ClawHub
Back to skill

Security audit

clawsec-nanoclaw

Security checks for vulnerabilities and agentic risk

Overview

This security skill is coherent overall, but it gives agents host-side tools that can restore and approve critical bot files without a clear human authorization boundary.

Review this before installing in a production NanoClaw deployment. Use a pinned installer or the signed release verification path, restrict advisory scans to the intended skills directory, and do not expose integrity approval or auto-restore for global instructions or group registration files to ordinary agents without separate human/admin approval.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
host-services/integrity-handler.ts:191
Finding

Agent-Controlled Baseline Approval Can Neutralize Protection of Global Security Files

Content
View full analysis

Vulnerability Details

File Location: host-services/integrity-handler.ts:191-203; related code in mcp-tools/integrity-tools.ts:94-123 and protected targets in guardian/policy.json:5-23
Vulnerability Type: Missing authorization for a security-sensitive integrity operation
Risk Level: High

Vulnerable Code

The MCP tool permits an agent to select a protected file and represents the approval as agent-authorized:

typescript
server.tool(
  'clawsec_approve_change',
  'Approve an intentional file modification as the new approved baseline. Use this after making legitimate changes to protected files (e.g., updating CLAUDE.md or registered_groups.json).',
  {
    path: z.string().describe('Absolute path to file to approve (e.g., /workspace/group/CLAUDE.md)'),
    note: z.string().optional().describe('Optional note explaining why this change is being approved'),
  },
  async (args) => {
    const requestId = `integrity-approve-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;

    writeIpcFile(TASKS_DIR, {
      type: 'integrity_approve',
      requestId,
      path: args.path,
      note: args.note || '',
      approvedBy: 'agent',
      groupFolder,
      timestamp: new Date().toISOString()
    });

The host accepts the request and updates the baseline without verifying that a human or appropriately privileged group authorized it:

typescript
async function handleIntegrityApprove(
  task: any,
  service: IntegrityService,
  logger: any
): Promise<void> {
  const { requestId, path: filePath, note, approvedBy, groupFolder } = task;

  logger.info({ requestId, filePath, groupFolder }, 'Processing integrity_approve');

  try {
    const monitor = service.getMonitor();

    await monitor.approveChange(filePath, approvedBy || 'agent', note || '');

    writeResult(requestId, {
      success: true,
      path: filePath,
      approved_at: new Date(
...[truncated 3025 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat baseline approval as a host-administrative operation rather than a generally available agent tool.
  2. Require authenticated human confirmation for every approval, especially for critical and global targets.
  3. Derive the approver identity from trusted host authentication context; never trust approvedBy supplied through IPC.
  4. Bind each request to the authenticated source group and enforce per-target access-control rules on the host.
  5. Prohibit container agents from approving registered_groups.json, global CLAUDE.md, and other host-wide targets.
  6. Use separate tools or workflows for requesting and authorizing approval. An agent may submit a proposal, but a distinct trusted principal must approve it.
  7. Record the authenticated principal, source group, request digest, old hash, and new hash in the audit log.
  8. Add negative tests proving that ordinary groups cannot approve global or critical files and that forged approvedBy values are ignored.

T09 · Insecure Skill Coding Practices

Error
Location
guardian/integrity-monitor.ts:269
Finding

Baseline Snapshot Name Collisions Can Restore the Wrong Protected File

Content
View full analysis

Vulnerability Details

File Location: guardian/integrity-monitor.ts:269-271; restoration use at guardian/integrity-monitor.ts:489-522
Vulnerability Type: Insecure file mapping caused by basename collisions
Risk Level: High

Vulnerable Code

Baseline snapshots are named only with the target's basename:

typescript
// Create baseline
const sha = sha256File(target.path);
const snapshot = path.join(this.approvedDir, path.basename(target.path));
fs.copyFileSync(target.path, snapshot);

Drift detection and restoration use the same basename-only mapping:

typescript
// Generate diff
const snapshot = path.join(this.approvedDir, path.basename(filePath));
const oldText = fs.existsSync(snapshot) ? fs.readFileSync(snapshot, 'utf-8') : '';
const newText = fs.readFileSync(filePath, 'utf-8');
const diff = unifiedDiff(oldText, newText, `approved/${path.basename(filePath)}`, path.basename(filePath));

const patchPath = path.join(
  this.patchesDir,
  `${new Date().toISOString().replace(/[:.]/g, '-')}-drift-${safePatchTag(path.basename(filePath))}.patch`
);
fs.writeFileSync(patchPath, diff);

this.appendAudit({
  ts: utcNowIso(),
  event: 'drift',
  actor,
  path: filePath,
  mode: baseline.mode,
  expected_sha: baseline.sha256,
  found_sha: currentSha,
  patch_path: patchPath
});

// Handle based on mode
if (baseline.mode === 'restore' && autoRestore) {
  // Auto-restore
  try {
    const quarantinePath = path.join(
      this.quarantineDir,
      `${safePatchTag(path.basename(filePath))}.${Date.now()}.quarantine`
    );
    fs.copyFileSync(filePath, quarantinePath);

    if (fs.existsSync(snapshot)) {
      atomicWrite(filePath, fs.readFileSync(snapshot));
    }

The default policy contains two distinct targets with the same basename:

json
{
  "path": "/workspace/group/CLAUDE.md",
  "mode": "restore",
  "priority": "high",
  "
...[truncated 2579 chars]
Remediation
View remediation

Remediation Suggestions

  1. Generate snapshot identifiers from the complete normalized absolute path, such as SHA-256(path), rather than path.basename().
  2. Store the exact snapshot path in each baseline manifest entry.
  3. Before restoration, hash the snapshot and verify that it equals the baseline's expected hash.
  4. Refuse restoration if the snapshot is absent, ambiguous, or has an unexpected digest.
  5. Use similarly collision-resistant identifiers for patch and quarantine files.
  6. Detect duplicate snapshot identifiers during initialization and fail closed instead of overwriting an existing snapshot.
  7. Migrate existing state by rebuilding snapshots from explicitly verified files; do not silently reuse basename-based snapshots.
  8. Add tests with multiple policy targets sharing a basename and verify that each restores only its own content.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Installation Instructions Execute an Unpinned Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:11-16; duplicated in README.md:5-10
Vulnerability Type: Unpinned executable dependency in the installation path
Risk Level: Medium

Vulnerable Code

markdown
## Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

```bash
npx skills add prompt-security/clawsec --skill clawsec-nanoclaw -a openclaw -y
text

### Technical Analysis

`npx skills` resolves and executes a package obtained from the configured package registry. The documentation does not pin a specific audited CLI version, package digest, lockfile, or integrity value. Therefore, the code executed by the installation command can change after this Skill version has been reviewed.

The `-y` option removes an interactive confirmation step. Although this is not a `curl | shell` command and the repository also documents signed release verification for standalone artifacts, the recommended Vercel-compatible installation path does not show equivalent pinning or integrity verification for the installer CLI itself.

This is a supply-chain exposure rather than evidence that the current package is intentionally malicious.

### Attack Path

1. An attacker compromises the registry account, package publication pipeline, dependency chain, or a future release of the unpinned `skills` CLI.
2. A user follows the documented `npx skills add ... -y` command.
3. `npx` resolves the currently available package rather than a specifically audited version.
4. The compromised CLI executes with the user's installation privileges.
5. It can modify the NanoClaw installation or other files available to that user before installing, replacing, or supplementing the intended Skill.

### Impact Assessment

A compromised installer can execute arbitrary code with the privileges of the user running `npx`. Depending on deployment practices, this may permit modification of the NanoClaw project, Skil
...[truncated 263 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a reviewed exact version, for example npx skills@<exact-version>, rather than resolving the latest version.
  2. Publish and verify the expected package integrity digest or use a lockfile-backed installation process.
  3. Prefer the documented signed standalone release workflow when strong provenance is required.
  4. Verify the installer publisher, package signature or provenance attestation, and dependency tree before execution.
  5. Avoid -y for security-sensitive installation unless all artifacts and actions are already cryptographically pinned.
  6. Run installation with a least-privileged account in an isolated environment and inspect resulting file changes before deployment.
  7. Document the exact trusted installer version and update it only through a reviewed release process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (45)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 311)May include surrounding context.

md
1. Remove MCP tool registration from `ipc-mcp-stdio.ts`
2. Remove IPC handler registration from `src/ipc.ts`
3. Remove `AdvisoryCacheManager` initialization from host entry point
4. Delete the skill directory: `rm -rf skills/clawsec-nanoclaw`
5. Delete the cache file: `rm /workspace/project/data/clawsec-advisory-cache.json`
6. Restart NanoClaw

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 312)May include surrounding context.

md
2. Remove IPC handler registration from `src/ipc.ts`
3. Remove `AdvisoryCacheManager` initialization from host entry point
4. Delete the skill directory: `rm -rf skills/clawsec-nanoclaw`
5. Delete the cache file: `rm /workspace/project/data/clawsec-advisory-cache.json`
6. Restart NanoClaw

## Support

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims to assess vulnerabilities and advisories, but also documents signature-validation logic, local path access, IPC to host-side verification services, and install recommendation logic based on signature trust. This is a significant broadening of capability and operational authority that can mislead users about what is actually being installed and trusted.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill claims to assess vulnerabilities and advisories, but also documents signature-validation logic, local path access, IPC to host-side verification services, and install recommendation logic based on signature trust. This is a significant broadening of capability and operational authority that can mislead users about what is actually being installed and trusted.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims to assess vulnerabilities and advisories, but also documents signature-validation logic, local path access, IPC to host-side verification services, and install recommendation logic based on signature trust. This is a significant broadening of capability and operational authority that can mislead users about what is actually being installed and trusted.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims to assess vulnerabilities and advisories, but also documents signature-validation logic, local path access, IPC to host-side verification services, and install recommendation logic based on signature trust. This is a significant broadening of capability and operational authority that can mislead users about what is actually being installed and trusted.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims to assess vulnerabilities and advisories, but also documents signature-validation logic, local path access, IPC to host-side verification services, and install recommendation logic based on signature trust. This is a significant broadening of capability and operational authority that can mislead users about what is actually being installed and trusted.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims to assess vulnerabilities and advisories, but also documents signature-validation logic, local path access, IPC to host-side verification services, and install recommendation logic based on signature trust. This is a significant broadening of capability and operational authority that can mislead users about what is actually being installed and trusted.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims to assess vulnerabilities and advisories, but also documents signature-validation logic, local path access, IPC to host-side verification services, and install recommendation logic based on signature trust. This is a significant broadening of capability and operational authority that can mislead users about what is actually being installed and trusted.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md
For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md
For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md
RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/INTEGRITY.md (reported line 419)May include surrounding context.

ls /workspace/project/data/soul-guardian/

If missing, reinitialize

rm -rf /workspace/project/data/soul-guardian/

Next integrity check will recreate baselines

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/INTEGRITY.md (reported line 419)May include surrounding context.

ls /workspace/project/data/soul-guardian/

If missing, reinitialize

rm -rf /workspace/project/data/soul-guardian/

Next integrity check will recreate baselines

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/INTEGRITY.md (reported line 453)May include surrounding context.

// If corruption, backup and reset cp /workspace/project/data/soul-guardian/audit.jsonl /tmp/audit-backup.jsonl rm /workspace/project/data/soul-guardian/audit.jsonl // Audit log will restart on next operation

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/INTEGRITY.md (reported line 471)May include surrounding context.

find /workspace/project/data/soul-guardian/patches/ -mtime +30 -delete

Clean quarantine (after review)

rm /workspace/project/data/soul-guardian/quarantine/*

text

## Performance

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The integrity_check path passes autoRestore !== false into monitor.checkIntegrity, meaning restoration is enabled by default unless explicitly disabled. This gives an agent-triggerable IPC request the ability to modify host files during what should be a checking operation, creating a write primitive that can revert files unexpectedly, interfere with operations, or be abused to manipulate host state under the guise of integrity enforcement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The integrity_approve handler lets IPC tasks call monitor.approveChange(filePath, ...) with attacker-controlled path, note, and approver fields, enabling an agent to mark filesystem changes as legitimate. If a compromised or malicious agent can invoke this IPC route, it can normalize tampering by updating integrity state or audit expectations, defeating the purpose of file integrity monitoring and hiding persistence.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that integrity-checking and audit-verification tools are included, but later says file integrity monitoring is only a future enhancement. In a security skill, contradictory claims about available protections can mislead operators into believing tamper detection exists when it may be incomplete or absent, causing unsafe deployment decisions and delayed detection of compromise.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 150)May include surrounding context.

md
## Documentation

- [Skill Documentation](skills/clawsec-nanoclaw/SKILL.md) - Features and architecture
- [Installation Guide](skills/clawsec-nanoclaw/INSTALL.md) - Detailed setup instructions
- [ClawSec Main README](README.md) - Overall ClawSec documentation
- [Security & Signing](../../wiki/security-signing-runbook.md) - Signature verification details

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill advertises and documents network access, local file access, package verification, cache storage, and integrity operations, but the manifest shown in SKILL.md does not declare any explicit tool scope such as permissions or allowed-tools. That creates a transparency and least-privilege problem: users and review systems cannot reliably determine the operational boundary before installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The installation command uses 'npx skills add ...' without pinning the CLI version, which makes the installation path dependent on whatever package version is current at execution time. This increases supply-chain risk and undermines reproducibility, especially for a security-sensitive skill that users may trust to make security decisions.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Security Audit

typescript
// Check all installed skills (defaults to ~/.claude/skills in the container)
const result = await tools.clawsec_check_advisories({
  installRoot: '/home/node/.claude/skills'  // optional
});

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation promotes automatic restoration of critical files but does not prominently warn that legitimate edits may be overwritten if baselines are stale or changes were not approved first. In an operational setting, this can cause loss of intended configuration or instruction changes and may hide active troubleshooting by repeatedly reverting files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.