Security audit

SoundClaw Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs a narrow readiness check, but it also directs users to run an unverified downloaded installer with sudo, which needs review before use.

Review this skill before installing. Its local readiness checks are narrow, but do not run the referenced installer as root unless you independently trust the SoundClaw release source and verify the exact downloaded archive through a checksum or signature from a trusted channel.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Unpinned External Release Bundle Is Invoked with Root Privileges
Content: View full analysis
.tar.gz` on the Raspberry Pi, extract it, and run the bundled installer wrapper from the extracted bundle root (`sudo ./install.sh --help` for options). The bundle already includes the ``` ### Technical Analysis The skill directs the operator to download an unspecified release archive from an external repository and invoke its bundled script through `sudo`. It does not identify a supported release version, pin an immutable archive URL or commit, require a cryptographic signature, or provide an expected checksum for the downloaded artifact. The package-level `checksums.txt` protects only the documentation files included in this skill. It does not authenticate the remotely downloaded release archive or its `install.sh` script. Although the suggested argument is `--help`, a shell script begins executing before it processes that argument; therefore, help-mode invocation cannot be assumed to be non-mutating or safe. No evidence establishes that the currently referenced repository or release bundles are malicious. The issue is an unsafe supply-chain trust boundary: the instructions permit externally hosted code that was not part of this audit to be selected dynamically and executed as root. ### Attack Path 1. An attacker compromises the referenced release repository, its publishing credentials, or a release artifact. 2. Alternatively, an operator selects an incorrect or tampered release because t ...[truncated 1013 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
and tell them to download and extract one `soundclaw-pi-release-<release-id>.tar.gz` bundle on the Raspberry Pi. The next install step should use the bundled wrapper from the extracted bundle root (`sudo ./install.sh --help` for options), which delegates to bundled pi-kit scripts under `repos/soundclaw-pi-kit/scripts/`. Then tell the operator to return to the same OpenClaw workspace and rerun the readiness check after the backend install completes.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/README.md (reported line 25)May include surrounding context.
md
and tell them to download and extract one `soundclaw-pi-release-<release-id>.tar.gz` bundle on the Raspberry Pi. The next install step should use the bundled wrapper from the extracted bundle root (`sudo ./install.sh --help` for options), which delegates to bundled pi-kit scripts under `repos/soundclaw-pi-kit/scripts/`. Then tell the operator to return to the same OpenClaw workspace and rerun the readiness check after the backend install completes.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill instructs the operator to download a release bundle from a public URL and run an installer with sudo, which elevates trust in externally obtained code without any mention of signature, checksum, provenance, or package authenticity verification. Even though the example only shows '--help', invoking an installer as root normalizes privileged execution of an unverified script and can lead to full host compromise if the bundle or distribution path is malicious or tampered with.
Content: Scanner excerpt · references/examples.md (reported line 18)May include surrounding context.
md
- If the marker is missing, point to the public `https://github.com/catholicbeer/soundclaw-release/releases` surface and tell the operator to download one `soundclaw-pi-release-<release-id>.tar.gz` bundle, run `sudo ./install.sh --help` from the extracted bundle root, then return to the same OpenClaw workspace after install. - If the marker is present, use that executable's `runtime status --json` command to decide whether the backend looks ready for normal use.