Security audit

ClawSec

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-traffic monitoring proxy, but it asks users to enable broad HTTPS interception and stores sensitive snippets in temporary local logs without enough scoping or safety guidance.

Install only if you intentionally want a local proxy that can decrypt and inspect agent HTTPS traffic. Prefer per-process CA variables instead of system-wide trust, verify the CA file before trusting it, remove the CA after use, and avoid using this with real credentials unless logs are locked down, redacted, and regularly deleted.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: skill.md:66
Finding: System-Wide Trust Installation of a CA from a Predictable Temporary Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skill.md:108
Finding: Sensitive Intercepted Traffic May Be Persisted in Plaintext Temporary Logs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
md
| `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
md
| `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
md
| `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 26)May include surrounding context.
md
| `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 26)May include surrounding context.
md
| `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 27)May include surrounding context.
md
| `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) | ### INJECTION patterns

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · skill.md (reported line 33)May include surrounding context.
md
### INJECTION patterns | Pattern name | What it matches | |---|---| | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` |

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · skill.md (reported line 33)May include surrounding context.
md
### INJECTION patterns | Pattern name | What it matches | |---|---| | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 36)May include surrounding context.
md
| `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` | | `ssh_key_inject` | `echo ssh-rsa` (SSH key injection attempt) | ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 36)May include surrounding context.
md
| `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` | | `ssh_key_inject` | `echo ssh-rsa` (SSH key injection attempt) | ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 75)May include surrounding context.
bash
# macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 75)May include surrounding context.
bash
# macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs users to perform HTTPS interception via a locally trusted CA and to install that CA into the system trust store, but it does not present a prominent warning about the security and privacy consequences. A trusted interception CA can decrypt traffic for many destinations and materially weakens endpoint trust boundaries if misused, leaked, or left installed beyond the intended scope.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill instructs the user to run sudo to add a custom CA certificate into the macOS system trust store. This requires elevated privileges and modifies a sensitive global security setting, which can enable broad HTTPS interception if the CA is abused or retained unintentionally.
Content: Scanner excerpt · skill.md (reported line 74)May include surrounding context.
bash
# macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This step uses sudo to copy a locally generated CA certificate into the system CA directory, modifying global trust settings with root privileges. Such instructions increase attack surface because they normalize privileged trust-store changes and can permit interception of HTTPS traffic system-wide.
Content: Scanner excerpt · skill.md (reported line 78)May include surrounding context.
md
-k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt sudo update-ca-certificates # Per-process (no system trust required)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Running update-ca-certificates with sudo finalizes installation of a custom CA into the operating system trust store. This is security-sensitive because it changes certificate validation behavior for many applications and can enable transparent decryption by the proxy.
Content: Scanner excerpt · skill.md (reported line 79)May include surrounding context.
md
# Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt sudo update-ca-certificates # Per-process (no system trust required) export REQUESTS_CA_BUNDLE=/tmp/clawsec/ca.crt # Python requests

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 85)May include surrounding context.
export REQUESTS_CA_BUNDLE=/tmp/clawsec/ca.crt # Python requests export SSL_CERT_FILE=/tmp/clawsec/ca.crt # httpx export NODE_EXTRA_CA_CERTS=/tmp/clawsec/ca.crt # Node.js export CURL_CA_BUNDLE=/tmp/clawsec/ca.crt # curl

text
Then route agent traffic through the proxy: