ClawHub
Back to skill

Security audit

T3 Code

Security checks for vulnerabilities and agentic risk

Overview

This setup guide needs review because its unattended server examples can run newly published software without a separate update decision.

Before enabling a background server, choose a specific reviewed T3 release and configure the service to run that installed executable. Approve updates separately, retain a working version for rollback, and confirm who can access each remote server. The remaining persistence and privilege warnings are explained by the disclosed setup workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
- Read `references/windows-remote.md` when a remote T3 backend runs on Windows.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/multi-machine.md (reported line 60)May include surrounding context.

If the result is Linger=no and the service must survive logout, get explicit operator approval before running:

bash
sudo loginctl enable-linger "$USER"
loginctl show-user "$USER" -p Linger

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/multi-machine.md (reported line 111)May include surrounding context.

bash
systemctl --user daemon-reload
systemctl --user enable --now t3-code.service
systemctl --user status t3-code.service --no-pager
ss -ltn 'sport = :3773'

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/multi-machine.md (reported line 163)May include surrounding context.

bash
systemctl --user daemon-reload
systemctl --user enable --now t3-code-tunnel-remote.service
systemctl --user status t3-code-tunnel-remote.service --no-pager
journalctl --user -u t3-code-tunnel-remote.service -n 100 --no-pager

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/project-state.md (reported line 75)May include surrounding context.

bash
   git -C /path/to/repository check-ignore -q .idea/icon.svg
  1. Do not add a personal or organization-specific icon to a shared repository without approval.

Stale desktop selections

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/remote-tailscale.md (reported line 90)May include surrounding context.

bash
chmod +x "$HOME/.local/bin/t3-code-serve"
systemctl --user daemon-reload
systemctl --user enable --now t3-code.service
systemctl --user status t3-code.service --no-pager
journalctl --user -u t3-code.service -n 100 --no-pager

MCP server referenced without pinned version: 'npx t3'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx t3'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx t3'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx t3'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes t3'.

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The unattended server command combines automatic installation approval with the mutable latest tag. If retained as a service launch command, subsequent starts can resolve and execute a different release without a separate approval step, potentially introducing compromised code or incompatible changes; loopback binding does not mitigate local package execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes t3'.

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The unattended headless command automatically approves execution of a package selected through the mutable nightly tag. User acceptance of development-channel risk and a rollback plan reduce surprise but do not prevent later service starts from executing a newly published, unreviewed build.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/updates-and-launchers.md (reported line 140)May include surrounding context.

bash
systemctl --user daemon-reload
systemctl --user enable --now t3-update.timer
systemctl --user list-timers --all | grep t3
journalctl --user -u t3-update.service -n 100 --no-pager