Security audit

Ghostclaw Clone

Security checks for vulnerabilities and agentic risk

Overview

Ghostclaw is a coherent architecture-review tool, but normal analysis can automatically run Python plugins from the repository being analyzed.

Install only in an isolated environment and analyze repositories you trust, or first remove/disable any `.ghostclaw/plugins` directory in target repos. Review the npm postinstall PATH change, optional systemd service, and `--create-pr` behavior before enabling them; use `--no-write-report` when you do not want local reports saved.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: src/ghostclaw/core/analyzer/__init__.py:216
Finding: Automatic Execution of Repository-Controlled Python Plugins
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements-dev.txt:1
Finding: Non-Reproducible Installation of Unbounded Third-Party Dependencies
Content: View full analysis
=9.0.0 pytest-cov>=6.0.0 pytest-mock>=3.14.0 pytest-asyncio>=0.24.0 pytest-xdist>=3.6.0 mcp>=1.1.0 ai-codeindex>=0.2.0 pyscn>=0.2.0 pyinstaller>=6.0.0 ruff>=0.9.0 lizard>=1.21.2 # Include regular dependencies for full dev environment python-dotenv>=1.0.0 requests>=2.32.5 pydantic-settings>=2.13.1 httpx>=0.28.1 tenacity>=9.0.0 rich>=14.3.0 tiktoken>=0.7.0 openai>=1.50.0 anthropic>=0.40.0 ``` ```json // package.json:9 "install-deps": "pip install -r requirements-dev.txt" ``` ```toml # pyproject.toml:25-44 dependencies = [ "pyyaml>=6.0.3", "python-dotenv>=1.0.0", "requests>=2.32.5", "pydantic-settings>=2.13.1", "httpx>=0.28.1", "tenacity>=9.0.0", "rich>=14.3.0", "tiktoken>=0.7.0", "openai>=1.50.0", "anthropic>=0.40.0", "pluggy>=1.0.0", "aiosqlite>=0.20.0", "lizard>=1.21.2", ] ``` ```bash # scripts/install.sh:17-21 pip install --upgrade pip pip install -e . # Install PyInstaller pip install pyinstaller ``` ### Technical Analysis The documented installation process resolves many packages using lower-bound-only constraints such as `>=`. No reviewed upper bounds, exact lock file, or package hashes are enforced. The build script also installs the latest available PyInstaller independently. Consequently, two users following the same installation instructions at different times may execute materially different package versions. A future compromised, malicious, or unexpectedly incompatible release satisfying the lower-bound constraint can be selected automatically. Python package installation may execute build backend or installation-related code. Therefore, dependency resol ...[truncated 1666 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (264)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Report serialization to the local filesystem for CI/CD or API consumption is a side effect that expands data handling beyond the declared purpose. In this context the risk is moderate: report files may leak repository metadata or accumulate in sensitive locations if writes are not clearly bounded.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/ghostclaw/cli/commands/debug/console.py:62

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/ghostclaw/core/adapters/registry.py:136

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/ghostclaw/core/llm_client/__init__.py:51