ClawHub
Back to skill

Security audit

Devin Floyd

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed security-scanner description with no bundled executable code, install hooks, credential access, or persistence behavior in the inspected artifact.

Review the linked repository or source package if you need the actual scanner implementation, because this artifact documents commands for scan.py but does not include that script. The inspected files themselves do not show malicious behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Credential Access

High
Category
Privilege Escalation
Content
|----------|----------|----------|
| 🔴 **Reverse Shells** | socket.connect(), pty.spawn(), /dev/tcp | Critical |
| 🔴 **Data Exfiltration** | requests.post() to suspicious TLDs | Critical |
| 🔴 **Credential Harvest** | Reading ~/.ssh/id_rsa, AWS credentials | Critical |
| 🔴 **Obfuscation** | base64.b64decode(exec), chr() chains | Critical |
| 🔴 **ClawHavoc IOCs** | glot.io scripts, fake Apple URLs, known C2 IPs | Critical |
| 🟠 **Code Execution** | exec(), eval(), subprocess | High |
Confidence
90% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The SKILL.md content claims to be an 'api-client' that performs HTTP requests, reads environment variables, and runs subprocesses, while the provided skill metadata identifies the skill as 'clawguard', a security scanner. This mismatch is dangerous because it can mislead reviewers and users about the skill’s true purpose, weakening trust and potentially hiding risky capabilities behind inaccurate documentation.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description is vague and overbroad, describing itself only as a 'helpful utility' without defining clear activation conditions, scope, or limitations. Ambiguous capability descriptions can cause a scanner or host agent to invoke the skill in unintended contexts, which increases the risk of misuse or concealment of harmful behavior behind generic wording.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The manifest description and markdown body describe the skill only as 'A utility helper' that 'Does helpful utility things,' which is too vague to define when the skill should or should not be invoked. This broad wording overlaps with general assistance requests and provides no specific trigger scope, constraints, or exclusion conditions.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill metadata and body describe a generic "system helper" that can be invoked for broad system tasks without clear scope boundaries. Overly broad invocation language increases the chance the skill will be selected for sensitive operations it was not explicitly designed or reviewed for, which can expand attack surface and enable misuse through prompt routing or operator confusion.

Static analysis

No suspicious patterns detected.