ClawHub
Back to skill

Security audit

Asusctl Usage

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed ASUS laptop hardware-control guide with some real hardware-risk commands, but no hidden code, exfiltration, or deceptive behavior.

Install only if you use asusctl on a supported ASUS laptop. Before running set commands, especially fan curves, charge limits, and Armoury/GPU MUX settings, check current values and supported features with the listed info/list/get commands; expect some changes to affect thermals, battery life, display routing, or require a reboot.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md
## Common Pitfalls & Fixes
- "Command not found" or limited options → `asusctl info --show-supported` (your model may not support the feature, or daemon not running / udev rules missing).
- Changes don't persist → Restart daemon after major upgrades: `sudo systemctl daemon-reload && sudo systemctl restart asusd`
- Fan curves ignored → Ensure `--enable-fan-curves true` and the profile is active.
- No RGB or partial zones → Use `asusctl aura power ...` or check laptop is in `aura_support.ron`.
- GUI won't start → Missing runtime deps for Slint/GTK (rare after proper `make install`).

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
# asusctl Runtime Usage Guide

## Overview
After `asusctl` (the suite) is built and installed via `make` + `sudo make install`, the main executables are:

- `asusd` — system daemon (must be running; auto-started via udev rule + systemd unit)
- `asusctl` — primary CLI for querying and controlling hardware features

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md
# asusctl Runtime Usage Guide

## Overview
After `asusctl` (the suite) is built and installed via `make` + `sudo make install`, the main executables are:

- `asusd` — system daemon (must be running; auto-started via udev rule + systemd unit)
- `asusctl` — primary CLI for querying and controlling hardware features

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

sh
  systemctl status asusd

If not: sudo systemctl enable --now asusd

  • asusctl and rog-control-center in PATH (installed to /usr/bin by sudo make install).

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

sh
  systemctl status asusd

If not: sudo systemctl enable --now asusd

  • asusctl and rog-control-center in PATH (installed to /usr/bin by sudo make install).

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

sh
  systemctl status asusd

If not: sudo systemctl enable --now asusd

  • asusctl and rog-control-center in PATH (installed to /usr/bin by sudo make install).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to modify firmware/BIOS-exposed hardware settings such as GPU MUX and other Armoury properties without any explicit warning about reboot requirements, instability, thermal/power implications, or possible loss of display/output on unsupported configurations. In a hardware-control skill, omission of safety guidance can cause real system-impacting changes even if the commands themselves are legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.