Claw Code Suite (Python-Only Edition)

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:17 AM UTC
• Version: 1.0.1

Overview

The skill is an offline Python wrapper with stale or overstated documentation and local logging, but the packaged executable code does not show active network, credential, or destructive behavior.

Before installing, be aware that this skill is primarily a local Python harness and mirrored capability inventory, not a real full implementation of every advertised web/SSH/MCP tool. Do not put secrets in prompts or payloads unless you are comfortable with local JSONL/session retention, and treat the bundled security-verification scripts as smoke tests rather than proof of safety.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill claims no declared permissions while its documented capabilities include shell execution, filesystem read/write, environment-variable access, and references that suggest possible network-related functionality. Even if some modes are placeholders, the absence of explicit permission declarations prevents users and reviewers from accurately understanding the trust boundary and increases the chance of over-privileged execution or unsafe downstream use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented description emphasizes a purely offline analysis integration, but the skill also advertises telemetry logging, transcript persistence, execution shims, and remote/ssh/teleport-style modes beyond that narrow scope. This mismatch is security-relevant because users may provide sensitive code or prompts assuming a minimal local analyzer, while the skill can store data locally and expose broader execution/orchestration surfaces than disclosed.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The metadata materially misrepresents the implementation by claiming a Python-only integration while enumerating many TypeScript, TSX, and JavaScript sources. This is dangerous because trust and sandboxing decisions may be made from the manifest description, causing reviewers or automated policy gates to apply the wrong risk model and under-scrutinize active code paths.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill advertises no network access and purely offline operation, yet the indexed capabilities include names strongly suggesting browser automation, bridge functionality, PR workflows, desktop interaction, and upload behavior. Even if some commands are inert in practice, this mismatch is security-relevant because it can conceal higher-risk functionality from operators and automated allowlisting systems, leading to inappropriate deployment in restricted environments.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The README explicitly documents network-capable components such as an API client with OAuth and streaming support, which conflicts with the skill metadata claiming a purely offline, no-network toolset. In a security-sensitive agent environment, this kind of capability misrepresentation can lead operators to grant trust or deployment approval under false assumptions, increasing the risk of unexpected external communication or data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The repository is described as containing both Python and Rust implementations, while the skill metadata claims it is Python-only. This discrepancy undermines transparency about the executable surface area and may hide additional binaries, build steps, or behaviors that reviewers and sandbox policies did not account for.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The README frames the repository as Python-first and focused on porting, but also states that live API-path verification was performed and documents network-capable subsystems elsewhere. That contradiction makes the offline framing less trustworthy and increases the chance that users will underestimate the skill's ability to interact with external services.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The snapshot materially contradicts the stated skill metadata: it enumerates archived TypeScript-derived modules despite a claimed Python-only integration, and it includes clearly network-capable tools such as WebFetchTool, WebSearchTool, MCP-related tools, and RemoteTriggerTool despite the claim of purely offline operation. Even though this JSON is only reference data, such mismatched capability disclosure is dangerous because it can mislead reviewers, policy engines, or users into granting trust to a skill whose effective tool surface is broader than advertised.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The listed tools include capabilities for remote or web interaction that are not justified by the stated offline-only purpose, including WebFetchTool, WebSearchTool, MCP tools, ReadMcpResourceTool, ListMcpResourcesTool, RemoteTriggerTool, and scheduling/task primitives that can expand operational reach. In a security-sensitive agent environment, undocumented remote-capable tooling increases the risk of policy bypass, unintended data exposure, and trust-boundary violations because operators may rely on the offline claim when approving the skill.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Permission gating is implemented as a substring check for 'bash' in the tool name, which is a weak authorization control that can be trivially bypassed by differently named shell-capable or destructive tools. The code's comment-level intent suggests broad protection, but the actual enforcement only covers a naming convention, creating a false sense of safety.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The setup routine automatically initiates MDM raw reads and keychain prefetches during workspace initialization, which is inconsistent with the stated purpose of an offline code-analysis skill that claims no credentials are required. Triggering sensitive local data access as a side effect of setup materially expands the privilege boundary and could expose secrets or device-management data without clear user intent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code includes capabilities to read keychain and MDM data even though those capabilities are not justified by the described functionality of offline development workflows. In this context, the mismatch between declared scope and implemented behavior makes the access especially suspicious and increases the risk of unnecessary credential or system-information exposure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata claims the capability is purely offline with no network access, yet the exposed command set includes remote-mode, ssh-mode, teleport-mode, direct-connect-mode, and deep-link-mode. That discrepancy can mislead operators and calling agents into treating the tool as safe for offline-only use when it may initiate remote access paths through the underlying module.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Remote connection features are a dangerous expansion of trust for a skill presented as an offline security/code-quality harness. In this context, exposing network-oriented modes creates an unnecessary avenue for data exfiltration, pivoting, or unauthorized remote interaction if the backing module implements those commands.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: Advertising that no credentials are required is inconsistent with exposing ssh-mode, which commonly relies on keys, agent forwarding, known_hosts trust, or other credential material present on the host. This can cause users to underestimate the sensitivity of invoking the skill and may lead to unintended use of ambient credentials.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script presents itself as a security verification mechanism for absence of network code, servers, and credential handling, but it relies on narrow filename and grep heuristics that are easy to evade and do not provide comprehensive coverage. This can create false assurance for users or downstream automation, causing unsafe code to be trusted or promoted based on incomplete checks.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The success message makes a broad claim that the entire skill is clean, Python-only, and contains no network code, even though the script only performs a small set of superficial checks. In a security-sensitive context, this overclaim is dangerous because operators may rely on the output as evidence of safety and skip deeper review.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: bootstrap_session executes matched commands and tools directly from the prompt-routing result before any visible confirmation or safety interlock in this code path. In an agent orchestration context, prompt-driven automatic execution increases the risk of unintended local actions, especially since the skill advertises a large command/tool surface and the offline context does not reduce host-side execution risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Sensitive keychain and MDM reads are started in setup code without any visible user-facing warning, consent flow, or disclosure in this file. Even if the reads are local and offline, silently accessing security-sensitive stores undermines user expectations and can facilitate covert collection of secrets or device posture data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The harness logs command arguments, workspace paths, arbitrary context, and on completion/failure may persist full structured results and error details to a JSONL file without redaction or user consent. If callers place sensitive data in context or if command output contains secrets, local tokens, source paths, or proprietary code details, the event log becomes a durable data-exposure surface that can be read later by other local users, tools, or processes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The harness logs raw args, positional_args, flag_args, workspace, and context to a JSONL file on disk without redaction or user-facing disclosure. Because prompts, payloads, targets, and contextual metadata may contain secrets, proprietary code references, or operational details, this creates a local data exposure and retention risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script executes `./run.sh summary` from a user-writable directory without validating the file’s integrity or warning the user that arbitrary code in `run.sh` will be run. If an attacker replaced or tampered with that script, this verifier would directly execute the malicious payload under the current user account.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The loop repeatedly invokes `./run.sh` with several arguments, increasing the attack surface and number of opportunities for a malicious or trojaned `run.sh` to perform harmful actions. Because the script presents this as routine verification, a user may not realize they are authorizing multiple executions of untrusted code.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: as_markdown serializes highly sensitive runtime state, including the full prompt, system initialization text, stream events, model output, history, and persisted session path, into a portable text format. If this markdown is saved, shared, or exposed through logs or artifacts, it can leak sensitive user input, internal instructions, and execution details that facilitate further abuse or privacy violations.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The history log stores the full prompt text and persisted session path in plain-language entries, creating durable retention of potentially sensitive user input and local storage locations. Even in an offline tool, this can expose secrets, proprietary code fragments, or operational details to anyone with access to logs or exported session artifacts.

Static analysis

No suspicious patterns detected.