Claw Permission Firewall

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:43 AM UTC
• Version: 1.0.0

Overview

This is a security policy evaluator; the dangerous-looking commands, secrets, and file paths are example inputs meant to be blocked or redacted, not actions the skill executes.

Install only if you understand this is a policy decision helper, not a complete enforcement boundary. Configure policy.yaml for your environment, execute only sanitizedAction after an ALLOW decision, fail closed on unexpected action types or evaluator errors, and keep dependencies patched.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest defines a network request that can fetch and potentially act on remote content, but it provides no trigger scope, activation constraints, or user-consent boundaries. In this file, that risk is amplified by the request targeting a raw GitHub install script and including a hard-coded API key header, creating a broad, potentially abusable outbound request capability with unclear invocation conditions.

External Transmission

Medium

• Category: Data Exfiltration

Content

"action": {
    "type": "http_request",
    "method": "GET",
    "url": "https://api.github.com/repos/octocat/Hello-World",
    "headers": {
      "authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.abc.def"
    }

• Confidence: 90% confidence
• Finding: The file defines an outbound HTTP request to an external domain and includes an Authorization bearer token in the headers. Even though the destination is GitHub over HTTPS and the request appears demo-like, this still represents transmission of credentials to an external service and could normalize or enable token exfiltration if reused with real secrets.

Credential Access

High

• Category: Privilege Escalation

Content

{
  "action": {
    "type": "file_read",
    "path": "~/.ssh/id_rsa"
  },
  "context": {
    "workspaceRoot": "/workspace",

• Confidence: 99% confidence
• Finding: The skill is explicitly configured to read ~/.ssh/id_rsa, which is a highly sensitive private SSH key file used for authentication. Attempting to access credentials outside the declared workspace is unnecessary for normal workspace-scoped operation and could enable credential theft, unauthorized remote access, or lateral movement if the key is exfiltrated.

Known Vulnerable Dependency: js-yaml==4.1.0 — 2 advisory(ies): CVE-2026-53550 (JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases); CVE-2025-64718 (js-yaml has prototype pollution in merge (<<))

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The package declares js-yaml 4.1.0, which is flagged for prototype pollution and quadratic-complexity DoS issues. In a skill that explicitly ships a policy.yaml file and likely parses YAML as part of a permission firewall, attacker-controlled or untrusted YAML input could trigger denial of service or unsafe object property mutation, making this more relevant than in a package that never parses YAML.

Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The package declares minimatch 9.0.5, which is reported as vulnerable to multiple ReDoS conditions. Because this skill is a runtime permission firewall that likely evaluates file, HTTP, or execution rules against patterns, hostile inputs or crafted policy patterns could force expensive backtracking and cause denial of service in the enforcement path, undermining availability of the security control itself.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{
  "action": {
    "type": "exec",
    "command": "rm -rf /"
  },
  "context": {
    "workspaceRoot": "/workspace",

• Confidence: 98% confidence
• Finding: This finding is a duplicate match on the same command string and still points to the same underlying issue: direct execution of `rm -rf /`. The surrounding context does not mitigate the risk; `workspaceRoot` and `strict` mode do not automatically constrain a raw shell command, so the skill remains capable of destructive behavior if invoked.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{
  "action": {
    "type": "exec",
    "command": "rm -rf /"
  },
  "context": {
    "workspaceRoot": "/workspace",

• Confidence: 98% confidence
• Finding: This finding is a duplicate match on the same command string and still points to the same underlying issue: direct execution of `rm -rf /`. The surrounding context does not mitigate the risk; `workspaceRoot` and `strict` mode do not automatically constrain a raw shell command, so the skill remains capable of destructive behavior if invoked.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.