ClawHub
Back to skill

Security audit

MessageGuard

Security checks for vulnerabilities and agentic risk

Overview

MessageGuard is a coherent local message-filtering skill, but it can expose blocked secrets in its own JSON output and detection logs, so users should review it carefully before relying on it.

Install only if you are comfortable reviewing or patching the script first. Do not rely on it as-is for high-sensitivity messages unless blocked outputs are redacted or omitted, config failures fail closed, and detection logs are minimized, permission-restricted, and retained only where appropriate.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/filter_message.py:201
Finding

YAML Configuration Failure Silently Falls Back to Weaker Defaults

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/filter_message.py:352
Finding

Blocked Messages Are Returned Unredacted in JSON Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/filter_message.py:254
Finding

Detection Metadata and Log Files Disclose Secret Prefixes

Content
View full analysis
6 else sensitive, "description": pattern.get("description", "") }) ``` For full-match detections: ```python detections.append({ "name": name, "action": action, "snippet": sensitive[:6] + "…" if len(sensitive) > 6 else sensitive, "description": pattern.get("description", "") }) ``` The metadata is optionally persisted: ```python def log_detection(log_path: str, channel: str | None, detections: list[dict], blocked: bool): """Append detection event to JSONL log.""" path = Path(log_path).expanduser() path.parent.mkdir(parents=True, exist_ok=True) entry = { "ts": datetime.datetime.utcnow().isoformat() + "Z", "channel": channel, "blocked": blocked, "detections": detections } with open(path, "a") as f: f.write(json.dumps(entry) + "\n") ``` ### Technical Analysis Each detection record copies up to the first six characters of the matched sensitive value. Values of six characters or fewer are retained in full. These snippets are always included in returned JSON and are also written to the JSONL audit file when detection logging is enabled. Credential prefixes can reveal provider, account, token type, environment, or other identifying information. Full retention of short matches creates a direct plaintext disclosure risk for custom patterns that detect short sensitive values. The log is opened using normal process umask behavior, without explicitly enforcing owner-only permissions. Existing files with permissive permissions ar ...[truncated 1231 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
80% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/filter_message.py (reported line 92)May include surrounding context.

python
"regex": r"(?i)(?:password|passwd|pass|pwd)\s*[=:\"'`\s]\s*(\S{6,})",
        "capture_group": 1,
        "action": "mask",
        "description": "Password in key=value form"
    },
    {
        "name": "database_url",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/filter_message.py (reported line 141)May include surrounding context.

python
"name": "env_file_line",
        "regex": r"(?m)^[A-Z_]{3,}=[^\s]{8,}$",
        "action": "mask",
        "description": ".env file variable assignment"
    },
    {
        "name": "sendgrid_key",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly promotes logging detections for outgoing-message filtering but does not warn that logs may capture the very sensitive strings being detected, or adjacent message content and metadata. In a data-loss-prevention context, this omission is security-relevant because centralized logs often have broader retention and access than the original message path, turning leak prevention into secondary sensitive-data exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.