ClawHub
Back to skill

Security audit

sentinel-proxy

Security checks for vulnerabilities and agentic risk

Overview

This security skill is coherent in purpose, but it sends broad prompt and tool content to a third-party service and relies on fail-open hooks, so users should review it carefully before installing.

Install only if you are comfortable sending prompts, tool arguments, and tool results to Sentinel for inspection. Use a tightly controlled environment, protect the Sentinel key, avoid processing regulated or secret-heavy data unless Sentinel's privacy and retention terms fit your needs, and prefer deployments that restrict or validate the API endpoint and define fail-closed behavior for sensitive workflows.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/scrub-pre-tool.sh:20
Finding

Unrestricted Disclosure of Prompts and Tool Content to a Third-Party Service

Content
View full analysis
/dev/null) if [[ -z "$content" ]]; then exit 0 fi payload=$(python3 -c " import json, sys print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]})) " "$content" "$SENTINEL_TIER") response=$(curl -sf \ -X POST "${SENTINEL_API_URL}/v1/scrub" \ -H "X-Sentinel-Key: ${SENTINEL_KEY}" \ -H "Content-Type: application/json" \ -d "$payload" 2>/dev/null) || exit 0 ``` From `scripts/scrub-pre-tool.sh:20-43`: ```bash # Serialize toolInput as JSON string for scrubbing tool_name=$(echo "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('toolName','unknown'))" 2>/dev/null || echo "unknown") content=$(echo "$input" | python3 -c " import sys, json d = json.load(sys.stdin) tool_input = d.get('toolInput', {}) # Serialize the full toolInput so Sentinel sees all parameters print(json.dumps(tool_input)) " 2>/dev/null) if [[ -z "$content" || "$content" == "{}" ]]; then exit 0 fi payload=$(python3 -c " import json, sys print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]})) " "$content" "$SENTINEL_TIER") response=$(curl -sf \ -X POST "${SENTINEL_API_URL}/v1/scrub" \ -H "X-Sentinel-Key: ${SENTINEL_KEY}" \ -H "Content-Type: application/json" \ -d "$payload" 2>/dev/null) || exit 0 ``` From `scripts/scrub-post-tool.sh:20-46`: ```bash tool_name=$(echo "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('toolName','unknown'))" 2>/dev/null || echo "unknown") content=$(echo "$input" | python3 -c " import sys, json d = json.load(sys.std ...[truncated 2428 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bootstrap.sh:5
Finding

Configurable API Endpoint Can Exfiltrate the Sentinel Key and Inspected Content

Content
View full analysis
&2 echo "[sentinel] Get a free key at https://sentinelaifirewall.com" >&2 exit 0 fi response=$(curl -sf -w "\n%{http_code}" \ -X POST "${SENTINEL_API_URL}/v1/scrub" \ -H "X-Sentinel-Key: ${SENTINEL_KEY}" \ -H "Content-Type: application/json" \ -d '{"content":"bootstrap-check"}' 2>/dev/null) || true ``` The same destination and credential pattern is used in each scanning hook. For example, `scripts/scrub-pre-tool.sh:39-43` contains: ```bash response=$(curl -sf \ -X POST "${SENTINEL_API_URL}/v1/scrub" \ -H "X-Sentinel-Key: ${SENTINEL_KEY}" \ -H "Content-Type: application/json" \ -d "$payload" 2>/dev/null) || exit 0 ``` ### Technical Analysis `SENTINEL_API_URL` is accepted directly from the process environment and used as the destination for authenticated requests. The code does not enforce HTTPS, validate the URL scheme, verify the destination hostname against an allowlist, reject embedded user information, or restrict unexpected ports. Any party capable of changing the environment or launch configuration can redirect requests to an attacker-controlled endpoint. Because the same request includes `X-Sentinel-Key` and the inspected content, endpoint redirection exposes both the service credential and sensitive agent data. If an unencrypted HTTP URL is supplied, network observers may also intercept the request. ### Attack Path 1. An attacker gains the ability to ...[truncated 1127 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/scrub-user-prompt.sh:34
Finding

Security Hooks Fail Open on Network Failures and Invalid API Responses

Content
View full analysis
/dev/null) || exit 0 # unreachable → pass through action=$(echo "$response" | python3 -c "import sys,json; print(json.load(sys.stdin)['security']['action_taken'])" 2>/dev/null || echo "clean") safe_payload=$(echo "$response" | python3 -c "import sys,json; print(json.load(sys.stdin)['safe_payload'])" 2>/dev/null || echo "$content") threat_score=$(echo "$response" | python3 -c "import sys,json; print(json.load(sys.stdin)['security']['threat_score'])" 2>/dev/null || echo "0") ``` From `scripts/scrub-pre-tool.sh:39-46`: ```bash response=$(curl -sf \ -X POST "${SENTINEL_API_URL}/v1/scrub" \ -H "X-Sentinel-Key: ${SENTINEL_KEY}" \ -H "Content-Type: application/json" \ -d "$payload" 2>/dev/null) || exit 0 action=$(echo "$response" | python3 -c "import sys,json; print(json.load(sys.stdin)['security']['action_taken'])" 2>/dev/null || echo "clean") threat_score=$(echo "$response" | python3 -c "import sys,json; print(json.load(sys.stdin)['security']['threat_score'])" 2>/dev/null || echo "0") ``` From `scripts/scrub-post-tool.sh:42-50`: ```bash response=$(curl -sf \ -X POST "${SENTINEL_API_URL}/v1/scrub" \ -H "X-Sentinel-Key: ${SENTINEL_KEY}" \ -H "Content-Type: application/json" \ -d "$payload" 2>/dev/null) || exit 0 action=$(echo "$response" | python3 -c "import sys,json; print(json.load(sys.stdin)['security']['action_taken'])" 2>/dev/null || echo "clean") safe_payload=$(echo "$response" | python3 -c "import sys,jso ...[truncated 3047 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

If the implementation only scans outbound tool inputs, omits tool-result processing, and fails open when the Sentinel key is missing or API calls fail, then the advertised security control can silently disappear exactly when needed. A fail-open security gateway is particularly dangerous because attackers can bypass protection through dependency failure while operators continue assuming the firewall is active.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

If the implementation only scans outbound tool inputs, omits tool-result processing, and fails open when the Sentinel key is missing or API calls fail, then the advertised security control can silently disappear exactly when needed. A fail-open security gateway is particularly dangerous because attackers can bypass protection through dependency failure while operators continue assuming the firewall is active.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

If the implementation only scans outbound tool inputs, omits tool-result processing, and fails open when the Sentinel key is missing or API calls fail, then the advertised security control can silently disappear exactly when needed. A fail-open security gateway is particularly dangerous because attackers can bypass protection through dependency failure while operators continue assuming the firewall is active.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill appears to require shell-capable setup and bootstrap behavior but does not declare any explicit tool scope or permissions. Undeclared capabilities weaken reviewability and can cause users or hosts to grant broader execution than expected, especially for a security-branded skill that users may trust by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The transparent proxy mode routes all LLM traffic through a third-party Sentinel endpoint, but the documentation does not clearly and prominently warn that prompts, tool-related content, and potentially sensitive data will be transmitted off-platform. This creates privacy, compliance, and data-handling risk because users may unknowingly send secrets or regulated data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill instructs users to redirect API traffic to an external Sentinel domain, which means model prompts and related content are transmitted to a third-party service. External transmission is not inherently malicious here, but in the context of an agent security product it becomes sensitive because users may send confidential prompts, credentials, or tool outputs through infrastructure they do not fully control.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

For complete protection — including scanning what your agent sends to external tools — route your LLM traffic through Sentinel's transparent proxy. Sentinel sits between Open Claw and the Anthropic API, scanning all content in both directions with zero changes to your agent code.

bash
export ANTHROPIC_BASE_URL=https://api.sentinelaifirewall.com/v1
export ANTHROPIC_API_KEY=sk_live_...   # your Sentinel key replaces your Anthropic key here

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 14)May include surrounding context.

sh
exit 0
fi

response=$(curl -sf -w "\n%{http_code}" \
  -X POST "${SENTINEL_API_URL}/v1/scrub" \
  -H "X-Sentinel-Key: ${SENTINEL_KEY}" \
  -H "Content-Type: application/json" \

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script prints that the 'AI Firewall' is active for inbound and outbound scanning after only a one-time connectivity check to /v1/scrub. This can create a false sense of protection: operators may believe enforcement is enabled when this script neither configures nor verifies any ongoing interception or scanning path.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This hook sends the full tool response content to an external Sentinel API for inspection. Because tool outputs can contain sensitive data from other tools, files, credentials, or user content, this creates a real data exfiltration path to a third party; additionally, the script fails open on missing key, curl failure, or parse errors, reducing the reliability of the security control. In the context of a post-tool scrubber, this is somewhat expected behavior, but it is still security-relevant because it exports potentially sensitive material off-host.

Content

Scanner excerpt · scripts/scrub-post-tool.sh (reported line 42)May include surrounding context.

sh
print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]}))
" "$content" "$SENTINEL_TIER")

response=$(curl -sf \
  -X POST "${SENTINEL_API_URL}/v1/scrub" \
  -H "X-Sentinel-Key: ${SENTINEL_KEY}" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script transmits the full serialized toolInput to an external API endpoint before a tool call. In this pre-tool context, toolInput can contain secrets, user data, credentials, or proprietary content, so the firewall itself becomes an outbound exfiltration path and expands the trust boundary to a third-party service. The risk is increased by fail-open behavior: if the API key is missing or the network request fails, the scan is skipped and the tool call is still allowed.

Content

Scanner excerpt · scripts/scrub-pre-tool.sh (reported line 39)May include surrounding context.

sh
print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]}))
" "$content" "$SENTINEL_TIER")

response=$(curl -sf \
  -X POST "${SENTINEL_API_URL}/v1/scrub" \
  -H "X-Sentinel-Key: ${SENTINEL_KEY}" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This script sends the raw inbound user prompt to an external third-party service for analysis. That creates a real data exfiltration/privacy boundary: prompts may contain secrets, proprietary data, credentials, or regulated information, and the script is explicitly designed to forward them off-box whenever the firewall is configured. In the context of a security filter, this behavior is expected, but it is still security-relevant because failure to minimize, gate, or disclose outbound data transfer can expose sensitive content.

Content

Scanner excerpt · scripts/scrub-user-prompt.sh (reported line 34)May include surrounding context.

sh
print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]}))
" "$content" "$SENTINEL_TIER")

response=$(curl -sf \
  -X POST "${SENTINEL_API_URL}/v1/scrub" \
  -H "X-Sentinel-Key: ${SENTINEL_KEY}" \
  -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.