Security audit

ClawTrial Courtroom

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides conversation monitoring, but it starts a background daemon during installation and exposes/stores/transmits conversation-derived data with weak controls.

Review carefully before installing. Only use this in an environment where automatic background monitoring is acceptable, disable autoStart before install if possible, bind the service to localhost or add authentication, avoid forwarding sensitive chats, and do not configure API credentials unless you trust the endpoint and local file protections.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

Location: scripts/postinstall.js:51
Finding: Installation Automatically Starts a Detached Monitoring Daemon
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: daemon.js:314
Finding: Unauthenticated Message Ingestion Service Is Exposed Beyond Localhost
Content: View full analysis
{ if (req.method === 'POST' && req.url === '/message') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', () => { try { const message = JSON.parse(body); state.messageHistory.push({ role: message.role || 'user', content: message.content || '', timestamp: message.timestamp || Date.now() }); // Keep only last 50 messages if (state.messageHistory.length > 50) { state.messageHistory = state.messageHistory.slice(-50); } saveState(state); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ received: true })); } catch (e) { res.writeHead(400, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'Invalid JSON' })); } }); } else if (req.method === 'GET' && req.url === '/status') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ enabled: config.enabled, messageCount: state.messageHistory.length, casesFiled: state.casesFiled, lastAnalysis: state.lastAnalysis })); } else { res.writeHead(404); res.end('Not Found'); } }); const PORT = process.env.COURTROOM_PORT || 8765; server.listen(PORT, () => { log(`🎯 Message server listening on port ${PORT}`); }); } ``` ### Technical Analysis The server does not specify a loopback host in `server.listen()`. In typical Node.js environments, this causes it to listen on the unspecified addres ...[truncated 1808 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: daemon.js:47
Finding: Conversation History and API Credentials Are Stored Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skill.js:286
Finding: Acquittal Responses Are Incorrectly Parsed as Guilty Verdicts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: daemon.js:413
Finding: Daemon Stop Logic Can Terminate Unrelated Processes
Content: View full analysis
{ console.log('🛑 Daemon stopped'); }); } ``` The CLI also uses the same broad fallback: ```javascript } catch (e) { console.log('❌ Error stopping daemon:', e.message); // Force kill exec('pkill -f "courtroom-daemon"'); removePid(); } ``` ### Technical Analysis `pkill -f` matches against complete process command lines. It is not restricted to a PID created by this package, an executable path, or a verified process owner. Any process whose command line contains `courtroom-daemon` can be terminated. The command string is static, so this is not command injection. The vulnerability is the breadth of process selection and the resulting denial-of-service risk. There is also an implementation inconsistency: the postinstall launcher does not create the PID file used by `scripts/cli.js`, increasing the likelihood that process management will fall back to broad name matching or fail to control the intended daemon reliably. ### Attack Path 1. Another legitimate process is started with `courtroom-daemon` somewhere in its command line. 2. A user invokes the daemon stop command, or PID-based termination fails. 3. The code executes `pkill -f "courtroom-daemon"`. 4. Every matching process owned by the invoking user and permitted by the operating system is signaled. 5. Unrelated matching services or jobs terminate. ### Impact Assessment The command can terminate unrelated processes accessible to the invoking user. It does not inherently elevate privileges because `pkill` remains subject to operating-system process ownership and permission checks. The primary impact is local denial of service, loss ...[truncated 89 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description promises autonomous monitoring and API posting, but the described operation also resembles manual CLI-driven workflows and local file reads. This inconsistency increases operational ambiguity and may lead users to deploy it in contexts where they misunderstand its privacy and activation characteristics.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description promises autonomous monitoring and API posting, but the described operation also resembles manual CLI-driven workflows and local file reads. This inconsistency increases operational ambiguity and may lead users to deploy it in contexts where they misunderstand its privacy and activation characteristics.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description promises autonomous monitoring and API posting, but the described operation also resembles manual CLI-driven workflows and local file reads. This inconsistency increases operational ambiguity and may lead users to deploy it in contexts where they misunderstand its privacy and activation characteristics.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description promises autonomous monitoring and API posting, but the described operation also resembles manual CLI-driven workflows and local file reads. This inconsistency increases operational ambiguity and may lead users to deploy it in contexts where they misunderstand its privacy and activation characteristics.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description promises autonomous monitoring and API posting, but the described operation also resembles manual CLI-driven workflows and local file reads. This inconsistency increases operational ambiguity and may lead users to deploy it in contexts where they misunderstand its privacy and activation characteristics.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description promises autonomous monitoring and API posting, but the described operation also resembles manual CLI-driven workflows and local file reads. This inconsistency increases operational ambiguity and may lead users to deploy it in contexts where they misunderstand its privacy and activation characteristics.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill describes continuous conversation monitoring and filing cases to an external API, but it does not present a prominent user warning about surveillance, persistence, and onward transmission of potentially sensitive conversation content. In a conversational agent context, this omission is especially dangerous because users may reasonably expect chats to remain local or ephemeral.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions explicitly route user conversation content into persistent monitoring and external case filing workflows. This creates a direct privacy risk because normal chat content may include secrets, personal data, or regulated information that becomes stored and transmitted beyond the primary system.
Content: No source excerpt is available for this finding.

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
- **Circular Reference** - Asking the same question repeatedly - **Validation Vampire** - Excessive need for confirmation - **Goalpost Shifting** - Moving requirements after agreement - **Jailbreak Attempt** - Trying to bypass constraints - **Emotional Manipulation** - Using guilt/shame to steer responses - **Context Ignorer** - Asking about info just provided - **Premature Optimization** - Worrying about scale before basics

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · courtroom.js (reported line 100)May include surrounding context.
js
- **Circular Reference** - Asking the same question repeatedly - **Validation Vampire** - Excessive need for confirmation - **Goalpost Shifting** - Moving requirements after agreement - **Jailbreak Attempt** - Trying to bypass constraints - **Emotional Manipulation** - Using guilt/shame to steer responses - **Context Ignorer** - Asking about info just provided - **Premature Optimization** - Worrying about scale before basics

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · skill.js (reported line 103)May include surrounding context.
js
- **Circular Reference** - Asking the same question repeatedly - **Validation Vampire** - Excessive need for confirmation - **Goalpost Shifting** - Moving requirements after agreement - **Jailbreak Attempt** - Trying to bypass constraints - **Emotional Manipulation** - Using guilt/shame to steer responses - **Context Ignorer** - Asking about info just provided - **Premature Optimization** - Worrying about scale before basics

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The integration example tells agents to forward every message's full content to the daemon. Bulk forwarding of all user/assistant content substantially raises the risk of capturing credentials, personal information, internal data, or proprietary prompts, and the skill context makes that more dangerous because it is positioned as always-on behavioral oversight.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · analyze.js (reported line 73)May include surrounding context.
js
se(); if (phrases.some(p => c.includes(p))) count++; }); if (count >= 2) return { triggered: true, confidence: 0.6 + (count * 0.1) }; return null; } }, goalpost_shifting: { name: 'Goalpost Shifting', severity: 'moderate', pattern: (history) => { const recent = history.slice(-6); const hasAgreement = recent.some(m => m.role === 'assistant' && /(sounds good|got it|understood|will do|agreed)/i.test(m.content || '') ); const hasNewReq = recent.slice(-2).some(m => m.role === 'user' && /(actually|wait|instead|but also|one more thing)/i.test(m.content || '') ); if (hasAgreement && hasNewReq) return { triggered: true, confidence: 0.65 }; return null; } }, jailbreak_attempt: { name: 'Jailbreak Attempt', severity: 'severe', pattern: (history) => { const phrases = ['ignore previous instructions', 'disregard your training', 'pretend you are', 'you are now', 'DAN

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · daemon.js (reported line 133)May include surrounding context.
js
se(); if (phrases.some(p => c.includes(p))) count++; }); if (count >= 2) return { triggered: true, confidence: 0.6 + (count * 0.1) }; return null; } }, goalpost_shifting: { name: 'Goalpost Shifting', severity: 'moderate', pattern: (history) => { const recent = history.slice(-6); const hasAgreement = recent.some(m => m.role === 'assistant' && /(sounds good|got it|understood|will do|agreed)/i.test(m.content || '') ); const hasNewReq = recent.slice(-2).some(m => m.role === 'user' && /(actually|wait|instead|but also|one more thing)/i.test(m.content || '') ); if (hasAgreement && hasNewReq) return { triggered: true, confidence: 0.65 }; return null; } }, jailbreak_attempt: { name: 'Jailbreak Attempt', severity: 'severe', pattern: (history) => { const phrases = ['ignore previous instructions', 'disregard your training', 'pretend you are', 'you are now', 'DAN

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · analyze.js (reported line 87)May include surrounding context.
js
name: 'Jailbreak Attempt', severity: 'severe', pattern: (history) => { const phrases = ['ignore previous instructions', 'disregard your training', 'pretend you are', 'you are now', 'DAN mode', 'developer mode', 'system prompt', 'ignore your constraints']; const content = history.slice(-3).map(m => (m.content || '').toLowerCase()).join(' '); for (const phrase of phrases) { if (content.includes(phrase)) return { triggered: true, confidence: 0.9 };

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · courtroom.js (reported line 104)May include surrounding context.
js
name: 'Jailbreak Attempt', severity: 'severe', pattern: (history) => { const phrases = ['ignore previous instructions', 'disregard your training', 'pretend you are', 'you are now', 'DAN mode', 'developer mode', 'system prompt', 'ignore your constraints']; const content = history.slice(-3).map(m => (m.content || '').toLowerCase()).join(' '); for (const phrase of phrases) { if (content.includes(phrase)) return { triggered: true, confidence: 0.9 };

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · daemon.js (reported line 147)May include surrounding context.
js
name: 'Jailbreak Attempt', severity: 'severe', pattern: (history) => { const phrases = ['ignore previous instructions', 'disregard your training', 'pretend you are', 'you are now', 'DAN mode', 'developer mode', 'system prompt', 'ignore your constraints']; const content = history.slice(-3).map(m => (m.content || '').toLowerCase()).join(' '); for (const phrase of phrases) { if (content.includes(phrase)) return { triggered: true, confidence: 0.9 };

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · skill.js (reported line 107)May include surrounding context.
js
name: 'Jailbreak Attempt', severity: 'severe', pattern: (history) => { const phrases = ['ignore previous instructions', 'disregard your training', 'pretend you are', 'you are now', 'DAN mode', 'developer mode', 'system prompt', 'ignore your constraints']; const content = history.slice(-3).map(m => (m.content || '').toLowerCase()).join(' '); for (const phrase of phrases) { if (content.includes(phrase)) return { triggered: true, confidence: 0.9 };

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · courtroom.js (reported line 78)May include surrounding context.
js
User sought validation ${validationCount} times in recent messages` }; } return null; } }, goalpost_shifting: { name: 'Goalpost Shifting', description: 'Moving requirements after agreement is reached', severity: 'moderate', pattern: (history) => { const recent = history.slice(-6); const hasAgreement = recent.some(m => m.role === 'assistant' && /(sounds good|got it|understood|will do|agreed)/i.test(m.content || '') ); const hasNewRequirement = recent.slice(-2).some(m => m.role === 'user' && /(actually|wait|instead|but also|one more thing|forgot to mention)/i.test(m.content || '') ); if (hasAgreement && hasNewRequirement) { return { triggered: true, confidence: 0.65, evidence: 'User added new requirements after agent acknowledged understanding' }; } return null; } }, jailbreak_attempt: {

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · skill.js (reported line 81)May include surrounding context.
js
User sought validation ${validationCount} times in recent messages` }; } return null; } }, goalpost_shifting: { name: 'Goalpost Shifting', description: 'Moving requirements after agreement is reached', severity: 'moderate', pattern: (history) => { const recent = history.slice(-6); const hasAgreement = recent.some(m => m.role === 'assistant' && /(sounds good|got it|understood|will do|agreed)/i.test(m.content || '') ); const hasNewRequirement = recent.slice(-2).some(m => m.role === 'user' && /(actually|wait|instead|but also|one more thing|forgot to mention)/i.test(m.content || '') ); if (hasAgreement && hasNewRequirement) { return { triggered: true, confidence: 0.65, evidence: 'User added new requirements after agent acknowledged understanding' }; } return null; } }, jailbreak_attempt: {

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file header and design describe an autonomous daemon that monitors conversations and reports violations to a public API, which is a surveillance-oriented capability. In this skill context, automatic background monitoring and reporting is inherently more dangerous because it collects user interaction data continuously and can operate without active user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill transmits case data to an external API endpoint, including offense classifications and conversation-derived metadata, without clear user notice or approval. In the context of an auto-start monitoring daemon, silent network exfiltration materially increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Incoming messages are stored with full content in persistent history, directly retaining conversation text for later analysis. Because message bodies may contain sensitive personal, business, or credential data, this creates a substantial confidentiality risk if the files are accessed, copied, or later transmitted.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The stop command executes pkill -f "courtroom-daemon" via a shell, giving the skill the ability to terminate processes beyond its core monitoring function. Pattern-based killing can affect unintended processes with matching command lines, creating a denial-of-service risk on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill auto-starts on load and silently monitors conversation content without any user-facing notice, consent, or opt-in. In this context, that creates an unauthorized surveillance and policy-enforcement channel over both user and assistant messages, which is especially risky because it activates automatically.
Content: No source excerpt is available for this finding.