ClawShorts

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:36 AM UTC
• Version: 1.3.2

Overview

ClawShorts is a disclosed Fire TV Shorts limiter that uses local ADB control and a user-level background daemon; it has privacy and operational caveats but no artifact-backed malicious behavior.

Install only if you are comfortable giving the skill ADB control of your Fire TV and running a user-level background daemon on your computer. Use it only on a trusted home network, keep ADB debugging disabled when not needed, and periodically review or delete local logs/UI dump files under ~/.clawshorts and /tmp if screen contents may be sensitive.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        subprocess.run(["launchctl", "stop", "com.fink.clawshorts"], timeout=5)
        time.sleep(1)
        subprocess.run(["pkill", "-9", "-f", "clawshorts-daemon.py"], timeout=10)
        time.sleep(1)
    except subprocess.TimeoutExpired:
        _log("Kill command timed out")

• Confidence: 78% confidence
• Finding: Using pkill -9 -f with a broad pattern can terminate any process whose full command line matches clawshorts-daemon.py, not just the intended daemon instance. If another local process can be named or launched to match that pattern, this healthcheck can be induced to kill unintended processes, creating a local denial-of-service condition.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes shell execution, filesystem access, SQLite state, and ADB-based device control, but does not declare corresponding permissions. This creates a trust and review gap: the agent may perform impactful local actions or interact with network-reachable devices without explicit user-visible authorization boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script includes host-level install, uninstall, daemon start/stop, and persistence management via launchd/systemd, which goes beyond the stated skill purpose of checking and configuring YouTube Shorts limiting on Fire TV devices. In an agent setting, this expands the action surface from device management into modifying the user's host environment and persistence state, increasing the risk of unintended system changes.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The script exposes history and debug-log access that are not reflected in the manifest description. This is dangerous because agents or users may invoke capabilities that reveal behavioral data or internal logs without expecting the skill to have those read-access features.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This code captures and pulls the full UI hierarchy XML from the device, which can expose unrelated on-screen content, account information, recommendations, search queries, or other sensitive state beyond Shorts detection. That is broader device-inspection capability than the narrow skill purpose suggests, so if misused or logged it creates an unnecessary privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The uninstall path removes user service files and disables services without any interactive warning or confirmation. In an agent context, this can cause unintended persistence removal and service disruption if the command is invoked accidentally or through ambiguous prompting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The install flow writes launchd/systemd auto-start configuration and enables it immediately, but the user-facing interface does not present a strong warning about establishing persistence. This is risky in an agent setting because it changes host startup behavior, which is more sensitive than ordinary device configuration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes a full device UI dump to a fixed path in /tmp, which is predictable and may be readable, replaceable, or recoverable by other local processes depending on system configuration. Because the XML can contain sensitive screen content, using a shared predictable filename increases the chance of data leakage or tampering.

Static analysis

No suspicious patterns detected.