Clawguard Release

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:21 AM UTC
• Version: 1.8.0

Overview

ClawGuard is mostly a local proof tool, but it also includes under-scoped host security scanning and cleanup behavior that can inspect or delete local data beyond the proof workflow.

Review carefully before installing. Use only if you are comfortable with a proof tool that can also inspect local OS/network state, and avoid the clean command unless the working directory is disposable. Do not rely on the legal, ISO, malware-safety, or ransomware-integrity claims until the proof validation, scan logic, and user warnings are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: ransomware_protection.py:66
• Finding: File integrity verification accepts altered files without comparing hashes<![CDATA[ ## Vulnerability Details **File Location**: `ransomware_protection.py:66-84` **Vulnerability Type**: Improper integrity validation **Risk Level**: High ### Vulnerable Code ```python try: sha256 = hashlib.sha256() with open(filepath, 'rb') as f: for chunk in iter(lambda: f.read(8192), b''): sha256.update(chunk) current_hash = sha256.hexdigest().upper()[:16] # Load the original proof proof_list = load_proof_list() if original_proof_id in str(proof_list): # Simplified verification: should actually compare hashes result["verified"] = True result["message"] = "File integrity verification passed" result["current_hash"] = current_hash else: result["message"] = "Original proof record not found" except Exception as e: result["message"] = f"Verification failed: {str(e)}" ``` ### Technical Analysis The function calculates the current file hash but never compares it with the hash recorded when the proof was created. Instead, it marks the file as verified whenever the supplied proof identifier appears anywhere in the proof-list representation. Proof existence and file integrity are separate security properties. The existence of a proof identifier does not demonstrate that the current file has the same content as the originally proven file. The implementation consequently provides a false-positive integrity result for modified, substituted, or ransomware-encrypted files. Using only the first 16 hexadecimal characters of SHA-256 also reduces the effective digest from 256 bits to 64 bits. Although this is not the primary bypass, full SHA-256 values should be retained for security-sensitive integrity checks. ### Attack Path 1. An attacker or user obtains any proof identifier present in the local proof list. 2. The protected file is modified, replaced, corrupted, or encrypted. 3. `verify_file_integrity()` is called with the altered file and the existing proof identifie ...[truncated 677 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store a complete SHA-256 digest in a structured proof record at proof-creation time. 2. Retrieve the exact record associated with `original_proof_id`; do not search a string representation. 3. Recalculate the complete SHA-256 digest of the current file. 4. Compare the two digests using exact equality, preferably `hmac.compare_digest()`. 5. Return success only if the proof exists, the record is structurally valid, and both hashes match. 6. Distinguish between `proof_not_found`, `hash_mismatch`, `file_unreadable`, and `verified` results. 7. Add tests covering modified files, substituted files, invalid proof IDs, malformed records, and hash mismatches. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scan_files.py:103
• Finding: Files are classified as proven and safe solely by filename<![CDATA[ ## Vulnerability Details **File Location**: `scan_files.py:103-121` **Vulnerability Type**: Trust decision based on non-unique metadata **Risk Level**: High ### Vulnerable Code ```python # Check whether the file has been proven by matching its filename filename = os.path.basename(filepath) is_proven = filename in proof_list proof_id = proof_list.get(filename, "") # Proven file, treated as trusted if is_proven: results["proven_files"].append({ "path": filepath, "type": get_file_type(ext), "size": format_size(file_size), "proof_id": proof_id, "status": "proven" }) results["safe_files"] += 1 # High-risk file elif ext in HIGH_RISK_EXTENSIONS: results["high_risk"].append({ "path": filepath, "type": get_file_type(ext), "size": format_size(file_size), "risk": "high" }) ``` ### Technical Analysis The scanner determines proof status using only the basename of a file. It does not compare the current file's content hash with the digest associated with the proof. It also does not account for full paths, allowing unrelated files in different directories to share the same proof status. Because the proof check occurs before extension-based risk classification, a filename match suppresses subsequent high-risk or medium-risk checks. More fundamentally, an ownership proof is not evidence that a file is free of malware. Even an exact hash match should indicate only that the content matches the proven artifact, not that the artifact is safe to execute. ### Attack Path 1. A benign file is registered under a particular filename. 2. The benign file is replaced with malicious or modified content while retaining the same basename. 3. Alternatively, a different file with the same basename is placed elsewhere in the scanned directory tree. 4. The file scanner loads the filename-to-proof mapping. 5. The malicious file's basename matches the stored name. 6. The scanner classifies ...[truncated 511 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store proof records in a structured format containing the proof ID, complete content hash, canonical path where relevant, owner, and timestamp. 2. Calculate the current file's complete SHA-256 digest and require an exact match with the selected proof record. 3. Do not use basenames as unique identifiers. 4. Continue security classification even when a file has a valid proof. 5. Report independent properties such as `proof_match: true` and `malware_risk: high` rather than treating proof status as safety. 6. Add regression tests for same-name files, replaced content, duplicate basenames across directories, and proven executable files. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: init.py:338
• Finding: Proof verification accepts partial identifiers through substring matching<![CDATA[ ## Vulnerability Details **File Location**: `init.py:338-359` **Vulnerability Type**: Improper proof-record validation **Risk Level**: High ### Vulnerable Code ```python def verify_proof(proof_id: str): # 1. Format check if not isinstance(proof_id, str): return {"valid": False, "msg": "Invalid proof type"} if not proof_id.startswith("BH-"): return {"valid": False, "msg": "Invalid proof prefix (must start with BH-)"} parts = proof_id.split("-") if len(parts) < 3: return {"valid": False, "msg": "Invalid proof format (must be BH-XXXX-YYYY)"} # 2. Chain verification try: if not os.path.exists(CHAIN_FILE): return {"valid": False, "msg": "Chain file not found"} with open(CHAIN_FILE, "r", encoding="utf-8") as f: chain_content = f.read() if proof_id in chain_content: return {"valid": True, "msg": BH_OFFICIAL_TAG, "root": BH_ROOT_ID} else: return {"valid": False, "msg": "Proof not found in chain"} except Exception as e: return {"valid": False, "msg": f"Chain verification failed: {str(e)}"} ``` ### Technical Analysis The verifier reads the complete chain as unstructured text and checks whether the supplied identifier occurs as a substring. The format validation only requires a `BH-` prefix and at least three hyphen-delimited components. It does not enforce the exact length or allowed structure of the generated root and content-hash components. A partial identifier that appears inside a valid stored identifier can therefore pass verification. The function also does not call `verify_chain_integrity()` before declaring the proof valid, so presence in a malformed or tampered chain may still be treated as sufficient. ### Attack Path 1. An attacker obtains or observes a legitimate proof identifier. 2. The attacker constructs a shorter value beginning with `BH-` and containing at least three componen ...[truncated 592 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define and enforce the exact proof-ID format with a full-match regular expression. 2. Parse each chain block into explicit fields instead of searching raw text. 3. Compare the submitted identifier only with the complete proof-ID field. 4. Call `verify_chain_integrity()` and reject verification if the chain is malformed or cryptographically inconsistent. 5. Reject duplicate, truncated, malformed, or whitespace-padded identifiers. 6. Add tests demonstrating that every proper prefix and substring of a valid ID is rejected. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scan_network.py:166
• Finding: Suspicious network connection scan always returns a passing result<![CDATA[ ## Vulnerability Details **File Location**: `scan_network.py:166-185` **Vulnerability Type**: Fail-open security assessment **Risk Level**: Medium ### Vulnerable Code ```python def check_suspicious_connections(): """Check suspicious connections""" try: cmd = 'powershell -Command "Get-NetTCPConnection | Select-Object RemoteAddress,State"' result = subprocess.run( cmd, shell=True, capture_output=True, text=True, timeout=10 ) # Simplified check: no obvious anomaly was found return { "name": "Suspicious connections", "status": "pass", "message": "No suspicious connections found", "recommendation": "" } except: return { "name": "Suspicious connections", "status": "warning", "message": "Unable to check connections", "recommendation": "Manually inspect network connections" } ``` ### Technical Analysis The PowerShell output is never parsed or evaluated. If the process call completes without raising an exception, the function returns a passing status regardless of the remote addresses, connection states, or command exit status. `subprocess.run()` does not raise an exception for a nonzero exit code unless `check=True` is supplied. Consequently, even a failed PowerShell command may be interpreted as evidence that no suspicious connection exists. ### Attack Path 1. A host has a malicious or otherwise suspicious active network connection. 2. The user runs the network security scan. 3. PowerShell enumerates the connections. 4. The function ignores the resulting addresses and states. 5. The function returns `status: pass`. 6. The aggregate network score incorporates the false passing result. ### Impact Assessment The issue does not directly provide additional privileges. It conceals network compromise indicators from the genera ...[truncated 134 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Run PowerShell without `shell=True` by passing an argument list. 2. Use `check=True` or explicitly validate `result.returncode`. 3. Parse connection records into structured objects. 4. Define documented, evidence-based suspicious conditions rather than unconditionally passing. 5. Return `unknown` when the command fails or evidence is inconclusive. 6. Exclude `unknown` checks from passing-score calculations. 7. Log the basis for each warning without exposing unnecessary network details. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scan_os.py:75
• Finding: Windows update check assumes the system is secure without evaluating update state<![CDATA[ ## Vulnerability Details **File Location**: `scan_os.py:75-94` **Vulnerability Type**: Fail-open security assessment **Risk Level**: Medium ### Vulnerable Code ```python def check_windows_update(): """Check Windows update status""" try: cmd = 'powershell -Command "Get-WindowsUpdateLog -ErrorAction SilentlyContinue; (Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update).LastSuccessSyncTime"' result = subprocess.run( cmd, shell=True, capture_output=True, text=True, timeout=30 ) # Simplified check: assume the system is updated return { "name": "System updates", "status": "pass", "message": "System update status is normal", "recommendation": "Keep automatic updates enabled" } except Exception as e: return { "name": "System updates", "status": "warning", "message": f"Unable to check update status: {str(e)}", "recommendation": "Manually inspect Windows Update" } ``` ### Technical Analysis The function does not inspect the command output, the last successful synchronization timestamp, available updates, installed patch levels, or the subprocess return code. Completion of the process call is treated as proof that the operating system is up to date. Because `check=True` is not set, a nonzero PowerShell exit code does not enter the exception handler. An unavailable command or failed registry query can therefore still produce a passing assessment. ### Attack Path 1. A Windows host is missing security updates or the update query fails. 2. The user invokes the operating-system or full scan. 3. The PowerShell command completes or returns a nonzero status without raising an exception. 4. The function ignores all output and status information. 5. The system is reported as having a normal ...[truncated 359 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use supported Windows APIs or PowerShell cmdlets that return structured update information. 2. Validate `result.returncode` and treat query failures as `unknown`, not `pass`. 3. Parse the last successful update and synchronization times. 4. Check for pending security updates and stale patch status against a documented policy. 5. Avoid generating a passing score when update state cannot be established. 6. Add tests for outdated systems, missing registry values, unavailable PowerShell, timeouts, and nonzero return codes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scan_network.py:75
• Finding: Open-port scan unconditionally marks discovered listening ports as safe<![CDATA[ ## Vulnerability Details **File Location**: `scan_network.py:75-101` **Vulnerability Type**: Incorrect security-state classification **Risk Level**: Medium ### Vulnerable Code ```python def check_open_ports(): """Check open ports""" common_ports = [80, 443, 8080, 3306, 5432] try: cmd = 'powershell -Command "Get-NetTCPConnection -State Listen | Select-Object LocalPort"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10) open_ports = [] for line in result.stdout.split('\n'): line = line.strip() if line.isdigit(): port = int(line) if port < 1024: open_ports.append(port) return { "name": "Open ports", "status": "pass", "message": f"Open ports: {', '.join(map(str, open_ports[:10])) or 'none'}", "recommendation": "" } except: return { "name": "Open ports", "status": "warning", "message": "Unable to check port status", "recommendation": "Manually inspect network settings" } ``` ### Technical Analysis The function always returns `pass` after parsing, even when sensitive or unexpected listening ports are discovered. The declared `common_ports` list is unused, ports at or above 1024 are ignored, and no owning process, bind address, firewall exposure, or service policy is considered. As with the other subprocess-based checks, nonzero return codes are not validated. The scan therefore cannot reliably distinguish a safe listening configuration from an exposed service. ### Attack Path 1. A host exposes an unnecessary or vulnerable listening service. 2. The user invokes the network scan. 3. The function collects some listening ports but applies no risk policy. 4. It unconditionally returns `status: pass`. 5. The generated report indicates that the open-port check passed. 6. T ...[truncated 312 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the subprocess return code and return `unknown` on collection failure. 2. Parse all listening ports, bind addresses, and owning processes. 3. Compare results against an explicit user- or administrator-defined allowlist. 4. Distinguish loopback-only listeners from externally reachable services. 5. Flag unexpected database, remote-management, file-sharing, and legacy protocol ports. 6. Remove the unused `common_ports` variable or apply it as part of a documented policy. 7. Never return `pass` solely because enumeration completed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scan_network.py:75
• Finding: Host security and network reconnaissance exceeds the core proof operation<![CDATA[ ## Vulnerability Details **File Location**: `scan_network.py:75-191` **Vulnerability Type**: Broad local environment reconnaissance **Risk Level**: Low ### Vulnerable Code ```python cmd = 'powershell -Command "Get-NetTCPConnection -State Listen | Select-Object LocalPort"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10) cmd = 'powershell -Command "Get-NetTCPConnection | Measure-Object | Select-Object -ExpandProperty Count"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10) cmd = 'powershell -Command "Get-DnsClientServerAddress | Select-Object -ExpandProperty ServerAddresses"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10) cmd = 'powershell -Command "Get-NetTCPConnection | Select-Object RemoteAddress,State"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10) cmd = 'powershell -Command "(netsh wlan show interfaces) -match \'Authentication\'"' result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10) ``` Related operating-system enumeration in `scan_os.py:79-192` includes firewall profiles, antivirus state, listening ports, Windows Update information, and process names. ### Technical Analysis The skill can enumerate listening ports, active connections, remote addresses, DNS servers, Wi-Fi authentication, firewall state, antivirus state, update status, and running process names. These operations create a detailed security profile of the local host. The functionality is represented in `skill.json` as system and network scanning, so it is not covert. However, it is broader than the proof-focused capabilities described in `SKILL.md` and should not be executed as part of an unrelated proof operation. No transmission of the collected information to an external destination was found during the audit. ### Attack Path 1. A caller invokes the network, operating-system, or full scan. 2 ...[truncated 729 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Separate digital-proof functionality from host-audit functionality into distinct, permission-scoped modules. 2. Require explicit user consent before each operating-system or network scan. 3. Document every category of collected host information in `SKILL.md`, not only in package metadata. 4. Never invoke reconnaissance during proof creation, verification, certificate generation, or unrelated commands. 5. Return only the minimum information needed for the requested assessment. 6. Redact remote addresses, process details, and other sensitive fields unless the user explicitly requests them. 7. Record whether each check requires elevated privileges and avoid requesting elevation automatically. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: init.py:363
• Finding: Cleanup command recursively deletes common directories outside a skill-owned root<![CDATA[ ## Vulnerability Details **File Location**: `init.py:363-371` **Vulnerability Type**: Unsafe recursive deletion **Risk Level**: High ### Vulnerable Code ```python def clean_all(): targets = ["__pycache__", "logs", "cache", "tmp", "temp"] removed = [] for d in targets: if os.path.isdir(d): shutil.rmtree(d, ignore_errors=True) removed.append(d) return removed ``` ### Technical Analysis The cleanup targets are relative paths resolved against the process's current working directory. They are not restricted to `DATA_DIR`, the package directory, or another skill-owned location. Names such as `logs`, `cache`, `tmp`, and `temp` are common legitimate project directories. The function recursively removes each matching directory without preview, ownership validation, confirmation, or recovery support. `ignore_errors=True` additionally suppresses deletion failures, making it difficult to provide an accurate audit trail of what was removed. ### Attack Path 1. The skill is launched with a working directory belonging to another project or user workflow. 2. That directory contains legitimate `logs`, `cache`, `tmp`, `temp`, or `__pycache__` directories. 3. The user or calling agent invokes the `clean` command. 4. `clean_all()` resolves the target names against the current working directory. 5. `shutil.rmtree()` recursively removes the matching directories. 6. Unrelated data is destroyed without confirmation. ### Impact Assessment The function does not grant additional privileges; deletion is limited to locations writable by the current process. Within those privileges, however, it can destroy arbitrary unrelated content stored under the targeted directory names. The scope depends on the process working directory and can include project logs, build caches, temporary work products, or application state. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve cleanup targets beneath a fixed, absolute skill-owned directory. 2. Canonicalize each target with `Path.resolve()` and verify that it remains under the approved root. 3. Never delete generic working-directory names such as `logs`, `tmp`, or `cache`. 4. Present a deletion preview and require explicit confirmation for recursive operations. 5. Consider deleting only files created and tracked by this skill. 6. Remove `ignore_errors=True`; record individual failures accurately. 7. Add tests that run the skill from an unrelated working directory and verify that external directories remain untouched. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (64)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Windows security scanning, PowerShell execution, firewall and antivirus inspection, network port enumeration, and process inspection are unrelated to the declared asset-proof use case. In this context, the mismatch strongly suggests covert reconnaissance capability, making the skill far more dangerous than the description implies.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Windows security scanning, PowerShell execution, firewall and antivirus inspection, network port enumeration, and process inspection are unrelated to the declared asset-proof use case. In this context, the mismatch strongly suggests covert reconnaissance capability, making the skill far more dangerous than the description implies.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Windows security scanning, PowerShell execution, firewall and antivirus inspection, network port enumeration, and process inspection are unrelated to the declared asset-proof use case. In this context, the mismatch strongly suggests covert reconnaissance capability, making the skill far more dangerous than the description implies.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Windows security scanning, PowerShell execution, firewall and antivirus inspection, network port enumeration, and process inspection are unrelated to the declared asset-proof use case. In this context, the mismatch strongly suggests covert reconnaissance capability, making the skill far more dangerous than the description implies.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Windows security scanning, PowerShell execution, firewall and antivirus inspection, network port enumeration, and process inspection are unrelated to the declared asset-proof use case. In this context, the mismatch strongly suggests covert reconnaissance capability, making the skill far more dangerous than the description implies.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The clean_all function recursively deletes directories such as __pycache__, logs, cache, tmp, and temp using shutil.rmtree. Although the command returns the removed names afterward, there is no prior confirmation, prompt, or warning before performing this irreversible filesystem action.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest frames the skill as an offline-first digital asset proof system with local blockchain and format support, which suggests evidence/provenance functionality. In contrast, the code exposes commands for file security scanning, operating system security checks, network scanning, and a combined scan mode, which is a substantially different product behavior.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The CLI explicitly offers operating system and network security scans, and `all` invokes both in addition to file scanning. Those capabilities are not an obvious or necessary implementation detail of a digital asset proof system, especially one described as offline-first and focused on proofing assets.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file performs broad host network reconnaissance even though the skill metadata describes a digital-asset proof/blockchain function, not local security auditing. That mismatch is dangerous because users or calling systems may grant trust or permissions based on the declared purpose while the code collects unrelated sensitive host information.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill launches shell/PowerShell commands to enumerate host network state without clear justification from the manifest. In an agent environment, this can expose local system details such as listening services and network posture, creating privacy and reconnaissance risk beyond the skill's stated purpose.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

common_ports = [80, 443, 8080, 3306, 5432]
    try:
        cmd = 'powershell -Command "Get-NetTCPConnection -State Listen | Select-Object LocalPort"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        
        open_ports = []
        for line in result.stdout.split('\n'):

• Confidence: 90% confidence
• Finding: Using subprocess.run with shell=True grants the shell authority to interpret the command, which is an unsafe execution pattern in agent tools even when the current string is constant. In hostile or misconfigured environments, shell resolution, PATH hijacking, or future code changes that add variable input can turn this into command-execution abuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

"""检查网络连接"""
    try:
        cmd = 'powershell -Command "Get-NetTCPConnection | Measure-Object | Select-Object -ExpandProperty Count"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        
        count = int(result.stdout.strip()) if result.stdout.strip().isdigit() else 0

• Confidence: 90% confidence
• Finding: This tool call uses shell=True for a host-enumeration command, which is an unsafe primitive for an agent skill. Even without immediate injection, the pattern enables shell-mediated execution behavior that can be abused via environment manipulation or later modifications.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

trusted_dns = ['114.114.114.114', '8.8.8.8', '1.1.1.1', '223.5.5.5']
    try:
        cmd = 'powershell -Command "Get-DnsClientServerAddress | Select-Object -ExpandProperty ServerAddresses"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        
        dns_servers = result.stdout.strip().split('\n')
        is_trusted = any(dns in str(dns_servers) for dns in trusted_dns)

• Confidence: 90% confidence
• Finding: The DNS inspection command is executed through shell=True, exposing unnecessary shell semantics for a task that does not require them. In agent contexts this is dangerous because it normalizes risky command execution and increases the chance of abuse through environmental control or future parameterization.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

"""检查可疑连接"""
    try:
        cmd = 'powershell -Command "Get-NetTCPConnection | Select-Object RemoteAddress,State"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        
        # 简单检查：未发现明显异常
        return {

• Confidence: 90% confidence
• Finding: Running the suspicious-connection check through shell=True uses a high-risk tool parameter for local host enumeration. Combined with the misleading success result, this creates both execution-surface risk and deceptive security signaling.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

"""检查 WiFi 安全"""
    try:
        cmd = 'powershell -Command "(netsh wlan show interfaces) -match \'Authentication\'"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        
        if "WPA3" in result.stdout:
            return {

• Confidence: 90% confidence
• Finding: This Wi-Fi inspection relies on shell=True, which is an unnecessarily permissive execution mode for collecting host network details. In an agent skill, such patterns are risky because they can be repurposed or become exploitable when the environment or command source changes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file performs host operating-system security scanning even though the declared skill purpose is a digital asset proof system. This capability mismatch is dangerous because it expands access to sensitive host-state information without a clear, user-justified need, making the skill more suspicious in context.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

try:
        # PowerShell 检查最后更新时间
        cmd = 'powershell -Command "Get-WindowsUpdateLog -ErrorAction SilentlyContinue; (Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update).LastSuccessSyncTime"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        
        # 简化检查：假设系统已更新
        return {

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

try:
        # PowerShell 检查最后更新时间
        cmd = 'powershell -Command "Get-WindowsUpdateLog -ErrorAction SilentlyContinue; (Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update).LastSuccessSyncTime"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        
        # 简化检查：假设系统已更新
        return {

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

try:
        # PowerShell 检查最后更新时间
        cmd = 'powershell -Command "Get-WindowsUpdateLog -ErrorAction SilentlyContinue; (Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update).LastSuccessSyncTime"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        
        # 简化检查：假设系统已更新
        return {

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

try:
        # PowerShell 检查最后更新时间
        cmd = 'powershell -Command "Get-WindowsUpdateLog -ErrorAction SilentlyContinue; (Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update).LastSuccessSyncTime"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        
        # 简化检查：假设系统已更新
        return {

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

try:
        # PowerShell 检查最后更新时间
        cmd = 'powershell -Command "Get-WindowsUpdateLog -ErrorAction SilentlyContinue; (Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update).LastSuccessSyncTime"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        
        # 简化检查：假设系统已更新
        return {

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Enumerating listening ports and local processes gives the skill visibility into host security posture and running tools, which is unrelated to a digital asset proof workflow. In this context, such reconnaissance-like behavior is more dangerous because it could be repurposed to fingerprint defenses or discover security tooling on the machine.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

message": "未发现开放的高危端口",
                "recommendation": ""
            }
    except:
        return {
            "name": "高危端口",
            "status": "warning",
            "message": "无法检查端口状态",
            "recommendation": "手动检查网络设置"
        }

def check_suspicious_processes():
    """检查异常进程"""
    suspicious_names = ['mimikatz', 'pwdump', 'procdump']
    try:
        cmd = 'powershell -Command "Get-Process | Select-Object ProcessName"'
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
        
        found = []
        for name in suspicious_names:
            if name.lower() in result.stdout.lower():
                found.append(name)
        
        if found:
            return {
                "name": "异常进程",
                "status": "critical",
                "message": f"发现可疑进程：{', '.join(found)}",
                "recommendation": "

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file advertises `clean`, `backup`, and `restore` management commands, including cache cleaning and configuration restore, but provides no warning about potential data loss, overwriting, or the need to verify targets before use. For markdown files, safety-relevant behaviors that can affect user data or system integrity should be accompanied by user-facing warnings.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The document makes affirmative legal-compliance claims tied to PRC Copyright Law and recommends direct evidentiary use without clearly limiting the claim to a jurisdiction-specific context or adding a legal disclaimer. In a security/legal-proof skill, users may rely on these statements as authoritative and use the system in unsuitable jurisdictions or overestimate evidentiary weight, creating compliance, fraud, or legal-risk exposure.

Static analysis

No suspicious patterns detected.