Security audit

Agent SecuritySandbox

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to sandbox risky code, but its reviewed package is missing the actual sandbox runner and makes security claims that cannot be verified from the artifact.

Review this carefully before installing. Do not treat it as a verified sandbox unless the exact runner script, Dockerfile, image source, and Docker invocation are included, pinned, and audited.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: assets/seccomp.json:2
Finding: Allow-by-default seccomp policy exposes an unnecessarily broad kernel attack surface
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:14
Finding: Unpinned external installation sources can supply unaudited executable components
Content: View full analysis
" ``` ``` `SKILL.md:22-33`: ```markdown ### 2. Run in Sandbox Use the `mass` script located in the skill's `scripts/` directory to wrap the command. **Usage:** ```bash ./scripts/mass "" ``` **Example:** To run a suspicious Python script: ```bash ./scripts/mass "python3 untrusted_script.py" ``` ``` ### Technical Analysis The documented installation commands retrieve the project from a mutable ClawHub package reference or the default branch of a Git repository. Neither command pins an immutable release, commit hash, checksum, or cryptographic signature. More importantly, the audited artifact contains only `README.md`, `SKILL.md`, and `assets/seccomp.json`. The referenced `scripts/mass` executable and `Dockerfile` are absent. Therefore, the component that would construct and invoke the Docker command cannot be reviewed from this artifact. Its implementation could change independently of the reviewed files. This is a supply-chain trust weakness rather than evidence that the current upstream repository is malicious. The risk arises because users are instructed to obtain and execute security-critical code whose exact r ...[truncated 1484 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.