ClawHub
Back to skill

Security audit

Mode Switch Kit

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and mostly disclosed, but it can change VPN state and stop/start local processes with weak safeguards that could affect unrelated processes or connectivity.

Review the YAML carefully before use, run only selftests and dry runs first, and avoid running the switcher with administrator privileges. Do not schedule the watchdog or use real VPN/service commands until process ownership checks and VPN unknown-state handling are tightened, because a mode switch can disrupt connectivity or terminate unrelated local processes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
templates/modes_switch.py:387
Finding

Port-Only Service Identification Can Terminate Unrelated Processes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
templates/modes_switch.py:274
Finding

Weak PID-File Validation Can Target Reused or Attacker-Selected Processes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
templates/modes_switch.py:326
Finding

VPN Status Failures Are Incorrectly Treated as a Disconnected State

Content
View full analysis
requested") if desired == "on": time.sleep(int(vpn.get("settle_s") or 0)) ``` ### Technical Analysis VPN state has at least three meaningful values: connected, disconnected, and unknown. The implementation collapses unknown into disconnected by returning `False` whenever the status command raises an exception. It also does not inspect `out.returncode`. A VPN status command that exits unsuccessfully but produces no connected marker is likewise interpreted as disconnected. This contradicts the project's own documented safety requirement that a failed status query must not be treated as a disconnected state. VPN mutation is security-sensiti ...[truncated 1477 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
| `SKILL.md` | this file |

Memory Manipulation

High
Category
Memory Poisoning
Confidence
90% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · templates/watchdog.py (reported line 240)May include surrounding context.

python
assert load_wd_state(base_cfg, tmp) == {}, "missing state file -> fail open"
    with open(wd_state_path(base_cfg, tmp), "w", encoding="utf-8") as f:
        f.write("{not json")
    assert load_wd_state(base_cfg, tmp) == {}, "corrupt state file -> fail open"
    save_wd_state(base_cfg, tmp, {"repair_ts": [1.0]})
    assert load_wd_state(base_cfg, tmp) == {"repair_ts": [1.0]}, "round trip"
    import shutil

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file states that one command can flip the whole machine stack, including VPN, background agents, local services, and model tier, but it does not include any warning about service disruption, connectivity changes, or other impacts to the user's system. For markdown files, descriptions that imply changes affecting system integrity or availability should disclose those risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file includes a command to 'flip the real machine' and elsewhere explains that modes control VPN state, background agents, and local services. Although functionality is described, there is no direct user warning near the real-machine command that running it will actively stop or start components and may disrupt connectivity or running workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill describes and instructs use of local scripts that read and write files and execute shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a mismatch between documented behavior and enforcement, increasing the risk that an agent runtime grants broader-than-expected filesystem and command execution access when the skill is invoked.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · templates/modes_switch.py (reported line 189)May include surrounding context.

python
def _run(argv, timeout=15, cwd=None):
    return subprocess.run(argv, capture_output=True, text=True, timeout=timeout,
                          cwd=cwd, encoding="utf-8", errors="replace",
                          creationflags=_NO_WINDOW)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

This code launches detached background processes from configuration-controlled argv and cwd values without any trust boundary enforcement, signature check, or executable allowlist. In the context of a skill that explicitly starts and stops VPNs, agents, and services, a malicious or tampered modes.yaml can cause arbitrary code execution whenever a mode switch occurs, and the detached/no-console design makes such execution less visible to the user.

Content

Scanner excerpt · templates/modes_switch.py (reported line 316)May include surrounding context.

python
kwargs["creationflags"] = _DETACH
    else:
        kwargs[_ON_WINDOWS_FLAG] = True
    subprocess.Popen([str(a) for a in argv], **kwargs)
    log(f"started {what or argv[0]}")

Static analysis

No suspicious patterns detected.