ClawHub
Back to skill

Security audit

ClawGuard Scanner

Security checks for vulnerabilities and agentic risk

Overview

This security-scanner skill is coherent in purpose, but it asks agents to run or globally install an unpinned npm package without enough containment or user warning.

Review this before installing. The skill's goal is legitimate, but you should only run ClawGuard from a pinned, verified version and preferably inside a sandbox with read-only access to the target skill directory. Avoid the global install path unless you trust the package source and understand it will persist on the host.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:23
Finding

Unpinned Third-Party npm Package Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–37 and 78–80
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

bash
# Lines 23–26
Run the following command on the skill directory:

npx clawguard scan <path-to-skill-directory>

# Lines 29–32
For JSON output (useful for programmatic analysis):

npx clawguard scan <path-to-skill-directory> --json

# Lines 35–38
To check only specific rules:

npx clawguard scan <path-to-skill-directory> --rules prompt-injection,data-exfiltration

# Lines 78–80
- Always scan BEFORE installation, never after
- If ClawGuard is not installed, run `npm install -g clawguard` first

Technical Analysis

The Skill directs the agent to execute clawguard through npx or install it globally without specifying an exact version, integrity value, lockfile, or verified artifact. If the package is absent locally, npx can retrieve the current package release from the configured npm registry and execute its CLI, including applicable package lifecycle behavior, with the invoking user's permissions.

Consequently, the code executed during a future scan is not fixed to the artifact reviewed here and may change after this audit. A compromised maintainer account, registry package compromise, malicious future release, or poisoned registry configuration could turn the mandatory security scan into a supply-chain execution channel.

The scanner legitimately requires access to the directory being audited, but unrestricted execution under the agent's normal account can expose substantially more resources than that purpose requires. The global installation instruction is also unnecessary for ordinary scanning and creates a persistent user- or system-level package installation.

The references to ~/.ssh, ~/.aws, and curl | sh elsewhere in SKILL.md are descriptions of patterns the scanner detects. They do not themsel ...[truncated 1516 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the scanner to a reviewed exact version, for example npx --yes clawguard@0.1.0 scan ..., rather than resolving the latest release implicitly.
  2. Verify the selected package version, publisher, provenance, and registry integrity metadata before documenting it.
  3. Prefer a project-local dependency governed by a committed lockfile and integrity hashes over an ad hoc or global installation.
  4. Remove the npm install -g clawguard instruction. If installation is required, use an isolated temporary project or a reproducible container image.
  5. Run the scanner in a sandbox with read-only access limited to the target directory. Deny access to SSH keys, cloud credentials, unrelated home-directory files, and unnecessary environment variables.
  6. Disable network access during the actual scan where feasible, separating verified package acquisition from package execution.
  7. Re-audit the package and update the pinned version deliberately when upgrades are required. Version pinning alone does not establish trust; the pinned artifact must also be reviewed or cryptographically verified.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
| CRITICAL | `data-exfiltration` — reading sensitive files (~/.ssh, ~/.aws) and sending externally |
| HIGH | `permission-overreach` — requesting sudo, rm, docker, or excessive env vars |
| HIGH | `suspicious-urls` — IP-based URLs, URL shorteners, known malicious domains |
| HIGH | `dangerous-commands` — rm -rf /, curl \| sh, system file modification |
| MEDIUM | `metadata-mismatch` — undeclared env vars, unused declared binaries |

## How to respond to scan results

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
| CRITICAL | `data-exfiltration` — reading sensitive files (~/.ssh, ~/.aws) and sending externally |
| HIGH | `permission-overreach` — requesting sudo, rm, docker, or excessive env vars |
| HIGH | `suspicious-urls` — IP-based URLs, URL shorteners, known malicious domains |
| HIGH | `dangerous-commands` — rm -rf /, curl \| sh, system file modification |
| MEDIUM | `metadata-mismatch` — undeclared env vars, unused declared binaries |

## How to respond to scan results

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
| CRITICAL | `data-exfiltration` — reading sensitive files (~/.ssh, ~/.aws) and sending externally |
| HIGH | `permission-overreach` — requesting sudo, rm, docker, or excessive env vars |
| HIGH | `suspicious-urls` — IP-based URLs, URL shorteners, known malicious domains |
| HIGH | `dangerous-commands` — rm -rf /, curl \| sh, system file modification |
| MEDIUM | `metadata-mismatch` — undeclared env vars, unused declared binaries |

## How to respond to scan results

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
| CRITICAL | `data-exfiltration` — reading sensitive files (~/.ssh, ~/.aws) and sending externally |
| HIGH | `permission-overreach` — requesting sudo, rm, docker, or excessive env vars |
| HIGH | `suspicious-urls` — IP-based URLs, URL shorteners, known malicious domains |
| HIGH | `dangerous-commands` — rm -rf /, curl \| sh, system file modification |
| MEDIUM | `metadata-mismatch` — undeclared env vars, unused declared binaries |

## How to respond to scan results

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs use of npx clawguard without pinning an exact package version. This allows whatever version is currently published or resolved by npm to be executed, creating supply-chain risk if a malicious or compromised release is published later.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The JSON-output example also invokes npx clawguard without a fixed version. Unpinned remote package execution is risky because the command may fetch and run changed third-party code in future runs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The rules-filtered scan example still relies on an unpinned npx package. In a security-focused skill, executing mutable external code undermines trust and can turn the scanner itself into an attack vector.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The instruction to install or run ClawGuard if missing relies on unpinned npm-distributed code. This increases supply-chain exposure and is especially sensitive because the tool is meant to be trusted for security decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill directs the agent to install and run third-party npm code but does not require a clear user-facing warning that this may execute untrusted code and modify the system. Users may interpret the security-scanner framing as inherently safe and approve risky execution without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.