ClawHub
Back to skill

Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

Sandboxer is openly a power-user skill for controlling local tmux sessions and workspace files, but it gives agents root-capable, unauthenticated command and file-write authority with broad impact.

Install only on a dedicated, isolated machine where every local process is trusted. Do not use this on shared hosts or machines with sensitive unrelated data. Prefer adding authentication, per-workspace authorization, an unprivileged service account, repository allowlists, audit logs, and review before auto-commit or file writes.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:9
Finding

Unauthenticated Root-Capable Session Control Interface

Content
View full analysis
**Power-user skill.** Sandboxer gives agents full access to tmux sessions, workspace files, and terminal output on your server. Intended for dedicated AI machines where agents run with root access. Not for shared or untrusted environments. Sandboxer runs on `localhost:8081`. No auth needed from localhost. ## Quick: Dispatch a Task ```bash # 1. Spawn a Claude session in a repo curl "localhost:8081/api/create?type=claude&dir=/root/workspaces/AGENT/data/repos/PROJECT" # 2. Send it a task curl "localhost:8081/api/send?session=SESSION_NAME&text=Fix+the+failing+tests" # 3. Check progress curl "localhost:8081/api/session-monitor?session=SESSION_NAME" # 4. Kill when done curl "localhost:8081/api/kill?session=SESSION_NAME" ``` Session types: `claude`, `bash`, `lazygit`, `gemini`, `opencode` ``` ```markdown | Endpoint | What | |----------|------| | `GET /api/sessions` | List all sessions (status: running/idle/done/error) | | `GET /api/create?type=T&dir=D` | Spawn session | | `GET /api/session-monitor?session=S` | Last 20 lines + status + duration | | `GET /api/capture?session=S` | Full terminal output | | `GET /api/send?session=S&text=T` | Send keystrokes | | `GET /api/forward?session=S&task=T` | Ctrl+C then send task | | `GET /api/kill?session=S` | Kill session | | `GET /api/workspaces` | List workspaces (with repos) | | `GET /api/workspace-repos?workspace=W` | List repos in workspace | | `GET /api/repo-tree?path=P` | Repo file tree with git status | | `GET/POST /api/workspace/W/file/PATH` | Read/write workspace files | | `POST /api/auto-commit?workspace=W` | Commit workspace changes | ``` ### Technical Analysis The documented Sandboxer service requires no authentication for requests originating through the host's loopback interface, whil ...[truncated 2169 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:36
Finding

Overbroad Workspace Access Exposes Agent Identity and Long-Term Memory

Content
View full analysis
/ ← one folder per OpenClaw agent │ ├── AGENTS.md ← agent behavior rules │ ├── SOUL.md, USER.md, TOOLS.md ← agent identity & config │ ├── MEMORY.md ← curated long-term memory │ ├── TODO.md ← workspace task list (P1/P2/P3) │ ├── CLAUDE.md ← coding rules for this workspace │ ├── memory/YYYY-MM-DD.md ← daily memory logs │ ├── cronjobs/ ← cron configs (tracked by git) │ └── data/ │ └── repos/ ← software projects (git clones) │ ├── / ← separate git repo │ │ ├── CLAUDE.md ← project-specific coding rules │ │ └── ...source code... │ └── / ``` ```markdown ### Key rules: - **`data/repos/` contains separate git repos** — each project has its own `.git`, branches, remotes - **The workspace `.gitignore` excludes `data/`** — repo contents stay in their own git, not the workspace commit - **The workspace git only tracks**: `.md` files, `.gitignore`, and `cronjobs/` - **Always read CLAUDE.md / AGENTS.md** in both workspace AND repo before dispatching work to a session ``` ### Technical Analysis The documented workspace places behavior rules, identity configuration, curated long-term memory, and daily memory logs within the same filesystem hierarchy available to a powerful session-management service. The Skill explicitly requires reading workspace and repository instruction ...[truncated 2304 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:15
Finding

State-Changing Operations and Sensitive Task Data Use HTTP GET Query Parameters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill advertises operation on dedicated machines where agents run with root access while also exposing unauthenticated local APIs that control tmux sessions, files, and terminal output. In practice, this means any compromised local process or misdirected agent action can exercise root-level control over repositories, workspace configuration, and arbitrary shell activity, dramatically increasing blast radius.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
# Sandboxer — Dispatch Tasks to Tmux Sessions

> **Power-user skill.** Sandboxer gives agents full access to tmux sessions, workspace files, and terminal output on your server. Intended for dedicated AI machines where agents run with root access. Not for shared or untrusted environments.

Sandboxer runs on `localhost:8081`. No auth needed from localhost.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly documents writable workspace-file endpoints and an auto-commit API, but does not pair them with strong cautions about integrity risk, accidental destructive changes, or the fact that an agent can persist modifications into tracked workspace state. In this context, the capability is especially dangerous because the same skill also grants terminal control and is intended for root-run agents, so an agent can both modify instructions/configuration files and then commit those changes for persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The documented send, forward, and kill actions can interrupt running processes, inject commands into active terminal sessions, or terminate work, yet the documentation does not emphasize their destructive nature. Given that sessions may be attached to coding agents, shells, or git tools with broad filesystem access, misuse can cause loss of work, unintended command execution, or corruption of repository state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.