claw-code

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a benign harness simulator/port; sensitive-looking keychain, persistence, and remote-mode labels are implemented as no-op placeholders rather than real access.

Installers should treat this as a prototype or simulator for an agent harness, not a full secure runtime. The sensitive labels are no-ops in this artifact, but users rebuilding it should review future implementations of persistence, remote modes, and prefetch hooks before using them with private prompts or real systems.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Credential Access

High

• Category: Privilege Escalation

Content

export function startMdmRawRead() {
    return { name: 'mdm_raw_read', detail: 'stub prefetch – no-op' };
}
export function startKeychainPrefetch() {
    return { name: 'keychain_prefetch', detail: 'stub prefetch – no-op' };
}
export function startProjectScan(_root) {

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

export function startMdmRawRead() {
    return { name: 'mdm_raw_read', detail: 'stub prefetch – no-op' };
}
export function startKeychainPrefetch() {
    return { name: 'keychain_prefetch', detail: 'stub prefetch – no-op' };
}
export function startProjectScan(_root) {

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

return { name: 'mdm_raw_read', detail: 'stub prefetch – no-op' };
}
export function startKeychainPrefetch() {
    return { name: 'keychain_prefetch', detail: 'stub prefetch – no-op' };
}
export function startProjectScan(_root) {
    return { name: 'project_scan', detail: `stub prefetch for root=${_root}` };

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

// Setup – workspace setup and report
// Mirrored from Python src/setup.py
import { runDeferredInit } from './deferred_init.js';
import { startKeychainPrefetch, startMdmRawRead, startProjectScan } from './prefetch.js';
export class WorkspaceSetup {
    constructor(args) {
        this.python_version = args?.python_version ?? '3.12.0';

• Confidence: 92% confidence
• Finding: The import of startKeychainPrefetch from the prefetch module indicates this skill includes functionality to access keychain material, which is highly sensitive credential data. In the context of a workspace setup routine, credential-access capability is not obviously required for basic initialization, making the skill more dangerous because secret collection logic is built into startup-related code paths.

Credential Access

High

• Category: Privilege Escalation

Content

export function runSetup(_cwd, trusted = true) {
    const prefetches = [
        startMdmRawRead(),
        startKeychainPrefetch(),
        startProjectScan(_cwd ?? '<root>'),
    ];
    return {

• Confidence: 98% confidence
• Finding: At runSetup, startKeychainPrefetch() is actually invoked automatically, confirming live credential-access behavior rather than a dormant import. Because this occurs alongside other prefetch side effects and before deferred initialization is trust-gated, the code can access sensitive credentials even when the rest of initialization might be restricted, substantially increasing risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documentation exposes capabilities for session persistence and multiple remote connection modes without any safety guidance, trust boundaries, or warnings about data handling and system impact. In an agent skill context, this can lead users or downstream agents to invoke persistence or remote-access features without understanding that prompts, transcripts, credentials, or target systems may be affected.

Session Persistence

Medium

• Category: Rogue Agent

Content

node dist/main.js bootstrap "<prompt>" --limit 5   # Bootstrap a session
node dist/main.js turn-loop "<prompt>" --max-turns 3   # Run turn loop
node dist/main.js flush-transcript "<prompt>"      # Persist session
node dist/main.js load-session <session_id>        # Load saved session
```

### Remote Modes

• Confidence: 87% confidence
• Finding: The documented `flush-transcript` and `load-session` functionality indicates session persistence without any visible notice about sensitive data capture, storage location, access control, or retention. In an agent runtime, persisted transcripts may contain prompts, secrets, internal context, or operational history, creating confidentiality and privacy risk if stored insecurely or replayed unexpectedly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The flush-transcript command persists user-supplied session content to storage immediately via persistSession(), with no explicit warning, consent prompt, or visibility into retention/location before the write. In an agent skill context, prompts and transcripts often contain secrets, internal data, or tokens, so silent persistence increases the risk of unintended data exposure on disk or later retrieval by other users/processes.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The inline help describes these commands as "Simulate ... runtime branching," which suggests non-operative or mock behavior. However, the main dispatcher calls runRemoteMode, runSshMode, runTeleportMode, runDirectConnect, and runDeepLink, indicating actual mode execution logic rather than merely printing a simulated branch choice.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code persists session state including `messages`, token counts, and a session identifier via `saveSession(session)`. Although this operation is commented as session persistence, there is no user-facing disclosure, confirmation prompt, or warning in the code indicating that conversation data will be written to storage.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: `bootstrap_session` is documented as only creating a new runtime session, but it also executes matched commands and tools, invokes the query engine, streams events, and persists a session. This hidden side-effect boundary is dangerous because callers may treat bootstrap as a safe initialization step and unknowingly trigger code execution or state changes simply by supplying a prompt.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The runtime routes a user prompt to matching commands/tools and immediately executes them without a user-visible confirmation, review, or policy gate. In a prompt-driven system, this can turn natural-language input into unintended actions, especially when routing is token-based and may match overly broad or surprising modules.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: runSetup starts startKeychainPrefetch() immediately as part of normal setup, with no visible consent, warning, or trust gate. Accessing keychain-related material during initialization is dangerous because it can collect sensitive credentials before the user understands what the skill is doing, and the same function also kicks off MDM raw reads, increasing the sensitivity of this startup behavior.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The code claims to infer permission denials for dangerous tools, but the actual policy only blocks tools whose name contains `bash`. This creates a weak, name-based safeguard that can be bypassed by dangerous tools with other names, leading reviewers or integrators to overestimate the protection level.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"test": "jest"
  },
  "devDependencies": {
    "@types/node": "^20.19.39",
    "typescript": "^5.3.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "@types/node": "^20.19.39",
    "typescript": "^5.3.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

No suspicious patterns detected.