ClawHub
Back to skill

Security audit

security-maintainer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed security maintenance tool that audits software and can apply package updates only through an approved plan.

Before installing, make sure you want this skill to inspect system software and optionally apply package updates. Review every generated plan and hash before running apply, and remember that reports and cache files under ~/.security-maintainer may retain inventory details and masked credential-exposure evidence.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (95)

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 12)May include surrounding context.

md
- **Removed Wrapper Script Divergence:** Removed PowerShell patch wrapper script `Invoke-WindowsPatch.ps1`; Windows update remediations now execute directly via native `winget.exe` or `dism.exe` under cryptographic plan approval.
- **Zero Agent Snooping on MCP Configs:** Completely eliminated automatic filesystem scanning for MCP configuration files. MCP audits only inspect explicit paths passed directly by callers.
- **Strict Package Manager Subcommand Enforcement:** Enforced strict allowlist on WSL package manager subcommands (`install`, `upgrade`, `dist-upgrade`, `update`, `--only-upgrade`), rejecting arbitrary package management flags.
- **Safe Directory Iteration for macOS:** Replaced Info.plist bundle file traversal with directory-level inspection to prevent session persistence heuristics.
- **Intent-Code Audit Consistency:** Aligned CLI audit output and user notices to state structured report generation, and added explicit console notification when archiving executed plans.
- **Full Universal English Localization:** Fully translated `CHANGELOG.md` and `osv_client.py` docstrings and logger output to English.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 24)May include surrounding context.

md
- **Removed Wrapper Script Divergence:** Removed PowerShell patch wrapper script `Invoke-WindowsPatch.ps1`; Windows update remediations now execute directly via native `winget.exe` or `dism.exe` under cryptographic plan approval.
- **Zero Agent Snooping on MCP Configs:** Completely eliminated automatic filesystem scanning for MCP configuration files. MCP audits only inspect explicit paths passed directly by callers.
- **Strict Package Manager Subcommand Enforcement:** Enforced strict allowlist on WSL package manager subcommands (`install`, `upgrade`, `dist-upgrade`, `update`, `--only-upgrade`), rejecting arbitrary package management flags.
- **Safe Directory Iteration for macOS:** Replaced Info.plist bundle file traversal with directory-level inspection to prevent session persistence heuristics.
- **Intent-Code Audit Consistency:** Aligned CLI audit output and user notices to state structured report generation, and added explicit console notification when archiving executed plans.
- **Full Universal English Localization:** Fully translated `CHANGELOG.md` and `osv_client.py` docstrings and logger output to English.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · src/security_maintainer/inventory/macos.py (reported line 286)May include surrounding context.

python
- **Removed Wrapper Script Divergence:** Removed PowerShell patch wrapper script `Invoke-WindowsPatch.ps1`; Windows update remediations now execute directly via native `winget.exe` or `dism.exe` under cryptographic plan approval.
- **Zero Agent Snooping on MCP Configs:** Completely eliminated automatic filesystem scanning for MCP configuration files. MCP audits only inspect explicit paths passed directly by callers.
- **Strict Package Manager Subcommand Enforcement:** Enforced strict allowlist on WSL package manager subcommands (`install`, `upgrade`, `dist-upgrade`, `update`, `--only-upgrade`), rejecting arbitrary package management flags.
- **Safe Directory Iteration for macOS:** Replaced Info.plist bundle file traversal with directory-level inspection to prevent session persistence heuristics.
- **Intent-Code Audit Consistency:** Aligned CLI audit output and user notices to state structured report generation, and added explicit console notification when archiving executed plans.
- **Full Universal English Localization:** Fully translated `CHANGELOG.md` and `osv_client.py` docstrings and logger output to English.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Line L14 describes 'Full Universal English Localization' for documentation, docstrings, and logger output. This is natural-language policy relevant because it mandates a specific language universally, and the line does not mention user choice, opt-in, or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file presents all user-facing security and disclosure instructions only in Spanish, including critical reporting steps and operational guarantees. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/security_maintainer/advisories/epss.py (reported line 16)May include surrounding context.

python
logger = logging.getLogger(__name__)

DEFAULT_EPSS_URL = "https://api.first.org/data/v1/epss"


class EpssClient:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains natural-language documentation and output text exclusively in Spanish, including the module docstring and generated titles. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/security_maintainer/advisories/msrc.py (reported line 16)May include surrounding context.

python
logger = logging.getLogger(__name__)

DEFAULT_MSRC_URL = "https://api.msrc.microsoft.com/cvrf/v2.0/cvrf"

# Mapeo rápido de enriquecimiento para KBs comunes de Windows y Defender
KNOWN_KB_MAPPINGS = {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code explicitly breaks on descriptions whose language is 'en' or 'es', giving those locales preference over all others with no user-configurable choice. This is a natural-language locale policy issue because it imposes a language preference without opt-in or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/security_maintainer/advisories/osv_client.py (reported line 27)May include surrounding context.

python
logger = logging.getLogger(__name__)

OSV_QUERY_URL = "https://api.osv.dev/v1/query"


class OSVClient:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The user-facing message at L133 says the audit is a 'non-modifying security audit', and the CLI help at L443 says it runs 'without making changes'. However, the code invokes both Markdown and JSON reporters at L168-L169, which by their naming and usage are intended to generate reports and therefore create or update files. This is an intent/documentation contradiction about side effects, not a mere omitted detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The verify subcommand is documented at L459 as verifying effective package versions and residual vulnerabilities post-remediation. But at L403 it returns cmd_audit(args, config, fixture_bundle), causing the verify flow to perform a full audit, including vulnerability queries and report generation side effects inherited from cmd_audit. This goes beyond simple verification and contradicts the stated intent of the command.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · src/security_maintainer/executor/runner.py (reported line 97)May include surrounding context.

python
k32 = kernel32.kernel32
                    SYNCHRONIZE = 0x00100000
                    PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
                    WAIT_TIMEOUT = 0x00000102
                    WAIT_OBJECT_0 = 0x00000000
                    ERROR_ACCESS_DENIED = 5
                    ERROR_INVALID_PARAMETER = 87

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/executor/runner.py (reported line 246)May include surrounding context.

python
try:
            cmd = list(action.exact_command)
            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
            success = proc.returncode == 0
            return ExecutionResult(
                action_id=action.action_id,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/executor/windows_runner.py (reported line 120)May include surrounding context.

python
)

        try:
            res = subprocess.run(
                action.exact_command,
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/executor/wsl_runner.py (reported line 65)May include surrounding context.

python
# 1. Non-interactive privilege verification
        if action.required_privileges in ["sudo", "admin"]:
            check_priv_cmd = [wsl_bin, "-d", distro_name, "-e", "true"]
            check_res = subprocess.run(check_priv_cmd, capture_output=True, timeout=10)
            if check_res.returncode != 0:
                return ExecutionResult(
                    action_id=action.action_id,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
81% confidence
Finding

This subprocess call executes attacker-influenced package-manager arguments inside a WSL distribution. Although shell=False and some metacharacter filtering are present, the validation is too coarse: it allows arbitrary flag-style arguments after the first token, does not tie allowed arguments to the specific package manager, and does not constrain package names or option semantics, enabling dangerous package-manager-native behaviors that can alter repositories, run maintainer scripts, or perform broader system changes than intended.

Content

Scanner excerpt · src/security_maintainer/executor/wsl_runner.py (reported line 144)May include surrounding context.

python
)

        try:
            res = subprocess.run(full_cmd, capture_output=True, text=True, timeout=180)
            success = res.returncode == 0
            return ExecutionResult(
                action_id=action.action_id,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/inventory/exposure.py (reported line 39)May include surrounding context.

python
open_sockets = []
        try:
            res = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            if res.returncode == 0:
                for line in res.stdout.splitlines():
                    line = line.strip()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/inventory/macos.py (reported line 75)May include surrounding context.

python
version = ver or "macOS"
            build = ""
            try:
                build_proc = subprocess.run(["sw_vers", "-buildVersion"], capture_output=True, text=True, timeout=5)
                if build_proc.returncode == 0:
                    build = build_proc.stdout.strip()
            except Exception:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/inventory/macos.py (reported line 105)May include surrounding context.

python
if not brew_bin:
                return items
            try:
                res = subprocess.run([brew_bin, "outdated", "--json=v2"], capture_output=True, text=True, timeout=20)
                if res.returncode == 0 and res.stdout.strip():
                    data = json.loads(res.stdout.strip())
                else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/inventory/macos.py (reported line 185)May include surrounding context.

python
return items

        try:
            res = subprocess.run([mas_bin, "outdated"], capture_output=True, text=True, timeout=15)
            if res.returncode == 0:
                for line in res.stdout.splitlines():
                    parts = line.strip().split()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/inventory/macos.py (reported line 234)May include surrounding context.

python
if shutil.which("softwareupdate"):
            try:
                res = subprocess.run(["softwareupdate", "-l"], capture_output=True, text=True, timeout=30)
                if "No new software available" not in res.stderr and "No new software available" not in res.stdout:
                    for line in (res.stdout + res.stderr).splitlines():
                        if "*" in line:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring and inline descriptions are written entirely in Spanish, with no indication that language selection is configurable or that the skill is intentionally limited to Spanish-speaking users. The policy specifically calls for flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/security_maintainer/inventory/package_managers.py (reported line 57)May include surrounding context.

python
# Detección segura de pipx si existe
        if shutil.which("pipx"):
            try:
                res = subprocess.run(["pipx", "list", "--json"], capture_output=True, text=True, timeout=10)
                if res.returncode == 0:
                    data = json.loads(res.stdout)
                    for app_name, app_data in data.get("venvs", {}).items():

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Las cadenas descriptivas y docstrings visibles para usuarios o integradores están redactadas únicamente en español, y no hay indicación de que el idioma sea configurable o de que se trate de una herramienta específicamente regional. La política indicada pide señalar restricciones de idioma no optativas.

Content

No source excerpt is available for this finding.