Sudo Tool

WarnAudited by ClawScan on May 10, 2026.

Overview

The skill is transparent about being a sudo/root command runner, but it gives an agent broad system-changing power without clear safeguards.

Install only if you intentionally want the agent to have sudo-like power. Treat every command as high impact, require explicit approval before execution, and prefer tight sudoers restrictions or safer scoped administration tools.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI02: Tool Misuse and Exploitation

What this means

If invoked incorrectly, the agent could run a privileged command that changes, damages, or exposes parts of the local system.

Why it was flagged

The skill defines an arbitrary command interface that can run with elevated privileges, but the artifacts do not bound which commands may run or require explicit per-command approval.

Skill content

Execute commands with root or other user privileges... sudo-tool [options] <command>

Recommendation

Only use this with explicit user confirmation for each command, least-privilege sudoers rules, and a clear understanding of the exact command being run.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may act with root-level or other-user permissions if the local sudoers configuration allows it.

Why it was flagged

The skill depends on local sudo authority and can cross user privilege boundaries. This is expected for the stated purpose, but it is sensitive authority.

Skill content

Requires proper authorization through /etc/sudoers configuration... -u user: Run as specified user (default: root)

Recommendation

Review sudoers permissions before use and restrict the agent to only the specific administrative commands you intend to allow.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users cannot confirm from the supplied registry metadata where the privileged tool behavior comes from.

Why it was flagged

For a skill intended to invoke superuser commands, the lack of source or homepage provenance makes it harder to verify the origin or intended implementation.

Skill content

Source: unknown; Homepage: none

Recommendation

Verify the installed command path and provenance locally before granting it sudo-capable use.