ClawShorts

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:15 AM UTC
• Version: 1.3.2

Overview

This skill is a disclosed Fire TV YouTube Shorts limiter that uses ADB and an optional user-level background service, with some operational risks but no artifact-backed malicious behavior.

Install only if you are comfortable enabling ADB on a trusted home network and running a user-level background daemon that monitors configured Fire TV devices and can close YouTube automatically when the limit is reached. Use the provided stop/uninstall controls when you no longer need it, and avoid enabling ADB on public or untrusted networks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/clawshorts/device_monitor.py:164

Finding

Predictable shared temporary files enable local symlink and data-tampering attacks

Content

View full analysis

/dev/null adb -s "$ip:5555" pull /sdcard/ui.xml /tmp/ui.xml 2>/dev/null pct=$(python3 -c " import re try: c=open('/tmp/ui.xml').read() ``` ### Technical Analysis Both implementations use fixed filenames in the globally shared `/tmp` directory. No secure creation operation, exclusive-open check, symlink rejection, ownership verification, or cleanup is performed. An untrusted local process can anticipate these filenames and create a regular file or symbolic link before ClawShorts runs. Depending on how the installed ADB client handles an existing destination, this can result in: - Overwriting a symlink target writable by the ClawShorts user. - Reading attacker-controlled XML and producing a forged Shorts classification. - Exposing Fire TV UI hierarchy data to other local users through an inadequately protected temporary file. - Cross-process collisions when multiple status checks or fallback daemons run concurrently. - Persistent retention of UI metadata after the operation finishes. The pulled UI hierarchy may contain text and interface metadata visible on the Fire TV. Although no external exfiltration was found, storing this information a ...[truncated 1364 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/clawshorts.sh:145

Finding

Broad command-line process matching can terminate unrelated user processes

Content

View full analysis

/dev/null || true) if [[ -z "$pids" ]]; then echo "Daemon not running" return 0 fi # Graceful shutdown: SIGTERM first, wait 2s, then SIGKILL only if still alive kill -TERM $pids 2>/dev/null || true sleep 2 for pid in $pids; do kill -0 "$pid" 2>/dev/null && kill -9 "$pid" done echo "✅ Stopped" } ``` The health checker performs an even broader forced termination: ```python def kill_daemon() -> None: """Kill all clawshorts daemon processes and stop launchctl.""" try: subprocess.run(["launchctl", "stop", "com.fink.clawshorts"], timeout=5) time.sleep(1) subprocess.run(["pkill", "-9", "-f", "clawshorts-daemon.py"], timeout=10) time.sleep(1) except subprocess.TimeoutExpired: _log("Kill command timed out") except OSError as e: _log(f"Error killing daemon: {e}") ``` ### Technical Analysis `pgrep -f` and `pkill -f` match text anywhere in a process's complete command line. They do not establish that the selected process: - Is the ClawShorts daemon instance managed by this installation. - Is owned by the expected user. - Executes the expected script from the expected project path. - Was started by the corresponding launchd or systemd unit. Consequently, any accessible process whose command line contains `clawshorts-daemon` or `clawshorts-daemon.py` may be selected. The launcher sends SIGTERM and subsequently SIGKILL to matching processes that remain alive. The health checker immediately uses `pkill -9`, preventing cleanup and graceful database or file handling. Operating-system ownership checks generally prevent an unpri ...[truncated 1248 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (91)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 73)May include surrounding context.

md

**Impact:** Abrupt app termination with no warning on-screen.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documented purpose is user-facing Shorts management, but the described behavior includes daemon/process management, local state mutation, LaunchAgent persistence, and log/database handling that are not clearly disclosed as privileged operations. This mismatch is dangerous because operators may approve or invoke the skill under a narrower trust assumption than the skill's actual system impact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is user-facing Shorts management, but the described behavior includes daemon/process management, local state mutation, LaunchAgent persistence, and log/database handling that are not clearly disclosed as privileged operations. This mismatch is dangerous because operators may approve or invoke the skill under a narrower trust assumption than the skill's actual system impact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is user-facing Shorts management, but the described behavior includes daemon/process management, local state mutation, LaunchAgent persistence, and log/database handling that are not clearly disclosed as privileged operations. This mismatch is dangerous because operators may approve or invoke the skill under a narrower trust assumption than the skill's actual system impact.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill can install packages and prepare for persistent execution on the host, which is not necessary for a narrow device-management task like checking or resetting Shorts quotas. This creates unnecessary privilege and system-modification risk if the skill is triggered unexpectedly or used in an automated agent flow.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/clawshorts.sh (reported line 119)May include surrounding context.

sh

install_adb() {
    echo "Installing ADB..."
    if command -v apt-get &> /dev/null; then
        sudo apt-get update -qq && sudo apt-get install -y adb
    elif command -v brew &> /dev/null; then
        brew install android-platform-tools
    else

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script writes launchd and systemd unit files and enables them so the daemon runs automatically at login. Persistent execution materially increases risk because the skill continues operating after the original user request and survives future sessions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/clawshorts.sh (reported line 257)May include surrounding context.

sh

rm -f "$plist"
    else
        systemctl --user disable --now clawshorts.service 2>/dev/null || true
        rm -f "${HOME}/.config/systemd/user/clawshorts.service"
        systemctl --user daemon-reload 2>/dev/null || true
    fi
    cmd_stop

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The setup instructs users to enable ADB debugging on a Fire TV and record its IP address, which creates a remotely reachable device-management surface on the local network. If the home network is untrusted or another host can access the device, ADB could allow unauthorized control of the Fire TV, making this persistence/remote-access exposure materially security-relevant in context.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md

1. On your Fire TV: **Settings → My Fire TV → About → Network**
2. Look for **IP Address** (like `192.168.1.100`)
3. Write it down

### Step 2 — Enable ADB Debugging

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 169)May include surrounding context.

"ADB not found" — Install ADB on your computer:

bash

brew install android-platform-tools  # Mac
sudo apt install adb                # Linux

"Daemon not running" — Start it:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The README states that the tool installs an auto-start LaunchAgent plist, meaning the daemon persists across sessions without requiring a user to manually launch it. Persistence is not inherently malicious here, but it does create a durable execution foothold on the user's machine; if the script or its dependencies are compromised later, that persistence increases blast radius and stealth.

Content

Scanner excerpt · README.md (reported line 204)May include surrounding context.

md

- `~/.clawshorts/` — all data lives here
- `~/.clawshorts/clawshorts.db` — watch history and config (SQLite)
- `~/.clawshorts/daemon.log` — debug log
- `~/Library/LaunchAgents/com.fink.clawshorts.plist` — auto-start (macOS)

---

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The audit explicitly says IPv4 validation only checks octet ranges and does not restrict targets to private/home-network addresses. That means the skill can be directed at arbitrary IPs, broadening scope beyond Buck's Fire TV devices and risking unintended ADB connection attempts to other local or even public hosts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The audit states current documentation lacks a prominent warning that ADB on Fire TV has no built-in authentication. In this skill's context, that omission matters because users may enable an unauthenticated remote-control channel on their home network without understanding the exposure.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The audit confirms the daemon can autonomously force-stop YouTube when a limit is reached, without real-time confirmation or on-screen warning. In a device-control skill, autonomous enforcement is security-relevant because it can take disruptive action on a user device without a just-in-time consent checkpoint, especially if misconfigured or pointed at the wrong device.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 63)May include surrounding context.

md

---

### 🟡 MEDIUM — No confirmation before force-stopping YouTube

**File:** `scripts/clawshorts-daemon.py` (`_force_stop_youtube`)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 98)May include surrounding context.

md

---

### 🟢 LOW — `cmd_stop` sends SIGKILL after 2s without checking if graceful shutdown succeeded

**File:** `scripts/clawshorts.sh` (`cmd_stop`)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The audit describes a LaunchAgent-managed daemon that persists and runs continuously under the user account. Persistence plus lack of resource limits can turn bugs or misuse into prolonged host impact, and in this skill context a background device-control daemon increases the consequences of misconfiguration.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 136)May include surrounding context.

md

### 🟡 MEDIUM — Daemon runs as user with no resource limits

**File:** `clawshorts-daemon.sh`, LaunchAgent plist

The daemon has no CPU, memory, or file descriptor limits set in the LaunchAgent plist. A bug causing an infinite loop could consume resources.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

This line continues the same issue: a persistent daemon without limits can consume resources indefinitely if it loops or malfunctions. While not evidence of malicious persistence, it is still a real operational/security weakness because it can degrade the host and keep device-control logic running continuously.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 138)May include surrounding context.

md

**File:** `clawshorts-daemon.sh`, LaunchAgent plist

The daemon has no CPU, memory, or file descriptor limits set in the LaunchAgent plist. A bug causing an infinite loop could consume resources.

**Impact:** Denial of service on the host machine.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The recommended plist hardening indicates the current persistent service lacks execution bounds. In an always-on agent skill, uncontrolled persistence raises denial-of-service risk on the host if the daemon misbehaves.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 142)May include surrounding context.

Impact: Denial of service on the host machine.

Recommendation: Add to plist:

xml

<key>HardResourceLimits</key>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares executable capabilities and operational behavior involving shell access, file reads, and file writes, but does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance of over-broad execution and weak reviewability, making misuse or unintended command/file access harder to constrain.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill documents persistent background execution via a LaunchAgent and stores ongoing device usage/history state under the user's home directory. Persistence is security-relevant because it allows continued execution and monitoring after the initial invocation, increasing the blast radius if the skill is misconfigured, compromised, or used unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

- `devices` — per-device settings (IP, name, limit, screen size, thresholds)
  - `daily_usage` — daily watch time per device
- Daemon log: `~/.clawshorts/daemon.log`
- LaunchAgent: `~/Library/LaunchAgents/com.fink.clawshorts.plist`

## Requirements

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY_AUDIT.md (reported line 166)May include surrounding context.

Symptom: The ClawShorts daemon restarts every 30-90 seconds, cycling continuously. Logs show "Shutdown requested (signal 15)" followed by immediate restart.

Root Cause: The LaunchAgent plist uses ThrottleInterval inside KeepAlive, which conflicts with launchd's restart behavior.

Bad plist configuration:

xml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 9)May include surrounding context.

Symptom: The ClawShorts daemon restarts every 30-90 seconds, cycling continuously. Logs show "Shutdown requested (signal 15)" followed by immediate restart.

Root Cause: The LaunchAgent plist uses ThrottleInterval inside KeepAlive, which conflicts with launchd's restart behavior.

Bad plist configuration:

xml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 11)May include surrounding context.

Symptom: The ClawShorts daemon restarts every 30-90 seconds, cycling continuously. Logs show "Shutdown requested (signal 15)" followed by immediate restart.

Root Cause: The LaunchAgent plist uses ThrottleInterval inside KeepAlive, which conflicts with launchd's restart behavior.

Bad plist configuration:

xml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 162)May include surrounding context.

Symptom: The ClawShorts daemon restarts every 30-90 seconds, cycling continuously. Logs show "Shutdown requested (signal 15)" followed by immediate restart.

Root Cause: The LaunchAgent plist uses ThrottleInterval inside KeepAlive, which conflicts with launchd's restart behavior.

Bad plist configuration:

xml

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 167)May include surrounding context.

Symptom: The ClawShorts daemon restarts every 30-90 seconds, cycling continuously. Logs show "Shutdown requested (signal 15)" followed by immediate restart.

Root Cause: The LaunchAgent plist uses ThrottleInterval inside KeepAlive, which conflicts with launchd's restart behavior.

Bad plist configuration:

xml

Static analysis

No suspicious patterns detected.