ClawHub
Back to skill

Security audit

miab-observer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed MIAB ledger observer and optional chat notifier whose file, state, and message-sending behavior fit its stated purpose.

Install this only if you want MIAB callback activity recorded locally and, when configured, summarized to a chat target. Review CLAW_CLOSED_TARGET carefully, use the dry-run command before enabling delivery, and protect the state files because resetting notifier state can cause previously closed bottles to be posted again.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if acct:
        cmd += ["--account", acct]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            print(f"delivery failed (exit {result.returncode}): {result.stderr.strip()}", file=sys.stderr)
            return False
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Low
Confidence
90% confidence
Finding
The manifest describes the skill as able to optionally post closed-bottle summaries to a chat target, but this implementation's operative behavior is limited to reading the ledger, rendering events, and appending them to a local log file. Across the main command flow, there is no code path for any chat delivery or remote post operation.

Description-Behavior Mismatch

Low
Confidence
78% confidence
Finding
The manifest frames the skill as observing the MIAB transaction ledger and rendering callback events, but this file also specifically handles and highlights an 'authority-override' event indicating forced actions that would otherwise be refused. That may be reasonable for ledger observation, but it is a broader security/audit capability than the manifest description explicitly conveys.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code formats `task` and `result` fields from the callback ledger into human-readable messages and later appends them to a persistent log file. While the module docstring mentions that it writes to a log file, it does not clearly warn that potentially sensitive task or result content will be copied into that log, which is a user-data/privacy-relevant behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
### Fixed

- **A corrupt state file no longer replays the entire ledger.** `load_state()` swallowed every
  exception and fell through to the same `{"enabled": false, "last_processed_line": 0}` default
  it uses for a genuine fresh start. A truncated or malformed `queue_state.json` therefore
  rewound the cursor to 0 without a word, and the next `process` wrote every ledger record that
Confidence
90% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Unvalidated Output Injection

High
Category
Output Handling
Content
if acct:
        cmd += ["--account", acct]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            print(f"delivery failed (exit {result.returncode}): {result.stderr.strip()}", file=sys.stderr)
            return False
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Session Persistence

Medium
Category
Rogue Agent
Content
PREREQUISITE: Requires the `miab-broker` skill to be installed and active.
It tails the append-only callback ledger (state/callbacks/ledger.jsonl) managed by miab-broker,
converts raw create / forward / return / resolve / cancel / fail / corrupt events into
human-readable log entries using the agent identity map, advances a once-only cursor, and — when the live
toggle is on — writes the formatted batch to the log file ($CLAW_HOME/logs/interagent-queue.log).
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/notify_closed_dryrun.py:23