Security audit

Clawhub Upload

Security checks for vulnerabilities and agentic risk

Overview

This macOS security skill mostly performs local security checks, but it requests broad permissions and advertises app-blocking and many features that the reviewed code does not actually provide.

Review before installing. The basic checks are local macOS diagnostics, but the package asks for more permissions than the code appears to need and its documentation overstates security features. Do not rely on block-app or the advertised larger command set as protective controls in this version.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Note

Location: src/index.ts:50
Finding: Security command responses inject unrelated commercial promotions
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: src/index.ts:186
Finding: Declared security capabilities do not match implemented command behavior
Content: View full analysis
Block malicious app ``` It also provides an example claiming that an application was removed: ```md User: /block-app Malware MaclawPro: 🚨 BLOCKED Malware.app moved to Trash ``` The actual implementation performs no blocking, removal, process termination, permission change, or filesystem operation: ```ts export async function blockApp(appName: string): Promise { if (!appName) { return `❌ Please specify an app name\n\nUsage: /block-app `; } return `🛡️ **APP BLOCKING**\n\n` + `This feature requires **MaclawPro Pro** for secure app removal.\n\n` + `**MaclawPro Pro includes:**\n` + `• Instant app blocking\n` + `• Protected apps whitelist\n` + `• Reversible (moves to Trash)\n` + `• Multiple security layers\n\n` + `**Get MaclawPro Pro** ($49/year):\n` + `→ https://maclawpro.com/pricing\n\n` + `💼 **Enterprise?** Contact info@sequr.ca for custom solutions`; } ``` The documentation also advertises “52+ professional macOS security tasks,” while the implementation exports only these seven handlers: ```ts commands: { 'camera-status': cameraStatus, 'microphone-status': microphoneStatus, 'firewall-status': firewallStatus, 'vpn-checker': vpnChecker, 'open-ports': openPorts, 'wifi-scanner': wifiScanner, 'block-app': blockApp } ``` ### Technical Analysis The public interface and documentation represent the skill as providing application blocking, removal, real-time monitoring, and more than 52 security tasks. The reviewed implementation exposes seven handlers, and the handler registered as `block-app` only validates that a name was suppli ...[truncated 1476 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: package.json:52
Finding: Manifest requests filesystem and network permissions not used by the implementation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This is a real trust-boundary issue: the skill is framed as security monitoring, but the documented behavior includes shell/system command execution, access to sensitive host telemetry, and product-promotion behavior not reflected in the declared purpose. In an agent ecosystem, this kind of description-behavior mismatch can bypass user scrutiny and policy checks, leading to over-privileged installation or unsafe execution on the host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This is a real trust-boundary issue: the skill is framed as security monitoring, but the documented behavior includes shell/system command execution, access to sensitive host telemetry, and product-promotion behavior not reflected in the declared purpose. In an agent ecosystem, this kind of description-behavior mismatch can bypass user scrutiny and policy checks, leading to over-privileged installation or unsafe execution on the host.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code advertises app blocking and secure removal, but the function never blocks or removes anything and only returns promotional text. In a security product, this deception can cause operators to rely on a nonexistent containment control, delaying real mitigation against malicious software and increasing the chance of continued compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises a destructive command (/block-app <name>) and even shows an example where an app is moved to Trash, but it provides no warning, confirmation requirement, or scope limitations. In an agent/skill context, documenting destructive actions as one-step commands increases the chance of accidental or coerced removal of legitimate applications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented uninstall <name> command implies software removal capability without any warning about permanence, privilege needs, or risk of deleting the wrong target. In a security-themed skill, users may overtrust the command and trigger unintended system changes, making this more dangerous than a generic informational tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Advertising an app-blocking feature without a prominent warning about system impact is unsafe because users may invoke it expecting a harmless inspection command, when blocking applications can disrupt workflows or interfere with legitimate software. In a security-themed skill, users are more likely to trust forceful actions, which increases the risk of unintended denial-of-service against local applications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documented 'block-app ' command lacks user-facing safety guidance despite implying a potentially destructive action on the host. Without warnings, confirmation, or reversibility information, an agent or end user could trigger service disruption or block legitimate software under the assumption that the command is safe and routine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code file declares openPorts() and wifiScanner() functions, which imply network/system scanning that could affect privacy or reveal sensitive environment details. The declarations and adjacent comments provide no confirmation prompt, logging, or user-facing warning about these actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest context says the skill is for macOS security monitoring, which implies observing or reporting system state. The exported blockApp command adds an enforcement/modification capability rather than monitoring, expanding behavior beyond the described scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The blockApp(appName: string) function suggests changing system or application behavior in a way that may disrupt user workflows. In this code file, there is no visible warning, confirmation requirement, or explanatory disclosure indicating that the command can block an app.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The camera status check enumerates local process activity using lsof and infers camera usage without any user-facing disclosure, consent prompt, or privacy notice. In a security-monitoring skill this is somewhat expected, but silently inspecting sensitive device usage can expose application activity patterns and normalize covert local surveillance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The microphone status check inspects local process activity via lsof/coreaudiod matching without warning the user that sensitive device-usage information is being examined. Although aligned with the skill's stated security purpose, this still creates privacy risk because process and peripheral usage data may reveal user behavior or active applications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The open ports scan inspects listening TCP services on the host without any warning or consent flow. In a security tool this behavior is contextually relevant, but it still exposes local network-service posture and could reveal sensitive host details if output is logged or surfaced to unintended parties.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The WiFi scanner reads local network security configuration from system_profiler without any user-facing notice. While appropriate for a macOS security skill, collecting network configuration details silently can expose environment information and creates unnecessary privacy risk if handled without consent or transparency.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest context describes the skill as 'macOS security monitoring for OpenClaw', which implies observational/status-check functionality. The exported block-app capability and its documentation describe app blocking/removal features, which are a control/remediation function rather than monitoring and therefore exceed the stated monitoring scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill declares a sensitive combination of permissions: command execution, filesystem read, and network access. For a security-focused skill this may be operationally justified, but without any user-facing warning, justification, or permission minimization in the manifest, the skill could perform host inspection and outbound communication in ways users may not expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as a macOS security monitoring tool, but it exposes a command named 'block-app' that implies a defensive action while only returning marketing content. In a security context, misleading capability claims are dangerous because users may believe a risky or unwanted app can be blocked when no protective action occurs, creating a false sense of security during incident response.
Content: No source excerpt is available for this finding.

Excessive Permissions

Low

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Content: Scanner excerpt · README.md (reported line 111)May include surrounding context.
md
## 🔒 **Security & Privacy** **This skill requires the following permissions:** - `exec` - Run macOS security commands (lsof, ps, etc.) - `fs.read` - Read TCC database for permissions - `network` - Check network connections

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The inline documentation says 'Block app (simplified version)', which downplays the nature of the capability while the exported function is plainly named blockApp and accepts an app name to act upon. That documentation creates a potentially misleading impression about the command's intent and effect.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The comment and function name indicate that the code blocks an application, but the implementation does not block, remove, or otherwise affect any app. Instead, it only returns promotional text for a paid product, which directly contradicts the documented intent of the function.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 38)May include surrounding context.
json
"node": ">=18.0.0" }, "devDependencies": { "@types/node": "^20.11.17", "typescript": "^5.3.3" }, "openclaw": {

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 39)May include surrounding context.
json
}, "devDependencies": { "@types/node": "^20.11.17", "typescript": "^5.3.3" }, "openclaw": { "displayName": "MaclawPro Security",

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This is a manifest file, so vague-trigger checks apply. The command list includes generic invocations such as "block-app" and "vpn-checker" without any description of when they should be used, what arguments they expect, or exclusion conditions, which can make activation scope unclear.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.