mini with zero internet, zero sudo, zero persistence.

The implementation creates and writes persistent files:

python
LOG_DIR = Path.home() / ".logs" / "macpowertools"
CONFIG_DIR = Path.home() / ".config" / "macpowertools"
LOG_DIR.mkdir(parents=True, exist_ok=True)
CONFIG_DIR.mkdir(parents=True, exist_ok=True)
HISTORY_FILE = CONFIG_DIR / "learning.json"

def log(msg, level="INFO"):
    ts = datetime.now().isoformat()
    with open(LOG_DIR / "main.log", "a") as f:
        f.write(f"[{ts}] {level}: {msg}\n")
    if not getattr(args, "agent", False):
        print(f"[{level}] {msg}")
python
def save_history(data):
    HISTORY_FILE.write_text(json.dumps(data, indent=2, default=str))

def append_run(metrics):
    hist = load_history()
    hist["runs"].append({**metrics, "timestamp": datetime.now().isoformat()})
    if len(hist["runs"]) > 500:
        hist["runs"] = hist["runs"][-500:]
    save_history(hist)

Technical Analysis

Importing or starting the script creates ~/.logs/macpowertools and ~/.config/macpowertools. Execution can append timestamped messages to main.log and save as many as 500 run-history entries in learning.json.

This is persistent user-level data storage and directly conflicts with the documented “zero persistence” claim. It is not system persistence in the backdoor or startup-service sense: the code does not install a launch agent, scheduled task, service, or other automatic execution mechanism. Nevertheless, the retained files survive the process and can disclose command usage and timestamps to other processes operating ...[truncated 1565 chars]

Remediation
View remediation

Remediation Suggestions

  1. Correct SKILL.md to clearly disclose the persistent log and history files, including their paths and retention limits.
  2. If zero persistence is a required property, remove file-backed logging and history or keep state only in memory.
  3. Add a --no-history or privacy mode that prevents directory and file creation.
  4. Create state lazily only when the user explicitly enables logging or history, rather than during module initialization.
  5. Create files with user-only permissions, such as mode 0600, and directories with mode 0700.
  6. Avoid storing sensitive arguments, paths, environment values, or command output in logs.
  7. Provide a documented command that securely removes all generated state.
  8. Define a retention policy for main.log, including rotation or size limits; only the JSON history currently has an entry limit.
  9. Add tests verifying that privacy mode leaves no files behind and that normal mode uses restrictive permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The file makes strong safety claims such as '100% local,' 'zero internet,' and 'zero persistence,' yet the detected behavior includes persistent logging/config storage and local network discovery via mDNS. This mismatch is dangerous because it can mislead operators into granting trust under false assumptions, enabling unintended data retention and network exposure in an environment explicitly marketed as safe and non-persistent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Repeated assertions such as '100% local,' 'no persistence,' and 'safe' are contradicted by persistent file writes and LAN discovery behavior. This kind of deceptive safety framing is dangerous because it conditions users and higher-level agents to lower scrutiny, making hidden or future-expanded capabilities more likely to be executed without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata and comments claim 'no persistence,' but the code creates ~/.logs/macpowertools and ~/.config/macpowertools and writes logs and history there. This is a trust and transparency violation: users and agents may grant the skill permissions or run it under assumptions that are false, and the retained data can expose operational history or sensitive usage patterns.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises executable behavior with effective file read, file write, and shell capabilities but does not declare an explicit tool scope. That creates an authorization and review gap: users and platforms cannot easily assess what the skill is allowed to do, increasing the risk of unexpected filesystem modification or command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims 'no internet' and a purely local optimization purpose, yet it performs mDNS service discovery on the LAN via dns-sd. Even if it does not reach the public internet, network scanning/discovery is still network activity and may reveal nearby hosts or advertise the tool's presence, violating user expectations and increasing attack surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

LAN service discovery is not necessary for a local Mac optimization toolkit and creates capability creep beyond the stated function. In this context, the mismatch makes the feature more suspicious because discovery of peer agents/hosts can support reconnaissance or unintended lateral awareness on a private network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The subprocess-based LAN scan performs service discovery without a prominent user-facing warning that it will interact with the local network. Even limited mDNS discovery can be observable on the LAN and may surprise users in restricted or monitored environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code comment claims 'only safe paths,' yet routing includes a LAN scan and references preserved original command handlers that are not shown. Hidden or omitted logic materially increases risk in security review because reviewers cannot verify what 'cleanup', 'backup', or other preserved handlers actually do, especially when the file already contains misleading safety claims.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

share_for_agents prints marketing text encouraging distribution on "Moltbook" and installation by other agents. This capability is not an obvious implementation detail of cleanup, backups, or local resource forecasting, and appears unjustified by the manifest's functional scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.