Claw Permission Firewall

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate permission-firewall skill, but several verified implementation flaws mean it should not be trusted as a hard security boundary without review.

Treat this skill as an advisory evaluator until the policy-bypass issues are fixed. Do not rely on it alone to protect secrets, enforce workspace boundaries, or authorize downstream HTTP/file actions; keep independent executor-side allowlists, pin and audit dependencies, and never place real credentials in example inputs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: src/evaluate.ts:114

Finding

HTTP transport and method restrictions can fail open

Content

View full analysis

risk) const method = (sanitized.method ?? "GET").toUpperCase(); if (policy.http?.allowMethods && !policy.http.allowMethods.includes(method)) { reasons.push({ ruleId: "http.method.not.allowlisted", message: `HTTP method not allowlisted: ${method}` }); } } ``` Related normalization occurs at `src/normalize.ts:22-33`: ```ts if (type === "http_request") { const method = String(action.method ?? "GET").toUpperCase(); const url = String(action.url ?? ""); const u = new URL(url); return { type, method, url, host: u.hostname.toLowerCase(), headers: normalizeHeaders(action.headers), body: action.body }; } ``` ### Technical Analysis TLS enforcement tests the original URL string with a case-sensitive `startsWith("http://")` comparison rather than checking the parsed URL protocol. A URL such as `HTTP://api.github.com/...` can be accepted by the URL parser while bypassing this comparison. If its hostname is allowlisted, the action may receive a risk score of zero and be returned as `ALLOW`. The configured HTTP method allowlist is also not enforced as an allowlist. A non-allowlisted method only appends a reason. The risk scorer adds risk for `DELETE` ...[truncated 1365 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/evaluate.ts:90

Finding

Workspace file jail can be bypassed through symbolic links

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/normalize.ts:42

Finding

Unsupported action types are allowed without policy evaluation

Content

View full analysis

= threshold && !confirmed) { return finalize( "NEED_CONFIRMATION", risk, sanitized, reasons, input, policy, { required: true, prompt: `This action is risky (riskScore=${risk.toFixed(2)}). Confirm to proceed.` } ); } return finalize("ALLOW", risk, sanitized, reasons, input, policy); ``` ### Technical Analysis Only `http_request`, `file_read`, `file_write`, and `exec` receive specialized policy checks. Any other type is preserved as a generic object. The risk scorer has no default penalty or denial branch for unsupported types, so the risk value remains zero unless another incidental rule applies. This creates a fail-open authorization model. It is especially dangerous if a downstream dispatcher supports action types not known to this evaluator or interprets attacker-controlled fields independently. The flaw does not directly execute arbitrary actions in this repository. Exploitation depends on an integration that treats `ALLOW` as authorization and dispatches the unsupported type. ...[truncated 831 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/evaluate.ts:73

Finding

Outbound secret-denial control scans data only after secret removal

Content

View full analysis

{ let changed = s; for (const r of rules) { const re = new RegExp(r.pattern, "g"); if (re.test(changed)) { changed = changed.replace(re, "[REDACTED]"); reasons.push({ ruleId: "secrets.redact.regex", message: `Redacted pattern: ${r.name}` }); } } return changed; }; ``` ```ts export function detectSecretsInOutbound(action: any, policy: Policy): boolean { const rules = policy.secrets?.redactRegex ?? []; const s = JSON.stringify(action ?? {}); for (const r of rules) { const re = new RegExp(r.pattern, "g"); if (re.test(s)) return true; } return false; } ``` ### Technical Analysis The configured secret patterns are replaced with `[REDACTED]` before `detectSecretsInOutbound` runs. Detection ...[truncated 1914 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Missing User Warnings

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill declares execution of a highly destructive command without any warning, consent, or confirmation metadata. A user or calling system could trigger irreversible deletion without understanding the consequences, making accidental or abusive execution extremely dangerous.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

- Exfiltration to unknown domains
- Prompt-injection “send secrets” attempts (secret detection + redaction)
- Reading sensitive local files (`~/.ssh`, `~/.aws`, `.env`, etc.)
- Unsafe execution patterns (`rm -rf`, `curl | sh`, etc.)

---

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · policy.yaml (reported line 42)May include surrounding context.

yaml

- Exfiltration to unknown domains
- Prompt-injection “send secrets” attempts (secret detection + redaction)
- Reading sensitive local files (`~/.ssh`, `~/.aws`, `.env`, etc.)
- Unsafe execution patterns (`rm -rf`, `curl | sh`, etc.)

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

"headers": { "authorization": "Bearer ..." },
    "body": "...",
    "path": "./reports/out.json",
    "command": "rm -rf /"
  },
  "context": {
    "workspaceRoot": "/workspace",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

"headers": { "authorization": "Bearer ..." },
    "body": "...",
    "path": "./reports/out.json",
    "command": "rm -rf /"
  },
  "context": {
    "workspaceRoot": "/workspace",

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest defines an unrestricted exec action that directly runs a destructive system command. Because there are no activation constraints, scope limits, or safety gates, this could be invoked in contexts far beyond the intended workspace and result in catastrophic deletion of system or user data.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This duplicate finding points to the same rm -rf / payload embedded as the executable command. Its presence as an active parameter to an exec tool makes the skill inherently unsafe and capable of severe destructive impact if run.

Content

Scanner excerpt · examples/exec-deny.json (reported line 4)May include surrounding context.

json

{
  "action": {
    "type": "exec",
    "command": "rm -rf /"
  },
  "context": {
    "workspaceRoot": "/workspace",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This duplicate finding points to the same rm -rf / payload embedded as the executable command. Its presence as an active parameter to an exec tool makes the skill inherently unsafe and capable of severe destructive impact if run.

Content

Scanner excerpt · examples/exec-deny.json (reported line 4)May include surrounding context.

json

{
  "action": {
    "type": "exec",
    "command": "rm -rf /"
  },
  "context": {
    "workspaceRoot": "/workspace",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The skill explicitly attempts to read a highly sensitive private key file from the user's home directory, which is outside the declared workspace root. Accessing ~/.ssh/id_rsa can expose SSH credentials that enable unauthorized access to other systems, and the 'strict' context does not mitigate the danger because the requested action itself targets a secret credential file.

Content

Scanner excerpt · examples/file-deny-sensitive.json (reported line 4)May include surrounding context.

json

{
  "action": {
    "type": "file_read",
    "path": "~/.ssh/id_rsa"
  },
  "context": {
    "workspaceRoot": "/workspace",

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The configuration contains a hard-coded API key in the request headers, which exposes a credential directly in the skill definition. Even if the shown value may be placeholder-like, embedding secrets in versioned configuration is unsafe because they can be leaked, reused accidentally, or normalized into real credentials later; combined with an outbound request to an external domain, this increases the chance of unintended credential disclosure.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · policy.yaml (reported line 27)May include surrounding context.

yaml

allowReadGlobs: ["**/*.md", "**/*.txt", "**/*.json"]
  allowWriteGlobs: ["**/*.md", "**/*.json", "reports/**"]
  denyPathGlobs:
    - "**/.env"
    - "**/*id_rsa*"
    - "**/*credentials*"
    - "**/*secret*"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

"action": {
    "type": "http_request | file_read | file_write | exec",
    "method": "GET|POST|PUT|DELETE",
    "url": "https://api.github.com/...",
    "headers": { "authorization": "Bearer ..." },
    "body": "...",
    "path": "./reports/out.json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The file defines an outbound HTTP request to an external domain and includes a bearer token in the Authorization header. Even though the destination is GitHub, embedding credentials in a skill action risks secret leakage, unintended data transmission, and reuse of hardcoded tokens if the request is executed or copied into production workflows.

Content

Scanner excerpt · examples/http-allow.json (reported line 10)May include surrounding context.

json

"action": {
    "type": "http_request",
    "method": "GET",
    "url": "https://api.github.com/repos/octocat/Hello-World",
    "headers": {
      "authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.abc.def"
    }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json

"prepack": "npm run build"
  },
  "dependencies": {
    "js-yaml": "^4.1.0",
    "minimatch": "^9.0.5"
  },
  "devDependencies": {

Unverifiable Dependency: js-yaml has 11 known advisory(ies) (CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); GHSA-2pr6-76vf-7546 (Denial of Service in js-yaml); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption) +8 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json

},
  "dependencies": {
    "js-yaml": "^4.1.0",
    "minimatch": "^9.0.5"
  },
  "devDependencies": {
    "@types/node": "^22.10.7",

Unverifiable Dependency: minimatch has 5 known advisory(ies) (CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja) +2 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"minimatch": "^9.0.5"
  },
  "devDependencies": {
    "@types/node": "^22.10.7",
    "ts-node": "^10.9.2",
    "typescript": "^5.7.3"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^22.10.7",
    "ts-node": "^10.9.2",
    "typescript": "^5.7.3"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"devDependencies": {
    "@types/node": "^22.10.7",
    "ts-node": "^10.9.2",
    "typescript": "^5.7.3"
  }
}

Static analysis

No suspicious patterns detected.