Security audit
Security checks for vulnerabilities and agentic risk
This is a focused Picoclaw security-checking skill that reads local configuration and writes local reports on demand, with no hidden persistence or exfiltration found.
Use this only for Picoclaw environments. Treat generated profile and drift files as sensitive operational reports because they can include local paths, file hashes, modes, and security-marker counts. For standalone installs, verify the release source and pinned signing key before extracting or installing artifacts.
Referenced artifact was not completely inspected
For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad
Referenced artifact was not completely inspected
For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"
curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"
Referenced artifact was not completely inspected
node scripts/generate_profile.mjs --output ~/.picoclaw/security/clawsec/current-profile.json
The skill metadata omits any explicit permission or allowed-tools scope even though the documented usage clearly depends on shell execution, environment access, and outbound network access. In an agent ecosystem, that mismatch can lead to overbroad execution at install/runtime or prevent operators from understanding that the skill will fetch remote artifacts and invoke local tooling, increasing the risk of unintended command and network exposure.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
]),
auth_disabled: truthyFromText(text, [
"auth: false",
"disable_auth: true",
"no_auth: true",
"password: ''",
'password: ""',
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
]),
auth_disabled: truthyFromText(text, [
"auth: false",
"disable_auth: true",
"no_auth: true",
"password: ''",
'password: ""',
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
]),
auth_disabled: truthyFromText(text, [
"auth: false",
"disable_auth: true",
"no_auth: true",
"password: ''",
'password: ""',
This function automatically discovers config paths, reads their contents to infer security signals, and computes file metadata and SHA-256 digests for watched files and release artifacts. The code contains no confirmation prompt, user-facing logging, or explanatory comment/docstring disclosing that local configuration files may be inspected and hashed, which is relevant because those files can contain credentials or other sensitive data.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Detected: suspicious.exposed_secret_literal