T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:116- Finding
Persistent and Excessively Broad Email-Read Authorization
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate Clawvisor gateway skill, but it documents broad, persistent, automatic access to sensitive services such as Gmail and should be reviewed carefully before installation.
Install only if you trust Clawvisor and are comfortable giving it mediated access to the connected services. Use a dedicated scoped agent token, prefer short-lived narrowly scoped tasks, avoid standing all-mailbox authorizations unless truly needed, require approval for writes and sensitive reads, review the included policies, and pin or verify the self-hosted Clawvisor version before running setup commands.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
README.md:21- Finding
Execution of an Unpinned Remote Repository During Setup
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md ped to only the services you need, and rotate or revoke it immediately if compromised. --- ## Overview Clawvisor is a gatekeeper between you and external services. Every action goes through Clawvisor, which checks restrictions, validates task scopes, injects credentials, optionally routes to the user for approval, and returns a clean semantic result. You never hold API keys. The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. --- ## Typical Flow > **Execute all curl commands as a single line.** The examples below are formatted for readability, but when you run them, inline everything — URL, headers, and
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md - **Always execute curl commands as a single line** — the examples in this document are multi-line for readability, but when running them, inline all variables, headers, and JSON bodies into one command. Never use `\` line continuations, heredocs, or separate variable assignments — each triggers a separate approval prompt. - Always fetch the catalog first to know what's available and restricted - Never attempt to bypass restrictions — they are hard blocks set by the user - Always create a task before making gateway requests - Use `auto_execute: false` for any action that sends, modifies, or deletes data - Generate unique request_ids for every gateway request
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md - **Always execute curl commands as a single line** — the examples in this document are multi-line for readability, but when running them, inline all variables, headers, and JSON bodies into one command. Never use `\` line continuations, heredocs, or separate variable assignments — each triggers a separate approval prompt. - Always fetch the catalog first to know what's available and restricted - Never attempt to bypass restrictions — they are hard blocks set by the user - Always create a task before making gateway requests - Use `auto_execute: false` for any action that sends, modifies, or deletes data - Generate unique request_ids for every gateway request
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The authorization model has two layers — applied in order: 1. **Restrictions** — hard blocks the user sets. If a restriction matches, the action is blocked immediately. 2. **Tasks** — scopes you declare. Every request must be attached to an approved task. If the action is in scope with `auto_execute`, it runs without approval. Actions with `auto_execute: false` still go to the user for per-request approval within the task. ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill instructs agents to execute one-line curl commands containing authorization headers and JSON bodies, which can expose the high-privilege CLAWVISOR_AGENT_TOKEN to shell history, process listings, logs, transcripts, or approval surfaces. The surrounding setup explicitly acknowledges the token is high privilege, so encouraging direct command-line use materially increases credential leakage risk.
- Content
md ## Typical Flow > **Execute all curl commands as a single line.** The examples below are formatted for readability, but when you run them, inline everything — URL, headers, and JSON body — into one `curl` command. Do not use `\` line continuations, heredocs, shell variables, or separate assignment statements. Multi-line commands trigger a separate approval prompt for each line. 1. Fetch the catalog — confirm the service is active and the action isn't restricted 2. Create a task with `POST /api/tasks?wait=true` — this blocks until the user approves
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 1. Fetch the catalog — confirm the service is active and the action isn't restricted 2. Create a task with `POST /api/tasks?wait=true` — this blocks until the user approves 3. Make gateway requests with `POST /api/gateway/request?wait=true` — in-scope auto-execute actions return immediately; actions requiring approval block until approved and return the result 4. Mark the task complete when done ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The documented ability to set verification to 'off' or 'lenient' for an authorized action weakens a key safeguard against prompt injection and scope drift. In a skill that can access Gmail, Calendar, Drive, Contacts, GitHub, and iMessage, disabling or reducing verification materially increases the chance that malicious external content influences actions within a broad approved scope.
- Content
md - **`purpose`** — shown at approval and checked by intent verification. Capability statement covering the workflow's natural follow-ups. Size to task complexity (see below). - **`expected_use`** — per-action description checked against your actual request params. Cover the scenarios you'll use in this task. - **`auto_execute`** — `true` runs in-scope requests immediately; `false` still requires per-request approval (use for destructive actions like `send_message`). - **`verification`** *(optional)* — per-scope intent verification mode: `"strict"` (default), `"lenient"`, or `"off"`. Use `"lenient"` for read/search scopes where strict mode frequently flags benign variation. The user can override this at approval and edit it anytime after. - **`expires_in_seconds`** — task TTL. Omit and set `"lifetime": "standing"` for a task that persists until the user revokes it (see below). Use `"lifetime": "sliding"` for a workflow whose end time is unpredictable — the TTL auto-extends by 10 min on each authorized tool_use, so the task expires only after the agent goes idle. - **`planned_calls`** *(optional)* — pre-register specific API calls you know you'll make. Planned calls are shown to the user during approval, evaluated as part of risk assessment, and **skip intent verification at runtime** when they match. This reduces latency for predictable workflows. Each entry must be covered by `authorized_actions` and must include `params`. Use exact values for known params, or `"$chain"` for values that will come from a prior call's results (e.g. `{"thread_id": "$chain"}`). Calls without params cannot skip verification.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The skill states that planned calls matching pre-registered params skip intent verification at runtime. While this may reduce latency, it weakens a security control and creates a path where a compromised or manipulated agent can execute pre-authorized requests with less scrutiny, especially for sensitive read operations.
- Content
md - **`auto_execute`** — `true` runs in-scope requests immediately; `false` still requires per-request approval (use for destructive actions like `send_message`). - **`verification`** *(optional)* — per-scope intent verification mode: `"strict"` (default), `"lenient"`, or `"off"`. Use `"lenient"` for read/search scopes where strict mode frequently flags benign variation. The user can override this at approval and edit it anytime after. - **`expires_in_seconds`** — task TTL. Omit and set `"lifetime": "standing"` for a task that persists until the user revokes it (see below). Use `"lifetime": "sliding"` for a workflow whose end time is unpredictable — the TTL auto-extends by 10 min on each authorized tool_use, so the task expires only after the agent goes idle. - **`planned_calls`** *(optional)* — pre-register specific API calls you know you'll make. Planned calls are shown to the user during approval, evaluated as part of risk assessment, and **skip intent verification at runtime** when they match. This reduces latency for predictable workflows. Each entry must be covered by `authorized_actions` and must include `params`. Use exact values for known params, or `"$chain"` for values that will come from a prior call's results (e.g. `{"thread_id": "$chain"}`). Calls without params cannot skip verification. ### Sizing scope to task complexity
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
This standing-task example authorizes extremely broad Gmail search across any sender, topic, and time with auto_execute enabled, and the purpose explicitly covers 'ALL email read operations.' Such a persistent, expansive read scope significantly enlarges blast radius if the agent is compromised or manipulated by prompt injection, since many future reads can occur without fresh user approval.
- Content
md "purpose": "Full executive assistant email management. Includes: inbox triage and prioritization, searching emails by any criteria (sender, recipient, company name, topic, subject keywords, date ranges, labels, read/unread status, or any Gmail query syntax), reading individual email bodies for full context and action items, tracking thread status and follow-ups across all senders and topics, researching email history on ad-hoc requests, monitoring for time-sensitive items, auditing intro/outreach status for specific companies or people, and surfacing anything requiring attention. This task covers ALL email read operations the user or their automated workflows may request.", "lifetime": "standing", "authorized_actions": [ {"service": "google.gmail:user@example.com", "action": "list_messages", "auto_execute": true, "expected_use": "Search and list emails using any Gmail query syntax: by sender, recipient, company name, subject keywords, date ranges (newer_than, older_than, before, after), labels, read/unread status, thread ID, or any combination. Used for inbox triage, follow-ups on hiring, intro status monitoring, deal research, investor correspondence tracking, scheduling and thread discovery, and any ad-hoc email search for any company, person, or topic at any time."}, {"service": "google.gmail:user@example.com", "action": "get_message", "auto_execute": true, "expected_use": "Read full email content for any message found via list_messages or referenced by message ID. Used to understand full context, extract action items, check reply status, draft summaries, track intro chains, audit follow-ups, and provide detailed email content to the user on request. Will read emails from any sender, about any topic, at any time as needed for triage, research, and executive assistant workflows."} ] }'
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The paired get_message authorization allows reading full message content for any discovered message, at any time, under a standing task with auto_execute. Combined with the broad list_messages scope, this creates persistent high-volume access to sensitive mailbox contents without per-request approval, increasing exposure to data exfiltration and privacy violations.
- Content
"lifetime": "standing", "authorized_actions": [ {"service": "google.gmail:user@example.com", "action": "list_messages", "auto_execute": true, "expected_use": "Search and list emails using any Gmail query syntax: by sender, recipient, company name, subject keywords, date ranges (newer_than, older_than, before, after), labels, read/unread status, thread ID, or any combination. Used for inbox triage, follow-ups on hiring, intro status monitoring, deal research, investor correspondence tracking, scheduling and thread discovery, and any ad-hoc email search for any company, person, or topic at any time."}, {"service": "google.gmail:user@example.com", "action": "get_message", "auto_execute": true, "expected_use": "Read full email content for any message found via list_messages or referenced by message ID. Used to understand full context, extract action items, check reply status, draft summaries, track intro chains, audit follow-ups, and provide detailed email content to the user on request. Will read emails from any sender, about any topic, at any time as needed for triage, research, and executive assistant workflows."} ] }'
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The batch curl example again embeds a bearer token in a command intended for execution, creating the same leakage channel through shell history, process inspection, logs, and captured transcripts. Because this endpoint can multiplex many service actions, compromise of the token could enable broad unauthorized access across connected services.
- Content
saving one round-trip per sub-request.
bash curl -s -X POST "$CLAWVISOR_URL/api/gateway/batch?wait=true" \ -H "Authorization: Bearer $CLAWVISOR_AGENT_TOKEN" \ -H "Content-Type: application/json" \ -d '{"requests": [
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
This summary explicitly states that planned calls with auto_execute are executed while skipping verification. The danger is contextual: because the skill mediates access to multiple sensitive services, normalized verification bypasses can become an exploitable gap if an attacker can influence task creation or planned call contents.
- Content
md | Condition | Gateway `status` | |---|---| | Restriction matches | `blocked` | | Task in scope + `auto_execute` + matches planned call | `executed` (skips verification) | | Task in scope + `auto_execute` + verification passes | `executed` | | Task in scope + `auto_execute` + verification fails | `restricted` | | Task in scope + `auto_execute: false` | `pending` (per-request approval) |