T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/engine.py:169- Finding
Potential Secrets Are Persisted in Plaintext Without Redaction or Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
clawguard
Security checks for vulnerabilities and agentic risk
Overview
clawguard is a local security-review skill whose behavior matches its stated purpose, with a privacy caveat because saved reports can include source excerpts.
Before installing, understand that clawguard saves local review reports and those reports may preserve snippets from files it scans. Do not point it at broad private directories or files containing real credentials unless you are comfortable with those snippets being copied into the local workspace report store.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose describes a substantive security review and risk auditing capability. The supplied code chunk only initializes storage and outputs the reports path. While storage setup could be a supporting utility for a larger auditing system, this chunk by itself does not implement the declared auditing behavior and instead has a materially different immediate purpose: filesystem/storage initialization.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md Administrator privileges, sensitive path access, and system-level modification tendencies. “自动修复”“绕过限制”“无需审查直接执行”等高风险表述。 High-risk claims such as “auto-fix,” “bypass restrictions,” or “execute without review.” ## 输出形式 ## Output
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
json Administrator privileges, sensitive path access, and system-level modification tendencies. “自动修复”“绕过限制”“无需审查直接执行”等高风险表述。 High-risk claims such as “auto-fix,” “bypass restrictions,” or “execute without review.” ## 输出形式 ## Output
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md Administrator privileges, sensitive path access, and system-level modification tendencies. “自动修复”“绕过限制”“无需审查直接执行”等高风险表述。 High-risk claims such as “auto-fix,” “bypass restrictions,” or “execute without review.” ## 输出形式 ## Output
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
json Administrator privileges, sensitive path access, and system-level modification tendencies. “自动修复”“绕过限制”“无需审查直接执行”等高风险表述。 High-risk claims such as “auto-fix,” “bypass restrictions,” or “execute without review.” ## 输出形式 ## Output
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code creates a workspace storage directory and initializes a persistent JSON file, but it provides no confirmation prompt, logging, or explanatory comment/docstring to disclose that report data will be written to disk. Because file persistence can affect user data handling and privacy, the lack of any visible warning meets the missing-user-warning criterion for code files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The save_report function modifies in-memory report data and rewrites the reports.json file, which is a file write operation affecting persistent user/workspace state. There is no confirmation, logging, or explanatory documentation in the code indicating that existing stored data may be updated or replaced.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON manifest contains natural-language exclusion examples in Chinese alongside English text, but it does not explain whether multilingual handling is intentional or user-selectable. Under the language/locale policy criterion, embedding a specific language without documented opt-in can be a minor policy concern.
- Content
Static analysis
No suspicious patterns detected.