ClawHub
Back to skill

Security audit

Win Cleaner

Security checks for vulnerabilities and agentic risk

Overview

This Windows cleanup skill may automatically delete important app/user state and weaken recovery options despite presenting itself as safe cleanup.

Review carefully before installing. This is not just a cache cleaner: it can remove sessions, history, workspace metadata, fonts, logs, Desktop matches, and rollback data. Only use it if you are comfortable reviewing every command first, running scan/report mode manually, and skipping DISM resetbase, VSS resizing, browser history/cookies, IDE workspaceStorage, Teams databases/local storage, and Desktop/profile-wide heuristic deletions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:739
Finding

Automatic DISM ResetBase and VSS Resizing Remove Recovery Capabilities Without Consent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:739-754
Vulnerability Type: Destructive privileged operations without explicit authorization
Risk Level: High

Vulnerable Code

powershell
### 4c. DISM Component Cleanup (long timeout: 600s)

```powershell
Write-Host "DISM basic cleanup..."
dism /online /cleanup-image /startcomponentcleanup
Write-Host "DISM deep cleanup (/resetbase) — removes ALL superseded components."
Write-Host "WARNING: After /resetbase, you cannot uninstall Windows updates. This is generally fine."
dism /online /cleanup-image /startcomponentcleanup /resetbase

4d. System Restore / VSS Slim Down

powershell
Write-Host "Resizing VSS to 1GB max..."
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1GB
vssadmin list shadowstorage
text

### Technical Analysis

The Skill places both operations in its automatic sequential cleanup phase rather than treating them as separately authorized recovery-policy changes.

`DISM /startcomponentcleanup /resetbase` permanently establishes currently installed component versions as the new base. Superseded updates can no longer be uninstalled afterward. Printing a warning does not constitute informed user consent.

`vssadmin resize shadowstorage` can delete existing Volume Shadow Copy snapshots and restore points when the new one-gigabyte limit is smaller than current usage. The fixed limit also ignores disk size, existing recovery requirements, endpoint-management policy, and available restore history.

Both commands normally require administrator privileges. Although elevated access may be appropriate for selected Windows maintenance tasks, altering rollback and recovery facilities exceeds the minimum privilege and impact necessary for ordinary cache cleanup.

### Attack Path

1. A user requests routine or deep C-drive cleanup.
2. The agent follows the instruction to auto-execute Phase 4 sequentially.
3. The agent inv
...[truncated 802 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove DISM /resetbase and VSS resizing from all default and automatic cleanup paths.
  2. Run only the non-reset DISM component cleanup by default.
  3. Before /resetbase, explain that superseded updates will no longer be uninstallable and require explicit confirmation for that exact command.
  4. Before changing VSS, report current allocation, maximum allocation, restore-point count, and estimated space savings.
  5. Require separate explicit confirmation before resizing VSS.
  6. Use a percentage-based or administrator-approved limit instead of a fixed one-gigabyte value.
  7. Respect enterprise management policy and refuse the operation when recovery settings are centrally managed.
  8. Log the original VSS configuration and the user's authorization.
  9. Provide a dry-run plan and allow the user to skip each privileged operation independently.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:855
Finding

Broad Name-Based Cache Detection Can Recursively Delete Active or User-Controlled Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:855-917
Vulnerability Type: Unsafe recursive deletion based on insufficient path validation
Risk Level: High

Vulnerable Code

powershell
$safePatterns = @(
    'Cache', 'cache', 'CACHE',
    'Temp', 'temp', 'TEMP',
    'Log', 'Logs', 'log', 'logs',
    'Code Cache',
    'GPUCache',
    'DawnCache',
    'ShaderCache',
    'GrShaderCache',
    'Crashpad',
    'CrashDumps',
    'Crash Reports',
    'thumbnails', 'Thumbnails',
    'preview', 'Preview',
    '__pycache__'
)

$searchRoots = @($env:LOCALAPPDATA, $env:APPDATA, "$env:USERPROFILE\AppData\LocalLow", "$env:USERPROFILE\.vscode")
$totalFreed = 0

foreach ($root in $searchRoots) {
    if (-not (Test-Path $root)) { continue }
    Get-ChildItem $root -Recurse -Directory -ErrorAction SilentlyContinue -Depth 8 |
        Where-Object { $safePatterns -contains $_.Name } |
        ForEach-Object {
            $isProject = (Test-Path "$($_.FullName)\.git") -or
                         (Test-Path "$($_.FullName)\package.json") -or
                         (Test-Path "$($_.FullName)\Cargo.toml") -or
                         (Test-Path "$($_.FullName)\CMakeLists.txt") -or
                         (Test-Path "$($_.FullName)\README") -or
                         (Test-Path "$($_.FullName)\README.md")
            if ($isProject) { return }
            $item = Get-Item $_.FullName -ErrorAction SilentlyContinue
            if ($item.LinkType) { return }
            $size = (Get-ChildItem $_.FullName -Recurse -ErrorAction SilentlyContinue |
                     Where-Object { !$_.PSIsContainer } |
                     Measure-Object -Property Length -Sum -ErrorAction SilentlyContinue).Sum
            if ($size -gt 1MB) {
                Write-Host "Cache: $($_.FullName) ($([math]::Round($size/1MB,1)) MB)"
                $totalFreed += $size
                Remove-Item -R
...[truncated 2489 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace generic recursive discovery with a versioned allowlist of vendor-documented cache paths.
  2. Resolve every candidate to a canonical path and verify that it remains under the intended root.
  3. Reject reparse points, symbolic links, junctions, and paths whose resolution cannot be verified.
  4. Enforce the documented inactivity threshold and use a substantially safer age threshold than one minute where possible.
  5. Detect or stop the owning application before modifying its files.
  6. Scan first and present the exact paths, sizes, and application owners before deletion.
  7. Require explicit confirmation for unknown applications or generic directory names.
  8. Delete only documented cache contents rather than the containing directory.
  9. Move uncertain targets to quarantine or the Recycle Bin instead of permanently deleting them.
  10. Remove broad names such as Log, Logs, Temp, Preview, and thumbnails from automatic classification.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:612
Finding

Automatic Cleanup Deletes Fonts, Workspace State, Authentication State, and Browsing Records

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:612-623, 1069-1113, 1364-1371
Vulnerability Type: Misclassification of user and application data as cache
Risk Level: High

Vulnerable Code

powershell
# Font cache (only temp font cache, not system fonts)
$fontDir = "$env:LOCALAPPDATA\Microsoft\Windows\Fonts"
if (Test-Path $fontDir) {
    $fontBefore = (Get-ChildItem $fontDir -Recurse -ErrorAction SilentlyContinue |
                   Where-Object { !$_.PSIsContainer } | Measure-Object -Property Length -Sum).Sum
    Get-ChildItem $fontDir -Recurse -ErrorAction SilentlyContinue |
        Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
    $freed += $fontBefore
    Write-Host "Font cache: $([math]::Round($fontBefore/1MB,1)) MB"
}
powershell
$wsStorage = "$vscRoot\User\workspaceStorage"
if (Test-Path $wsStorage) {
    $wsSize = (Get-ChildItem $wsStorage -Recurse -ErrorAction SilentlyContinue |
               Where-Object { !$_.PSIsContainer } | Measure-Object -Property Length -Sum).Sum
    if ($wsSize -gt 200MB) {
        Write-Host "$vsc workspaceStorage: $([math]::Round($wsSize/1MB,1)) MB"
        Remove-Item -Recurse -Force $wsStorage -ErrorAction SilentlyContinue
    }
}
powershell
# Teams Classic
$teamsClassic = "$env:APPDATA\Microsoft\Teams"
if (Test-Path $teamsClassic) {
    foreach ($sub in @('Cache','Code Cache','GPUCache','blob_storage','databases',
                        'Local Storage','tmp','logs','crash reports')) {
        $p = "$teamsClassic\$sub"
        if (Test-Path $p) {
            $s = (Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue |
                  Where-Object { !$_.PSIsContainer } | Measure-Object -Property Length -Sum).Sum
            if ($s -gt 5MB) {
                $teamsFreed += $s
                Write-Host "Teams Classic $sub: $([math]::Round($s/1MB,1)) MB"
                Remove-Item -Recurse -
...[truncated 2448 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the user Fonts directory, VS Code workspaceStorage, Teams databases, Teams Local Storage, cookies, and browsing history from automatic cleanup.
  2. Use only vendor-documented cache paths and cleanup APIs.
  3. Preserve application databases, local storage, authentication state, workspace metadata, user-installed fonts, cookies, and history by default.
  4. Separate disk-cache cleanup from privacy-data removal.
  5. For privacy-data removal, clearly identify what will be lost and require explicit, category-specific consent.
  6. Ensure the relevant application is closed before clearing any documented cache.
  7. Back up or quarantine stateful data before an approved deletion.
  8. Verify post-cleanup application health and provide restoration instructions.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:1190
Finding

Filename and Extension Heuristics Can Permanently Delete Legitimate User Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:1190-1240
Vulnerability Type: Unsafe deletion based on unverified filename heuristics
Risk Level: High

Vulnerable Code

powershell
# SQLite files with I/O error markers
Get-ChildItem $env:USERPROFILE -Recurse -File -ErrorAction SilentlyContinue -Depth 6 |
    Where-Object { $_.Name -match 'SQLITE_IOERR|SQLITE_CORRUPT|_IOERR\d{10,}' } |
    ForEach-Object {
        Write-Host "Corrupted DB: $($_.FullName) ($([math]::Round($_.Length/1MB,1)) MB)"
        Remove-Item $_.FullName -Force -ErrorAction SilentlyContinue
    }

# Orphaned WAL/SHM journal files (parent DB no longer exists)
Get-ChildItem $env:USERPROFILE -Recurse -File -ErrorAction SilentlyContinue -Depth 6 |
    Where-Object {
        $ext = $_.Extension
        ($ext -eq '.db-wal' -or $ext -eq '.db-shm' -or $ext -eq '.db-journal') -and
        (-not (Test-Path ($_.FullName -replace '-(wal|shm|journal)$', '')))
    } | ForEach-Object {
        Write-Host "Orphaned journal: $($_.FullName) ($([math]::Round($_.Length/1MB,1)) MB)"
        Remove-Item $_.FullName -Force -ErrorAction SilentlyContinue
    }
powershell
$desktop = "$env:USERPROFILE\Desktop"
$junkPatterns = @('update.mar','update.mar.*','cached-microdescs','cached-certs',
                   '*.tmp','*.temp','~$*.docx','~$*.xlsx','~$*.pptx')
foreach ($pattern in $junkPatterns) {
    Get-ChildItem $desktop -Filter $pattern -ErrorAction SilentlyContinue | ForEach-Object {
        if ($_.Length -gt 10MB -or $_.Extension -match '\.(tmp|temp|mar)$') {
            Write-Host "Desktop junk: $($_.Name) ($([math]::Round($_.Length/1MB,1)) MB)"
            Remove-Item $_.FullName -Force -ErrorAction SilentlyContinue
        }
    }
}

Technical Analysis

A filename containing SQLITE_IOERR or SQLITE_CORRUPT is not proof that the file is corrupt, is a SQLite database, or is safe to delete. The code ...[truncated 1866 chars]

Remediation
View remediation

Remediation Suggestions

  1. Change all heuristic matches to report-only behavior.
  2. Verify the SQLite file signature and run a read-only integrity check before labeling a database corrupt.
  3. Never delete WAL, SHM, or journal files while the owning application may be running.
  4. Use application-specific recovery procedures for SQLite artifacts.
  5. Require explicit user confirmation for every user-profile or Desktop file.
  6. Display the full path, size, modification time, detected owner, and reason for classification.
  7. Move approved files to the Recycle Bin or a time-limited quarantine instead of using permanent forced deletion.
  8. Revalidate file identity and path immediately before modification to reduce check-to-use races.
  9. Exclude recently modified files and preserve Office recovery artifacts by default.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is framed as safe junk/cache cleanup, yet it auto-deletes items that are not purely disposable cache, including browser history/cookies, IDE workspace state, old application versions, desktop junk patterns, and profile-wide database artifacts. These actions can remove user preferences, session state, forensic artifacts, or working data not clearly recoverable by the user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill promises zero user data loss, but later includes scans and deletions in user-controlled locations such as Desktop and profile roots, with some automated cleanup actions. That contradiction is dangerous because users may consent based on the stated guarantee while the implementation reaches beyond clearly disposable caches into potentially valuable personal or application state.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document lacks an upfront warning that it will automatically execute broad deletion and some system-altering maintenance steps. Without a prominent pre-execution warning and confirmation, users may not understand that the skill can remove application state, logs, browser artifacts, restore-storage capacity, and other nontrivial data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill says pattern-based cleaning will never search Documents, Desktop, or Downloads, but later phases recurse broadly through user-profile areas and delete matching files in places like Desktop and profile subtrees. This undermines the stated safety boundary and increases the chance of deleting non-cache files that happen to match broad junk-like patterns.

Content

No source excerpt is available for this finding.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
70% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 1452)May include surrounding context.

md
* | Reinstallable — suggest keeping only active one |
| `.cargo`, `.gradle`, `.m2`, `.nuget` | **Build cache** | Re-downloadable — suggest cleaning |
| `\Projects\`, `\Workspace\`, `\repos\` | **Dev projects** | NEVER suggest deletion |
| `\Recordings\`, `\Meetings\` | **Recordings** | May be important — ask |
| `VirtualBox`, `VMware`, `Docker`, `WSL` | **VM/Container** | Large — ask |
| `BurpSuite`, `Wireshark`, `fiddler`, `ZAP` | **Security tools** | User projects — NEVER delete |
| `.android\avd` | **Android emulators** | Re-downloadable but large — ask |
| `.apple`, `MobileSync`, `Apple Computer` | **Apple backups** | May be important — ask |
| `Squirrel`, `app-`, `-full` | **Old installers** | Stale versions — suggest deletion |
| `node_modules` (not inside a project) | **Abandoned deps** | Can be regenerated — suggest deletion |
| `go/pkg`, `.go/pkg` | **Go module cache** | Re-downloadable — suggest cleaning |
| `.cache`, `.shiv`, `.openjfx` | **SDK/tool cache

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The invocation scope is very broad, covering common requests like freeing space or optimizing storage, which raises the chance the skill is triggered in contexts where the user expected advice rather than extensive automated deletion. In a destructive maintenance skill, ambiguous activation materially increases risk because high-impact actions may occur without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The pre-flight rules require reparse-point and recency checks before deletion, but most later Remove-Item flows do not perform those validations. Missing these safeguards can cause deletion through junctions/symlinks into unintended locations or removal of files still in active use, risking data loss and instability.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

Marking large cleanup phases as 'Auto-Execute' enables autonomous destructive actions without a per-item review step. In this skill, that is especially risky because the deletion scope is broad and includes areas where misclassification or application-state loss can occur.

Content

Scanner excerpt · SKILL.md (reported line 462)May include surrounding context.

md
---

## Phase 4: Universal Safe Cleanup (Auto-Execute)

### 4a. Package Manager Caches

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill performs system-altering operations such as resizing VSS shadow storage, stopping and starting Windows Update service, and flushing DNS, which go beyond deleting junk files. These changes can affect restore-point retention, update behavior, troubleshooting data, and network state, especially if executed automatically or on managed systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Deleting browser cookies and history is privacy- and usability-destructive, and it provides little disk-space benefit compared with ordinary cache cleanup. This can sign users out, remove browsing state, and erase information they did not intend to lose under the guise of storage optimization.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.