Clawdbot Filesystem.Bak

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:46 AM UTC
• Version: 1.0.0

Overview

This filesystem skill is not clearly malicious, but it asks for broad file access while the declared executable is missing and some setup paths would run unpinned external tools.

Review this carefully before installing. Only use it in a limited workspace, prefer read-only modes where possible, avoid granting sensitive directories, and do not rely on the advertised safety controls until the missing executable and exact pinned external tool versions are supplied and reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: skills/filesystem-mcp/SKILL.md:26

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: skills/filesystem-mcp/SKILL.md:26-33, skills/filesystem-mcp/SKILL.md:45-53, and skills/nano-pdf/SKILL.md:5
Vulnerability Type: Unpinned remote dependency installation and execution
Risk Level: Medium

Vulnerable Code

skills/filesystem-mcp/SKILL.md:26-33:

bash

# Official reference implementation
npm install -g @modelcontextprotocol/server-filesystem

# Or build from source
git clone https://github.com/modelcontextprotocol/servers
cd servers/src/filesystem
npm install
npm run build

skills/filesystem-mcp/SKILL.md:45-53:

json

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/yourname/Documents",
        "/Users/yourname/Projects"
      ]
    }
  }
}

skills/nano-pdf/SKILL.md:5:

yaml

metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["nano-pdf"]},"install":[{"id":"uv","kind":"uv","package":"nano-pdf","bins":["nano-pdf"],"label":"Install nano-pdf (uv)"}]}}

Technical Analysis

The installation and runtime instructions identify third-party packages by name but do not pin an exact reviewed version or provide an integrity hash. The bundled package-lock.json does not cover either @modelcontextprotocol/server-filesystem or nano-pdf.

The npx -y configuration is especially sensitive because it permits npm to resolve, download, and execute the currently available package without interactive confirmation. The code that eventually runs can therefore differ from the code that existed when this skill was reviewed.

The global npm installation, source build instructions, and uv installer metadata have the same version-selection weakness. Although no malicious upstream package is present in the audited artifact, compromise of a package release, registry account, dependency chain, or mut ...[truncated 1360 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every remotely installed component to an exact reviewed version, for example @modelcontextprotocol/server-filesystem@X.Y.Z and nano-pdf==X.Y.Z.
2. Record and verify package integrity hashes through appropriate lockfiles or installer hash-checking mechanisms.
3. Replace runtime npx -y bootstrap behavior with a separately reviewed installation step and execute a known local binary afterward.
4. Pin source-based installation to a verified immutable commit rather than cloning and building the current default branch.
5. Verify release signatures, publisher identity, and package provenance before updating pins.
6. Run third-party tools as an unprivileged user and expose only the minimum necessary directories.
7. Prefer read-only MCP access unless modification is explicitly required.
8. Test dependency updates in an isolated environment before publishing a revised skill.

T09 · Insecure Skill Coding Practices

Warning

• Location: package.json:5

Finding

Package Declares a Filesystem Executable That Is Missing from the Artifact

Content

View full analysis

Vulnerability Details

File Location: package.json:5-8 and package.json:35-41
Vulnerability Type: Incomplete package with unverifiable executable behavior and safeguards
Risk Level: Medium

Vulnerable Code

package.json:5-8:

json

"main": "filesystem",
"bin": {
  "filesystem": "./filesystem"
},

package.json:35-41:

json

"preferGlobal": true,
"files": [
  "filesystem",
  "config.json",
  "SKILL.md",
  "README.md",
  "LICENSE.md"
],

The installation documentation also expects this file to exist.

README.md:42-49:

bash

# Clone the skill
git clone https://github.com/gtrusler/clawdbot-filesystem.git
cd clawdbot-filesystem

# Make executable
chmod +x filesystem

# Optional: Install globally
npm install -g .

The audited project inventory contains no file named filesystem. It only contains documentation, metadata, configuration, and the two sub-skill directories.

Technical Analysis

The package declares ./filesystem as both its main program and command-line entry point, and explicitly includes that path in its publication allowlist. However, the executable is absent from the reviewed artifact.

Consequently, the advertised implementation cannot be audited or executed from this package. In particular, documented claims concerning path validation, protected system paths, permission checks, operation limits, and confirmation behavior cannot be verified against executable code.

Depending on the installation and invocation environment, this inconsistency may cause installation failure, broken command links, or accidental invocation of a different same-named command already available through the user's shell search path. It may also encourage users to retrieve a replacement executable from an external source that was not included in this audit.

Attack Path

1. A user installs the package or attempts to follow its setup instruction ...[truncated 1252 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the declared filesystem executable and its complete source code in the published artifact.
2. Ensure the main, bin, and files entries resolve to files that are present in the final package archive.
3. Add a publication test that runs npm pack, inspects the resulting archive, installs it in a clean environment, and invokes filesystem help.
4. Add automated tests proving path canonicalization, traversal prevention, symlink handling, protected-path enforcement, confirmation requirements, and permission boundaries.
5. Fail closed when configuration or executable components are missing; do not silently fall back to a command found elsewhere.
6. In documentation, instruct users to invoke the package-resolved binary rather than an ambiguous same-named command where feasible.
7. Publish cryptographic checksums or signed releases so users can verify that the executable matches the reviewed artifact.
8. Re-audit the executable implementation before considering the documented filesystem safety claims validated.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/filesystem-mcp/SKILL.md (reported line 281)May include surrounding context.

Allowed: /Users/dev/projects Agent tries: /Users/dev/projects/src/index.ts → ✅ Allowed Agent tries: /Users/dev/projects/../secret → ❌ Blocked Agent tries: /etc/passwd → ❌ Blocked

text

### Best Practices

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file falls under the SQP-2 markdown scope. The filesystem copy command includes write-affecting behavior and an --overwrite option, but the command reference does not provide a direct user warning about potential data modification or overwrite risk beyond mentioning dry-run and safety checks elsewhere.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The package description advertises broad 'advanced filesystem operations' including listing, searching, batch processing, and analysis, but it does not communicate any scope limits, safety boundaries, or user-confirmation requirements. In an agent-skill context, vague capability descriptions can cause an orchestrator or user to invoke high-risk file actions without understanding that large-scale or destructive operations may be possible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest requests read-write filesystem access but provides no adjacent warning or limitation statement about modification, overwrite, deletion, or bulk changes. For an AI-agent skill, write access materially increases risk because ambiguous prompts or misuse could alter sensitive files, damage repositories, or change system/user data at scale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill metadata and description use very broad activation language such as general 'filesystem access' and 'content management,' which can cause the agent to invoke this high-privilege skill for routine requests without clear scoping. In a file-manipulation skill, overbroad triggering increases the chance of unnecessary exposure to read/write/delete capabilities and can lead to unintended destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The examples normalize file creation, editing, moving, organization, and deletion workflows without consistently requiring explicit user confirmation, dry-run behavior, or warnings about irreversible changes. Because this is an agent skill for direct filesystem operations, such examples can shape unsafe agent behavior and increase the risk of accidental data loss or unauthorized modification within allowed directories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.