ClawHub
Back to skill

Security audit

agent-readiness

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill benign with medium confidence: it found no AIG issues and no clear malicious behavior, while noting a changeable package version and a possible mismatch between fix instructions and declared write permissions.

The verdict is benign, not risk-free. Before installing, consider that the package can change within major version 8, and that scanner coverage was partial: one of two listed components was fully scanned, with tool-misuse analysis degraded. Install only if you are comfortable with those limits.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

text

- Pass the explicit `http://` scheme for local dev servers — a bare host defaults to `https://`.
- The relaxation is scoped to the **single host named on the CLI**, evaluated per hop. A redirect or sitemap `<loc>` pointing at any other private host (e.g. `169.254.169.254`) stays blocked.
- To audit a whole local site whose sitemap hardcodes the prod domain, combine with sitemap origin rewriting:

```bash

Manifest references MCP server without version pin: 'npx @canonry/agent-readiness'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The commands specify @8, so the package is major-version constrained rather than completely unversioned, and it is a CLI rather than an MCP server. However, @8 can resolve to changing minor or patch releases; a compromised release could execute with the agent process's filesystem, environment, and network access. The repeated requirement to use the published package makes this a persistent supply-chain exposure, although no malicious package behavior is demonstrated.

Content

No source excerpt is available for this finding.

The fix workflow directs edits across the current codebase despite file-write permissions being limited to four named files.

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The allowed-tools declaration at L006–L014 permits direct writes only to llms.txt, llms-full.txt, robots.txt, and entities.json. The fix workflow at L313–L321 nevertheless directs changes to structured data, FAQ markup, metadata, and Markdown endpoints, which can require modifying source files outside that allowlist. User confirmation at L325 does not itself expand the declared tool permissions.

Content

No source excerpt is available for this finding.