ClawHub
Back to skill

Security audit

Security Skill Scanner

Security checks for vulnerabilities and agentic risk

Overview

The skill is framed as a security scanner, but it asks users to add persistent cron jobs and a shell wrapper that intercepts future install commands using scripts that are not included in the artifact.

Review this carefully before installing. The artifact does not include the scanner, hook, whitelist, or monitor scripts it tells users to run. Do not add the cron jobs or shell-profile molthub wrapper unless you have independently verified the referenced files, their ownership and permissions, and a clear removal path; prefer running any scanner explicitly under a non-root account.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:79
Finding

Optional Cron Configuration Establishes Persistent Privileged Execution

Content
View full analysis
> /var/log/skill-scan.log 2>&1 # Moltbook monitor every 30 min */30 * * * * bash /root/clawd/skills/security-skill-scanner/moltbook-monitor.sh >> /var/log/moltbook-monitor.log 2>&1 ``` ``` ### Technical Analysis The documentation instructs users to register two recurring cron jobs. These jobs survive the original skill invocation and execute files from `/root/clawd/skills/security-skill-scanner/` every day or every 30 minutes. Automated scheduling is consistent with the advertised daily reporting and continuous monitoring features, and the instructions mark it as optional. Nevertheless, persistence is not necessary for the skill's core on-demand scanning function. The use of `/root` and `/var/log` paths also encourages deployment in a privileged context rather than under a dedicated, least-privileged account. The referenced `skill-scanner.py` and `moltbook-monitor.sh` files are absent from the audited project. Their integrity, network activity, command execution, and data-handling behavior therefore cannot be verified. If these paths are writable or their contents are later replaced, cron will repeatedly execute the replacement with the privileges of the crontab owner. ### Attack Path 1. A user follows the documentation and adds the provided entries to a crontab. 2. The entries remain active across shell sessions and system restarts where cron is enabled. 3. A script is subsequently placed at, or replaces a file at, one of the referenced paths. 4. Cron executes that script at the configured interval without further user confirmation. 5. If the entries were added to root's crontab, the substituted code e ...[truncated 690 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
SKILL.md:107
Finding

Persistent Shell Function Shadows and Intercepts the Molthub Tool

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
| Category | Patterns |
|----------|----------|
| Credential Theft | .env access, webhook.site, POST secrets |
| Command Injection | os.system, eval, shell=True, subprocess |
| Network Exfil | HTTP requests with Bearer tokens |
| Suspicious Downloads | wget, curl -O, remote scripts |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
| Category | Patterns |
|----------|----------|
| Credential Theft | .env access, webhook.site, POST secrets |
| Command Injection | os.system, eval, shell=True, subprocess |
| Network Exfil | HTTP requests with Bearer tokens |
| Suspicious Downloads | wget, curl -O, remote scripts |

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill advises users to add a shell-function wrapper to ~/.bashrc or ~/.zshrc, creating persistent interception of future 'molthub install/add' commands. Even though framed as a security feature, persistence in shell startup files changes command behavior system-wide and could be abused if the referenced hook script is modified, replaced, or behaves unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Add to your shell profile for automatic scanning on every install:

bash
# Add to ~/.bashrc or ~/.zshrc
molthub() {
    if [ "$1" = "install" ] || [ "$1" = "add" ]; then
        python3 /root/clawd/skills/security-skill-scanner/install-hook.py "$2" --interactive

Static analysis

No suspicious patterns detected.