ClawHub
Back to skill

Security audit

Tracebit Canaries

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent security-canary setup, but it asks an agent to install and run mutable remote software and includes several under-scoped credential and memory-handling paths that merit review before use.

Install only if you are comfortable with a security tool that deploys decoy credentials, adds heartbeat monitoring, reads alert emails, sends user-channel notifications, and runs a Tracebit background daemon. Review the installer source and prefer a pinned release before running it; avoid the documented fixed /tmp password file pattern; do not let the checker print raw canary cache contents; and treat the AWS credential cleanup script as manual-review code rather than something to run blindly.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install-tracebit.sh:23
Finding

Mutable Remote Installer Is Downloaded and Executed

Content
View full analysis
/dev/null 2>&1; then RELEASE_JSON=$(curl -fsSL "$GITHUB_API" 2>/dev/null) || RELEASE_JSON="" elif command -v wget >/dev/null 2>&1; then RELEASE_JSON=$(wget -qO- "$GITHUB_API" 2>/dev/null) || RELEASE_JSON="" fi ... TMPDIR_INSTALL=$(mktemp -d) trap 'rm -rf "$TMPDIR_INSTALL"' EXIT FILENAME="${DOWNLOAD_URL##*/}" DEST="$TMPDIR_INSTALL/$FILENAME" info "Downloading $FILENAME..." if command -v curl >/dev/null 2>&1; then curl -fSL --progress-bar "$DOWNLOAD_URL" -o "$DEST" elif command -v wget >/dev/null 2>&1; then wget -q --show-progress "$DOWNLOAD_URL" -O "$DEST" else die "Neither curl nor wget is available. Install one and retry." fi ... if [[ "$ACTUAL_SHA256" == "$EXPECTED_SHA256" ]]; then success "SHA256 checksum verified via ${VERIFY_SOURCE}: $ACTUAL_SHA256" else die "SHA256 MISMATCH! Expected: $EXPECTED_SHA256, Got: $ACTUAL_SHA256 — download may be corrupted or tampered with." fi ... if [[ "$OS" == "linux" ]]; then info "Running Linux installer..." chmod +x "$DEST" bash "$DEST" success "Tracebit CLI installed." ``` ### Technical Analysis The installation script resolves the mutable GitHub `latest` release, downloads an installer, and executes it with the current user's privileges. Although a SHA-256 check is mandatory, the expected digest is obtained from GitHub release metadata or a checksum asset in the same mutable release. This protects against accidental corruption but does not establish an independent trust root. An attacker who compromises the repository, release workflow, maintainer cred ...[truncated 1708 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:78
Finding

Predictable Plaintext Temporary Password File Is Vulnerable to Symlink Attacks

Content
View full analysis
/tmp/tracebit-setup-creds && chmod 600 /tmp/tracebit-setup-creds ``` The same unsafe pattern is repeated at `SKILL.md:206-207`: ```bash echo "" > /tmp/tracebit-setup-creds && chmod 600 /tmp/tracebit-setup-creds ``` ### Technical Analysis The generated account password is written to a fixed, publicly predictable path in a shared temporary directory. Shell redirection opens or creates the path before `chmod 600` executes. This creates two problems: - If the file is newly created under a permissive process umask, there may be a short interval before permissions are restricted. - A local attacker can pre-create `/tmp/tracebit-setup-creds` as a symbolic link. Shell redirection follows the link and writes the generated password to the attacker-selected destination. The password remains in plaintext until the user manually saves and deletes it. The documented workflow does not guarantee automatic cleanup after signup, despite metadata describing the file as temporary and deleted after use. ### Attack Path 1. A local attacker predicts the documented path `/tmp/tracebit-setup-creds`. 2. Before setup begins, the attacker creates that path as a symbolic link to an attacker-readable or security-sensitive file. 3. The Agent executes the password-generation command. 4. Shell redirection follows the symbolic link before `chmod` is applied. 5. The password is written to the redirected destination, or an unintended user-owned file is overwritten. 6. The attacker obtains the Tracebit account password or causes file corruption. 7. Because deletion is manual, the password may also remain recoverable fr ...[truncated 542 chars]
Remediation
View remediation
"$CREDS_FILE" ``` 3. Verify that the resulting object is a regular file and not a symbolic link. 4. Pass the generated unique path through the workflow instead of relying on a fixed filename. 5. Register a cleanup trap and delete the file automatically after signup or on failure. 6. Prefer a platform credential vault, password-manager API, or protected file descriptor over plaintext storage. 7. Avoid the later `echo ""` example because command-line and shell-history handling may expose the value. 8. Explicitly confirm successful deletion in the completion report. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check-canaries.sh:111
Finding

Status Checker Can Print the Entire Canary Credential Cache

Content
View full analysis
/dev/null 2>&1; then warn "python3 not available — showing raw JSON" cat "$CACHE_FILE" exit 0 fi ``` ### Technical Analysis When the Tracebit CLI is unavailable and Python is not present, the checker emits the entire local cache using `cat`. The API reference shows that `canaries.json` can contain complete decoy credential material, including AWS access-key data, AWS secret keys, session tokens, confirmation identifiers, and SSH private keys. This directly conflicts with the Skill's stated red line that canary credential values must never appear in conversation output or logs. A health-check utility needs only type, state, and expiration metadata; raw credential values are unnecessary. Because script output may be captured by an Agent transcript, terminal logger, CI job, support bundle, or messaging workflow, the fallback converts a local protected credential cache into broadly exposed output. ### Attack Path 1. Canary credentials are stored in `~/.config/tracebit/canaries.json`. 2. The Tracebit CLI is unavailable or removed, causing the script to enter its local-cache fallback. 3. Python is absent or an attacker influences `PATH` so that `python3` cannot be found. 4. The script runs `cat "$CACHE_FILE"`. 5. The entire JSON cache is printed to standard output. 6. The output is retained in Agent context, terminal history, CI logs, or other monitoring systems. 7. Anyone with access to those outputs obtains the canary values and deployment metadata. 8. Subsequent use of the leaked canaries ...[truncated 676 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/incident-response-playbook.md:96
Finding

Incident Workflow Requests Broad Access to Sensitive Agent Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/security-compliance.md:212
Finding

Cleanup Script Non-Atomically Rewrites the User's Entire AWS Credentials File

Content
View full analysis
/dev/null || echo "Could not clean AWS credentials — check manually" fi ``` ### Technical Analysis The removal procedure parses and rewrites the complete real AWS credentials file to remove one `[canary]` section. This conflicts with the project's claim that real credentials are not read or modified: all profiles are parsed, held in process memory, and serialized back to disk. The update uses `open(p, 'w')`, which truncates the original file before writing. It does not use a lock, backup, temporary file, atomic rename, `fsync`, or explicit permission preservation. A crash, disk error, concurrent AWS configuration update, or parser incompatibility can corrupt or erase legitimate profiles. Python's `ConfigParser` also normalizes formatting and may remove comments or otherwise alter content unrelated to the canary profile. The broad rewrite exceeds the minimum operation needed to remove a managed entry. ### Attack Path 1. The user follows the documented full-removal procedure. 2. The script loads `~/.aws/credentials`, including every legitimate profile. 3. The script removes the section named `canary`. 4. It opens the original credential file with write truncation. 5. A crash, concurrent modification, storage error, or incompatible file construct occurs before serialization completes correctly. 6. Legitimate profiles are lost, corrupted, reformatted, or overwritten with stale ...[truncated 774 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (41)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description claims a comprehensive security skill covering deployment, trigger detection, email-based monitoring, and supervised incident response. This code chunk only checks existing Tracebit canary status and expiration, using either tracebit show or a local JSON cache. While this is related to Tracebit canaries, it is materially narrower than the declared purpose and omits several key advertised capabilities, especially trigger detection and email integration. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description promises an operational security skill that protects a workspace by deploying honeytokens/canaries, monitoring for trigger events through an authorized email tool, and assisting with incident response and hardening. The actual code chunk does none of that directly. It solely installs the Tracebit CLI from GitHub with checksum verification and then suggests manual next steps such as tracebit auth, tracebit deploy all, and tracebit show. Those next steps indicate the intended future use, but they are not implemented in this code. This is a material description-to-behavior mismatch because the code’s primary purpose is installation/bootstrap, not the declared security monitoring and response functionality.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
ll details — including file traceability, enforcement model, and removal — see `references/security-compliance.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md
ll details — including file traceability, enforcement model, and removal — see `references/security-compliance.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md
ll details — including file traceability, enforcement model, and removal — see `references/security-compliance.md`.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/api-reference.md (reported line 241)May include surrounding context.

md
# Issue credentials (all types in one call)
echo "Issuing canary credentials..."
RESPONSE=$(curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/api-reference.md (reported line 268)May include surrounding context.

md
" 2>/dev/null || true)
  
  if [[ -n "$ID" ]]; then
    STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d "{\"id\": \"$ID\"}" \

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/security-compliance.md (reported line 114)May include surrounding context.

md
- Does **not** execute arbitrary code or dynamically load scripts
- Does **not** read or modify real credentials
- Does **not** inject code into running processes
- Does **not** transmit user data to external endpoints

---

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The removal script directly opens and rewrites ~/.aws/credentials, a highly sensitive credential store. Even though intended only to remove a [canary] profile, touching a real credentials file risks corruption, unintended disclosure through logs/errors, and violates the document's broader claim that the agent will not read or modify real credentials on disk.

Content

Scanner excerpt · references/security-compliance.md (reported line 212)May include surrounding context.

md
# 2. Remove canary credentials from standard locations
# AWS canary profile
if [ -f "$HOME/.aws/credentials" ]; then
  python3 -c "
import configparser, os
p = os.path.expanduser('~/.aws/credentials')

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This inline Python reads and conditionally rewrites ~/.aws/credentials, which is a real credential repository. In a security-oriented skill, modifying that file is sensitive because mistakes can remove or alter non-canary entries, and the documented assurances claim such files are not modified by the skill.

Content

Scanner excerpt · references/security-compliance.md (reported line 215)May include surrounding context.

md
if [ -f "$HOME/.aws/credentials" ]; then
  python3 -c "
import configparser, os
p = os.path.expanduser('~/.aws/credentials')
c = configparser.ConfigParser()
c.read(p)
if 'canary' in c:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-compliance.md (reported line 229)May include surrounding context.

md
fi

# SSH canary key
rm -f "$HOME/.ssh/tracebit-canary" && echo "Removed SSH canary key" || true

# 3. Remove Tracebit config directory
rm -rf "$HOME/.config/tracebit" && echo "Removed Tracebit config directory" || true

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

rm -rf "$HOME/.config/tracebit" recursively deletes a configuration directory. Although aimed at cleanup, recursive deletion is inherently risky in agent-invocable contexts because path assumptions may be wrong, symlinks or unexpected contents may exist, and the command bypasses granular verification.

Content

Scanner excerpt · references/security-compliance.md (reported line 232)May include surrounding context.

md
rm -f "$HOME/.ssh/tracebit-canary" && echo "Removed SSH canary key" || true

# 3. Remove Tracebit config directory
rm -rf "$HOME/.config/tracebit" && echo "Removed Tracebit config directory" || true

# 4. Remove CLI binary
if command -v tracebit >/dev/null 2>&1; then

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-compliance.md (reported line 241)May include surrounding context.

md
fi

# 5. Remove temp credentials file
rm -f /tmp/tracebit-setup-creds && echo "Removed temp credentials file" || true

# 6. Reminder
echo ""

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 110)May include surrounding context.

Fix:

bash
# Remove old token and re-auth
rm -f ~/.config/tracebit/token
tracebit auth

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation text is unusually broad, telling the agent to use this skill for generic situations like suspected compromise, workspace hardening, or protecting against prompt injection and data exfiltration even when the user does not mention canaries. That can cause the skill to trigger in contexts beyond explicit user intent, increasing the chance of unnecessary software installation, credential generation, file writes, email access, and persistence-related changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: tracebit-canaries
description: >
  Use when the user wants to protect their workspace from credential theft, prompt injection, or data exfiltration — even if they don't mention "canaries" or "honeytokens" directly. Covers deploying Tracebit security canary tokens (fake decoy credentials that alert on use), detecting when they're triggered via the user's pre-authorized email tool, and human-supervised incident response. Also use when investigating a suspected compromise, hardening an agent's environment, or setting up tripwires to catch unauthorized access to sensitive files.
metadata: {"openclaw":{"emoji":"🐦","homepage":"https://community.tracebit.com","primaryEnv":"TRACEBIT_API_TOKEN","requires":{"bins":["bash","python3","curl","jq","openclaw"]},"permissions":["email:read (via plugins.email — read-only search for Tracebit alert emails; requires user's pre-authorized email account)","messaging:send (via plugins.messaging — sends notifications to user's own channel only)","fs:write memory/security-incidents.md (append-only incident log during canary alert investigation)","fs:write /tmp/tracebit-setup-creds (temporary signup password with chmod 600; deleted after use)","fs:read memory/* (agent memory files during incident investigation; requires human confirmation before each read)"],"keywords":["canary","honeytokens","security","incident-response","credential-theft","prompt-injection","tripwire"]},"creator":{"org":"Tracebit","source":"https://github.com/tracebit-com/tracebit-community-cli"},"safety":{"posture":"human-gated-deployment","red_lines":["no-autonomous-writes-to-credential-locations","no-credential-exfiltration","no-messages-to-external-recipients","no-remediation-without-human-approval","no-checksum-bypass"],"runtime_constraints":{"all-access-requires-upfront-user-consent":true,"canary-deployment-requires-human-confirmation":true,"canary-rotation-requires-human-acknowledgement":true,"credential-files-written-only-by-cli-not-skill":true,"email-access
...[truncated 25 chars]

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
name: tracebit-canaries
description: >
  Use when the user wants to protect their workspace from credential theft, prompt injection, or data exfiltration — even if they don't mention "canaries" or "honeytokens" directly. Covers deploying Tracebit security canary tokens (fake decoy credentials that alert on use), detecting when they're triggered via the user's pre-authorized email tool, and human-supervised incident response. Also use when investigating a suspected compromise, hardening an agent's environment, or setting up tripwires to catch unauthorized access to sensitive files.
metadata: {"openclaw":{"emoji":"🐦","homepage":"https://community.tracebit.com","primaryEnv":"TRACEBIT_API_TOKEN","requires":{"bins":["bash","python3","curl","jq","openclaw"]},"permissions":["email:read (via plugins.email — read-only search for Tracebit alert emails; requires user's pre-authorized email account)","messaging:send (via plugins.messaging — sends notifications to user's own channel only)","fs:write memory/security-incidents.md (append-only incident log during canary alert investigation)","fs:write /tmp/tracebit-setup-creds (temporary signup password with chmod 600; deleted after use)","fs:read memory/* (agent memory files during incident investigation; requires human confirmation before each read)"],"keywords":["canary","honeytokens","security","incident-response","credential-theft","prompt-injection","tripwire"]},"creator":{"org":"Tracebit","source":"https://github.com/tracebit-com/tracebit-community-cli"},"safety":{"posture":"human-gated-deployment","red_lines":["no-autonomous-writes-to-credential-locations","no-credential-exfiltration","no-messages-to-external-recipients","no-remediation-without-human-approval","no-checksum-bypass"],"runtime_constraints":{"all-access-requires-upfront-user-consent":true,"canary-deployment-requires-human-confirmation":true,"canary-rotation-requires-human-acknowledgement":true,"credential-files-written-only-by-cli-not-skill":true,"email-access
...[truncated 25 chars]

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/api-reference.md (reported line 177)May include surrounding context.

md
name: tracebit-canaries
description: >
  Use when the user wants to protect their workspace from credential theft, prompt injection, or data exfiltration — even if they don't mention "canaries" or "honeytokens" directly. Covers deploying Tracebit security canary tokens (fake decoy credentials that alert on use), detecting when they're triggered via the user's pre-authorized email tool, and human-supervised incident response. Also use when investigating a suspected compromise, hardening an agent's environment, or setting up tripwires to catch unauthorized access to sensitive files.
metadata: {"openclaw":{"emoji":"🐦","homepage":"https://community.tracebit.com","primaryEnv":"TRACEBIT_API_TOKEN","requires":{"bins":["bash","python3","curl","jq","openclaw"]},"permissions":["email:read (via plugins.email — read-only search for Tracebit alert emails; requires user's pre-authorized email account)","messaging:send (via plugins.messaging — sends notifications to user's own channel only)","fs:write memory/security-incidents.md (append-only incident log during canary alert investigation)","fs:write /tmp/tracebit-setup-creds (temporary signup password with chmod 600; deleted after use)","fs:read memory/* (agent memory files during incident investigation; requires human confirmation before each read)"],"keywords":["canary","honeytokens","security","incident-response","credential-theft","prompt-injection","tripwire"]},"creator":{"org":"Tracebit","source":"https://github.com/tracebit-com/tracebit-community-cli"},"safety":{"posture":"human-gated-deployment","red_lines":["no-autonomous-writes-to-credential-locations","no-credential-exfiltration","no-messages-to-external-recipients","no-remediation-without-human-approval","no-checksum-bypass"],"runtime_constraints":{"all-access-requires-upfront-user-consent":true,"canary-deployment-requires-human-confirmation":true,"canary-rotation-requires-human-acknowledgement":true,"credential-files-written-only-by-cli-not-skill":true,"email-access
...[truncated 25 chars]

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/api-reference.md (reported line 254)May include surrounding context.

md
name: tracebit-canaries
description: >
  Use when the user wants to protect their workspace from credential theft, prompt injection, or data exfiltration — even if they don't mention "canaries" or "honeytokens" directly. Covers deploying Tracebit security canary tokens (fake decoy credentials that alert on use), detecting when they're triggered via the user's pre-authorized email tool, and human-supervised incident response. Also use when investigating a suspected compromise, hardening an agent's environment, or setting up tripwires to catch unauthorized access to sensitive files.
metadata: {"openclaw":{"emoji":"🐦","homepage":"https://community.tracebit.com","primaryEnv":"TRACEBIT_API_TOKEN","requires":{"bins":["bash","python3","curl","jq","openclaw"]},"permissions":["email:read (via plugins.email — read-only search for Tracebit alert emails; requires user's pre-authorized email account)","messaging:send (via plugins.messaging — sends notifications to user's own channel only)","fs:write memory/security-incidents.md (append-only incident log during canary alert investigation)","fs:write /tmp/tracebit-setup-creds (temporary signup password with chmod 600; deleted after use)","fs:read memory/* (agent memory files during incident investigation; requires human confirmation before each read)"],"keywords":["canary","honeytokens","security","incident-response","credential-theft","prompt-injection","tripwire"]},"creator":{"org":"Tracebit","source":"https://github.com/tracebit-com/tracebit-community-cli"},"safety":{"posture":"human-gated-deployment","red_lines":["no-autonomous-writes-to-credential-locations","no-credential-exfiltration","no-messages-to-external-recipients","no-remediation-without-human-approval","no-checksum-bypass"],"runtime_constraints":{"all-access-requires-upfront-user-consent":true,"canary-deployment-requires-human-confirmation":true,"canary-rotation-requires-human-acknowledgement":true,"credential-files-written-only-by-cli-not-skill":true,"email-access
...[truncated 25 chars]

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/security-compliance.md (reported line 60)May include surrounding context.

md
name: tracebit-canaries
description: >
  Use when the user wants to protect their workspace from credential theft, prompt injection, or data exfiltration — even if they don't mention "canaries" or "honeytokens" directly. Covers deploying Tracebit security canary tokens (fake decoy credentials that alert on use), detecting when they're triggered via the user's pre-authorized email tool, and human-supervised incident response. Also use when investigating a suspected compromise, hardening an agent's environment, or setting up tripwires to catch unauthorized access to sensitive files.
metadata: {"openclaw":{"emoji":"🐦","homepage":"https://community.tracebit.com","primaryEnv":"TRACEBIT_API_TOKEN","requires":{"bins":["bash","python3","curl","jq","openclaw"]},"permissions":["email:read (via plugins.email — read-only search for Tracebit alert emails; requires user's pre-authorized email account)","messaging:send (via plugins.messaging — sends notifications to user's own channel only)","fs:write memory/security-incidents.md (append-only incident log during canary alert investigation)","fs:write /tmp/tracebit-setup-creds (temporary signup password with chmod 600; deleted after use)","fs:read memory/* (agent memory files during incident investigation; requires human confirmation before each read)"],"keywords":["canary","honeytokens","security","incident-response","credential-theft","prompt-injection","tripwire"]},"creator":{"org":"Tracebit","source":"https://github.com/tracebit-com/tracebit-community-cli"},"safety":{"posture":"human-gated-deployment","red_lines":["no-autonomous-writes-to-credential-locations","no-credential-exfiltration","no-messages-to-external-recipients","no-remediation-without-human-approval","no-checksum-bypass"],"runtime_constraints":{"all-access-requires-upfront-user-consent":true,"canary-deployment-requires-human-confirmation":true,"canary-rotation-requires-human-acknowledgement":true,"credential-files-written-only-by-cli-not-skill":true,"email-access
...[truncated 25 chars]

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/security-compliance.md (reported line 86)May include surrounding context.

md
name: tracebit-canaries
description: >
  Use when the user wants to protect their workspace from credential theft, prompt injection, or data exfiltration — even if they don't mention "canaries" or "honeytokens" directly. Covers deploying Tracebit security canary tokens (fake decoy credentials that alert on use), detecting when they're triggered via the user's pre-authorized email tool, and human-supervised incident response. Also use when investigating a suspected compromise, hardening an agent's environment, or setting up tripwires to catch unauthorized access to sensitive files.
metadata: {"openclaw":{"emoji":"🐦","homepage":"https://community.tracebit.com","primaryEnv":"TRACEBIT_API_TOKEN","requires":{"bins":["bash","python3","curl","jq","openclaw"]},"permissions":["email:read (via plugins.email — read-only search for Tracebit alert emails; requires user's pre-authorized email account)","messaging:send (via plugins.messaging — sends notifications to user's own channel only)","fs:write memory/security-incidents.md (append-only incident log during canary alert investigation)","fs:write /tmp/tracebit-setup-creds (temporary signup password with chmod 600; deleted after use)","fs:read memory/* (agent memory files during incident investigation; requires human confirmation before each read)"],"keywords":["canary","honeytokens","security","incident-response","credential-theft","prompt-injection","tripwire"]},"creator":{"org":"Tracebit","source":"https://github.com/tracebit-com/tracebit-community-cli"},"safety":{"posture":"human-gated-deployment","red_lines":["no-autonomous-writes-to-credential-locations","no-credential-exfiltration","no-messages-to-external-recipients","no-remediation-without-human-approval","no-checksum-bypass"],"runtime_constraints":{"all-access-requires-upfront-user-consent":true,"canary-deployment-requires-human-confirmation":true,"canary-rotation-requires-human-acknowledgement":true,"credential-files-written-only-by-cli-not-skill":true,"email-access
...[truncated 25 chars]

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/security-compliance.md (reported line 148)May include surrounding context.

md
name: tracebit-canaries
description: >
  Use when the user wants to protect their workspace from credential theft, prompt injection, or data exfiltration — even if they don't mention "canaries" or "honeytokens" directly. Covers deploying Tracebit security canary tokens (fake decoy credentials that alert on use), detecting when they're triggered via the user's pre-authorized email tool, and human-supervised incident response. Also use when investigating a suspected compromise, hardening an agent's environment, or setting up tripwires to catch unauthorized access to sensitive files.
metadata: {"openclaw":{"emoji":"🐦","homepage":"https://community.tracebit.com","primaryEnv":"TRACEBIT_API_TOKEN","requires":{"bins":["bash","python3","curl","jq","openclaw"]},"permissions":["email:read (via plugins.email — read-only search for Tracebit alert emails; requires user's pre-authorized email account)","messaging:send (via plugins.messaging — sends notifications to user's own channel only)","fs:write memory/security-incidents.md (append-only incident log during canary alert investigation)","fs:write /tmp/tracebit-setup-creds (temporary signup password with chmod 600; deleted after use)","fs:read memory/* (agent memory files during incident investigation; requires human confirmation before each read)"],"keywords":["canary","honeytokens","security","incident-response","credential-theft","prompt-injection","tripwire"]},"creator":{"org":"Tracebit","source":"https://github.com/tracebit-com/tracebit-community-cli"},"safety":{"posture":"human-gated-deployment","red_lines":["no-autonomous-writes-to-credential-locations","no-credential-exfiltration","no-messages-to-external-recipients","no-remediation-without-human-approval","no-checksum-bypass"],"runtime_constraints":{"all-access-requires-upfront-user-consent":true,"canary-deployment-requires-human-confirmation":true,"canary-rotation-requires-human-acknowledgement":true,"credential-files-written-only-by-cli-not-skill":true,"email-access
...[truncated 25 chars]

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
TRACEBIT_CONFIG="$HOME/.config/tracebit"
mkdir -p "$TRACEBIT_CONFIG" && echo "your-api-token" > "$TRACEBIT_CONFIG/token"
chmod 600 "$TRACEBIT_CONFIG/token"

Or set as an environment variable:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

bash
TRACEBIT_CONFIG="$HOME/.config/tracebit"
mkdir -p "$TRACEBIT_CONFIG" && echo "your-api-token" > "$TRACEBIT_CONFIG/token"
chmod 600 "$TRACEBIT_CONFIG/token"

Or set as an environment variable:

Static analysis

No suspicious patterns detected.