Smartclaws Producer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 1.0.1

Overview

The skill is coherent with its IoT publishing purpose, but it needs review because it installs an unverified remote binary and suggests persistent and privileged host changes.

Review the install and host-permission steps before using this skill. Prefer a pinned SmartClaws release with checksum or signature verification, install into a user-owned bin directory, avoid granting CAP_NET_RAW to the system Python interpreter unless you understand the host-wide effect, and remember that enabling the systemd service will keep publishing sensor data in the background across sessions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45

Finding

Unverified Mutable Remote Binary Download and Execution

Content

View full analysis

Remediation

View remediation

" URL="https://github.com/skalenetwork/smartclaws/releases/download/${VERSION}/smartclaws-${PLATFORM}" curl --fail --location --proto '=https' --tlsv1.2 \ --output smartclaws.download "$URL" printf '%s %s\n' "$EXPECTED_SHA256" smartclaws.download | sha256sum --check - install -m 0755 smartclaws.download "$HOME/.local/bin/smartclaws" rm -f smartclaws.download ``` 4. Prefer a signed release manifest and verify its signature against a maintainer key distributed through a separate trusted channel. 5. Download to a temporary non-executable file and install it only after successful verification. 6. Prefer a user-owned installation directory such as `~/.local/bin`; do not suggest elevating the download command itself. 7. Document the exact expected version and fail closed if signature or checksum verification does not succeed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:322

Finding

Shared Python Interpreter Granted Excessive Raw-Network Capabilities

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

PLATFORM="$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed 's/aarch64/arm64/')" curl -fL -o /usr/local/bin/smartclaws
"https://github.com/skalenetwork/smartclaws/releases/latest/download/smartclaws-${PLATFORM}" chmod +x /usr/local/bin/smartclaws

text

If `/usr/local/bin` requires root, use `~/.local/bin/smartclaws` instead and ensure it's on PATH.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands for installation, wallet setup, device registration, and service management, but it declares no explicit tool scope or permission boundaries. That increases the chance an agent will execute impactful commands without a clear authorization model or user confirmation, especially because the workflow includes network access, filesystem writes, and service persistence.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill downloads and installs an executable directly from a remote URL using curl and immediately marks it executable, with no checksum, signature, or pinned version verification. If the release channel, network path, or upstream repository is compromised, the user could install and run malicious code.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

bash

PLATFORM="$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed 's/aarch64/arm64/')"
curl -fL -o /usr/local/bin/smartclaws \
  "https://github.com/skalenetwork/smartclaws/releases/latest/download/smartclaws-${PLATFORM}"
chmod +x /usr/local/bin/smartclaws

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md

2. If the model or protocol is missing, ask the user.
3. Look up the sensor's pairing / reading instructions.
4. Determine the required Python package, system dependency, permissions, and read method.
5. Only then write a hardware-specific publisher script.

Never substitute mock data unless the user explicitly asks for a simulation or test publisher.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs enabling a persistent systemd user service, causing the publisher to auto-start and continue running across sessions. Persistence is not inherently malicious here, but it is a sensitive capability because it creates long-lived background execution that can continue transmitting data or running modified scripts.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

EOF

systemctl --user daemon-reload systemctl --user enable --now smartclaws-

text

Check status: `systemctl --user status smartclaws-<device-name>`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The instruction uses sudo to modify interpreter capabilities, which is a privileged host change. Even though it is framed as a troubleshooting step, it can materially alter system security posture and may enable unintended access for unrelated Python programs.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md

| `Device 'X' is already registered.` | Duplicate name | Use a different name or check `smartclaws device list` |
| `Device 'X' not found.` | Wrong device name for publish | Check `smartclaws device list` |
| `Invalid JSON payload.` | Malformed --data argument | Ensure valid JSON, e.g. `'{"temp": 22.5}'` |
| BLE permission denied | Linux BLE requires capabilities | `sudo setcap cap_net_raw+eip $(which python3)` |
| BLE connection timeout | Sensor out of range or asleep | Move closer, retry. BLE range is ~10m |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill recommends a privileged capability change (sudo setcap cap_net_raw+eip $(which python3)) without a prominent safety warning about the security implications. Granting network capabilities to the system Python interpreter broadens what any Python script can do and can unintentionally weaken host security beyond this single use case.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · examples/ble-publisher.py (reported line 39)May include surrounding context.

python

def publish(device: str, topic: str, payload: dict) -> bool:
    """Publish a reading to SmartClaws via CLI."""
    result = subprocess.run(
        [
            SMARTCLAWS, "publish",
            "--device", device,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · examples/mock-publisher.py (reported line 34)May include surrounding context.

python

def publish(payload):
    result = subprocess.run(
        [
            SMARTCLAWS, "publish",
            "--device", DEVICE,

Static analysis

No suspicious patterns detected.