Security audit

Claw Secure Auditor

Security checks for vulnerabilities and agentic risk

Overview

This security-auditor skill is read-only, but it can give misleading safety results because it skips scanning a self-named target and advertises full checks that are not implemented.

Treat this as a Review item before installing. It appears read-only, but do not rely on its audit verdicts for security decisions until the self-whitelist is removed, full/sandbox/VirusTotal claims are either implemented or removed, and the unnecessary dependency/API-key requirement is cleaned up.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/auditor.py:79
Finding: Directory-name-based self-whitelist bypasses all security scanning
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/auditor.py:196
Finding: Advertised full, sandbox, and VirusTotal analysis is not implemented
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auditor.py:120
Finding: Silent exception handling causes file scanning to fail open
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unused dependency is installed without a version or integrity pin
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented feature Self-whitelist: auto-mark self as safe is a strong integrity violation for a security auditor because it intentionally biases scan results in favor of the tool's own package. In a security context, self-exemption undermines trust, can conceal unsafe behavior, and may be used to evade detection while presenting the tool as authoritative.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auditor.py (reported line 46)May include surrounding context.
python
r"ignore.*previous", # Network/data exfiltration r"echo.*\$[A-Z_]+", r"cat.*\.env", # Privilege escalation r"sudo", ]

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest and code position the tool as a security auditor with reputation scoring, but the implementation grants a guaranteed perfect score and safe risk level to a whitelisted skill without inspection. This is a trust-boundary violation: consumers may rely on the reported safety status, yet the result is fabricated for that target rather than derived from evidence.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The auditor contains a self-whitelist that bypasses all analysis and automatically marks the skill as safe when the target directory name matches "claw-secure-auditor". In a security tool, unconditional trust logic defeats the core assurance claim and can hide real issues in the whitelisted target, especially because the output explicitly presents the result as a completed audit.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable usage via python3 scripts/auditor.py ... and its metadata declares a Python runtime dependency, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an implicit capability gap: consumers and platforms cannot clearly constrain or understand that the skill needs file-read and shell-like execution, which weakens review and sandboxing expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This code recursively enumerates every file beneath the user-supplied target and reads file contents, which can expose sensitive local data during execution. Although the tool is an auditor, the code itself provides no explicit warning in comments, docstrings, or prompts that it will traverse and read all files in the specified path.
Content: No source excerpt is available for this finding.