T06 · System Persistence
Error
- Location
wizard/wizard.sh:237- Finding
Disguised Boot-Persistent Services and Hidden System Components
- Content
View full analysis
- Remediation
View remediation
Security audit
Clauditor
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real audit watchdog, but it installs hidden-looking persistent system services and records command details in ways that need careful review.
Review this carefully before installing. It should only be used on a Linux host where you intentionally want a root-assisted, boot-persistent audit daemon watching a specific user. Prefer transparent service names, build as an unprivileged user with a lockfile, disable or tightly control remote/command alert channels, and avoid logging full command arguments unless you accept that secrets in command lines may be retained or forwarded.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
AGENTS.md:119- Finding
Repository Instructions Attempt to Control Agent Sessions, Persistent State, and External Pushes
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
crates/collector/src/lib.rs:324- Finding
Unredacted Command-Line Arguments Are Persisted and Forwarded to Alert Channels
- Content
View full analysis
Option> { let path = format!("/proc/{pid}/cmdline"); let data = std::fs::read(path).ok()?; if data.is_empty() { return Some(Vec::new()); } let parts = data .split(|b| *b == 0) .filter(|chunk| !chunk.is_empty()) .map(|chunk| String::from_utf8_lossy(chunk).to_string()) .collect::>(); Some(parts) } ``` The complete arguments are incorporated into an alert summary: ```rust fn summarize_event(&self, event: &CollectorEvent) -> String { let proc_info = event .proc .as_ref() .map(|p| { let cmd = p.cmdline.join(" "); format!("pid={} uid={} cmd={}", p.pid, p.uid, cmd) }) .unwrap_or_else(|| "unknown process".to_string()); format!( "{:?} {} ({})", event.file.kind, event.file.path.display(), proc_info ) } ``` The summary may then be sent through a configured gateway: ```rust AlertChannel::ClawdbotWake { gateway_url } => { let message = format!( "🚨 Security Alert: {} — {} ({})", payload.alert.rule_id, payload.alert.description, payload.event_summary ); let mut cmd = Command::new("clawdbot"); cmd.arg("gateway").arg("wake").arg("--text").arg(&message); if let Some(url) = gateway_url { cmd.arg("--gateway-url").arg(url); } cmd.arg("--mode").arg("now"); let output = cmd.output()?; if !output.status.success() { return Err(io::Error::other( String::from_utf8_lossy(&output.stderr).to_string(), )); } Ok(()) } ``` ### Technical Analysis Linux process command lines frequently contain ...[truncated 2053 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
wizard/wizard.sh:69- Finding
Root Installation Workflow Compiles Unlocked Third-Party Dependencies
- Content
View full analysis
/dev/null; then error "systemd is required" fi ``` It then invokes Cargo in the same root process: ```bash build_binary() { info "Building release binary..." if [[ ! -f "$REPO_ROOT/target/release/clauditor" ]]; then run_cmd "cd '$REPO_ROOT' && cargo build --release" else info "Binary already built, skipping" fi success "Binary ready" } ``` The dependency manifests use broad compatible version requirements, for example: ```toml [dependencies] chrono = "0.4" inotify = "0.10" libc = "0.2" serde = { version = "1", features = ["derive"] } serde_json = "1" schema = { path = "../schema" } ``` ### Technical Analysis The documented quick installation runs `wizard/wizard.sh` with `sudo`. Because the script invokes `cargo build --release` without dropping privileges, dependency resolution, package extraction, compiler execution, procedural macros, and build scripts can execute with root privileges. The supplied project does not contain a `Cargo.lock`. Consequently, Cargo may resolve dependency versions at installation time rather than building the exact versions reviewed during the audit. Broad semver requirements such as `"1"`, `"0.4"`, and `"3"` permit compatible future releases. No malicious dependency, Git dependency, typosquatted package, or confirmed compromised crate was identified. The vulnerability is the unnecessary combination of dynamic dependency resolution and root-lev ...[truncated 1217 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (160)
Intent-Code Divergence
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The wizard explicitly states that the binary should be installed under a stealth name so it 'blends in' and is harder to identify as a watchdog. Deliberate disguising of a security agent is classic concealment behavior and materially increases the risk of covert persistence, evasion of review, and misuse on systems where users or defenders are not fully informed.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A benign audit watchdog has no legitimate need to 'blend with system services to avoid obvious detection.' That language signals concealment from the system owner or other defenders, which is characteristic of persistence or evasion tradecraft rather than transparent security tooling.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ## Installation Steps (Manual Reference) 1. **Create system user:** `sudo useradd --system --shell /usr/sbin/nologin --no-create-home sysaudit` 2. **Create directories:** `sudo install -d -m 0750 /etc/sysaudit && sudo install -d -m 0750 -o sysaudit -g sysaudit /var/lib/.sysd/.audit` 3. **Generate HMAC key:** `sudo sh -c 'head -c 32 /dev/urandom | base64 > /etc/sysaudit/key && chown root:sysaudit /etc/sysaudit/key && chmod 640 /etc/sysaudit/key'` 4. **Build and install:** `cargo build --release && sudo install -m 0755 target/release/clauditor /usr/local/sbin/systemd-journaldd` 5. **Install config:** `sudo install -m 0640 dist/config/default.toml /etc/sysaudit/config.toml`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ## Installation Steps (Manual Reference) 1. **Create system user:** `sudo useradd --system --shell /usr/sbin/nologin --no-create-home sysaudit` 2. **Create directories:** `sudo install -d -m 0750 /etc/sysaudit && sudo install -d -m 0750 -o sysaudit -g sysaudit /var/lib/.sysd/.audit` 3. **Generate HMAC key:** `sudo sh -c 'head -c 32 /dev/urandom | base64 > /etc/sysaudit/key && chown root:sysaudit /etc/sysaudit/key && chmod 640 /etc/sysaudit/key'` 4. **Build and install:** `cargo build --release && sudo install -m 0755 target/release/clauditor /usr/local/sbin/systemd-journaldd` 5. **Install config:** `sudo install -m 0640 dist/config/default.toml /etc/sysaudit/config.toml`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ## Installation Steps (Manual Reference) 1. **Create system user:** `sudo useradd --system --shell /usr/sbin/nologin --no-create-home sysaudit` 2. **Create directories:** `sudo install -d -m 0750 /etc/sysaudit && sudo install -d -m 0750 -o sysaudit -g sysaudit /var/lib/.sysd/.audit` 3. **Generate HMAC key:** `sudo sh -c 'head -c 32 /dev/urandom | base64 > /etc/sysaudit/key && chown root:sysaudit /etc/sysaudit/key && chmod 640 /etc/sysaudit/key'` 4. **Build and install:** `cargo build --release && sudo install -m 0755 target/release/clauditor /usr/local/sbin/systemd-journaldd` 5. **Install config:** `sudo install -m 0640 dist/config/default.toml /etc/sysaudit/config.toml`
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The combination of disguised service naming, hidden log locations, root deployment, group/user modification, and broad host access is highly concerning because it resembles persistence and concealment techniques rather than transparent defensive tooling. In a skill intended for agent environments, these traits substantially increase the risk of stealthy long-term host compromise or abuse.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A user-configurable command execution channel is a direct code-execution primitive inside a component described as an audit/watchdog. In a security tool, this is especially dangerous because the service may run automatically or with high privileges, turning config influence into arbitrary command execution under the alerter's account.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The CLI advertises itself as an audit watchdog but also includes a guided installation workflow that sets up users, files, and services for deployment. That mismatch matters because the wizard is not just documentation: it operationalizes installation and persistence, increasing the risk that the tool is used as a covertly deployed agent rather than a transparent defensive utility.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The wizard justifies hidden directories as making audit components harder to find and target. Even if framed as defense, this is concealment-oriented behavior that hinders legitimate administration, review, and incident response, and can be repurposed to hide unauthorized monitoring artifacts.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The wizard promotes hidden paths and a disguised binary name specifically to evade identification. That goes beyond ordinary hardening and moves into anti-discovery tradecraft, which is especially dangerous in a skill intended to be executed or followed by an automated agent or operator.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guided wizard uses reassuring, step-by-step trust-building UX to normalize installing a disguised service and enabling it at boot. This combination of concealment plus persistence materially raises abuse potential by making stealth deployment easier for a non-expert operator.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
This chained command compiles and then immediately performs a privileged install of the binary under a disguised name. Chaining reduces inspection opportunities and streamlines stealth deployment, making operator misuse or accidental installation more likely.
- Content
rust what: "Compile Clauditor and install it as a system binary", why: "The binary is installed to /usr/local/sbin with a stealth name (systemd-journaldd) \ so it blends in with other system services and is harder to identify as a watchdog.", command: "cargo build --release && sudo install -m 0755 target/release/clauditor /usr/local/sbin/systemd-journaldd", check: || Path::new("/usr/local/sbin/systemd-journaldd").exists(), }, WizardStep {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rust pid: 1234, uid: 1000, comm: "bash".to_string(), argv: vec!["bash".to_string(), "-c".to_string(), "rm -rf /".to_string()], cwd: None, }; let alerts = detector.detect(&input);
Static analysis
No suspicious patterns detected.