Skills Backup Claw Shell

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:58 PM UTC
• Version: 1.0.0

Overview

This skill openly provides shell access through tmux, but its execution path is too broad and weakly controlled for routine installation.

Install only if you intentionally want an agent to have broad shell access on this host. Use it in a tightly sandboxed environment, avoid secrets in that environment, and do not rely on the built-in dangerous-command check as a strong approval or containment control.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: handler.js:10

Finding

Host Shell Command Injection Through Unsafe Command Interpolation

Content

View full analysis

Vulnerability Details

File Location: handler.js, lines 10-13
Vulnerability Type: OS command injection
Risk Level: High

Vulnerable Code

js

function sendCommand(cmd) {
  const escaped = cmd.replace(/"/g, '\\"');
  execSync(`tmux send-keys -t claw "${escaped}" C-m`);
}

Technical Analysis

The attacker-controlled cmd value is interpolated into a command string passed to execSync. By default, execSync executes string commands through a system shell.

Escaping only double quotation marks does not prevent shell evaluation inside double-quoted strings. Shell command substitutions using $(...) or backticks remain active and are evaluated by the host shell before tmux is invoked. Crafted backslash and quotation-mark sequences may also interfere with the intended quoting.

This behavior violates the documented guarantee that commands are run inside the dedicated claw tmux session. Injected command substitutions execute directly in the environment of the Node.js skill process rather than in the tmux session.

Attack Path

1. An attacker supplies a command containing shell substitution, for example:

   sh

   echo "$(touch /tmp/claw-shell-injected)"
   

2. The value does not contain any substring rejected by isDangerous.

3. sendCommand escapes double quotation marks but leaves $() active.

4. The resulting command is passed to the host shell by execSync.

5. The host shell executes touch /tmp/claw-shell-injected before invoking tmux.

6. More consequential commands can be substituted to read, alter, or destroy resources available to the skill process.

Impact Assessment

An attacker able to control the command input can execute arbitrary operating-system commands with the user identity and privileges of the Node.js process. This can provide access to all files, credentials, environment variables, processes, and network resources available to that accou ...[truncated 273 chars]

Remediation

View remediation

Remediation Suggestions

Do not construct a shell command by interpolating untrusted text. Invoke tmux directly with a fixed executable and an argument array while disabling shell processing. For example:

js

const { execFileSync } = require("node:child_process");

function sendCommand(cmd) {
  execFileSync(
    "tmux",
    ["send-keys", "-t", "claw", "--", cmd, "C-m"],
    {
      shell: false,
      stdio: "ignore"
    }
  );
}

Additional hardening should include:

1. Reject NUL bytes and unexpected control characters in cmd.
2. Use fixed argument arrays for every tmux invocation, including session creation and output capture.
3. Run the skill under a dedicated, unprivileged operating-system account.
4. Restrict that account's filesystem and network access using sandboxing or container controls.
5. Add regression tests containing $(), backticks, nested quotes, backslashes, semicolons, and newlines, verifying that no command is evaluated by the host shell.

T09 · Insecure Skill Coding Practices

Warning

• Location: handler.js:22

Finding

Bypassable Destructive-Command Denylist and Missing Approval Enforcement

Content

View full analysis

Vulnerability Details

File Location: handler.js, lines 22-26
Vulnerability Type: Insufficient command validation and authorization
Risk Level: Medium

Vulnerable Code

js

function isDangerous(cmd) {
  const bad = ["sudo", " rm ", " rm-", "reboot", "shutdown", "mkfs", "dd "];
  const lower = ` ${cmd.toLowerCase()} `;
  return bad.some(k => lower.includes(k));
}

Technical Analysis

The security decision is based on a small, syntactically unaware substring denylist. It does not reliably identify which executable the shell will run or the effects of the command.

Dangerous operations can be expressed in forms absent from the list, including absolute executable paths, alternative utilities, shell functions, encoded or indirect execution, and whitespace variants. For example, /bin/rm -rf target does not contain the denylisted substring " rm " because the executable token is /bin/rm.

The documentation also identifies commands such as chmod -R and docker system prune -a as requiring confirmation, but the implementation does not test for them. Furthermore, the API has no approval token, confirmation flag, or persistent approval state. It only rejects matching commands and returns a message instructing the agent to ask the user. Consequently, the implementation cannot cryptographically or logically verify that a user approved an exact command before execution.

Attack Path

1. An attacker submits a destructive command using a representation not covered by the denylist, such as:

   sh

   /bin/rm -rf /path/writable/by/skill
   

2. The lowercase padded command does not match the listed " rm " or " rm-" patterns.

3. isDangerous returns false.

4. The command is sent to the claw tmux session without requiring confirmation.

5. The shell running inside tmux executes the destructive operation with the privileges of the skill account.

Other documented dangerous opera ...[truncated 753 chars]

Remediation

View remediation

Remediation Suggestions

Do not treat a substring denylist as a security boundary for unrestricted shell input. Apply defense in depth:

1. Prefer a strict allowlist of supported executables and arguments instead of accepting arbitrary shell programs.
2. If shell syntax must be supported, use a mature shell parser to inspect command structure, resolved executable names, pipelines, substitutions, redirections, and compound commands.
3. Resolve executable paths and enforce policy against the canonical executable rather than matching raw text.
4. Implement a single-use approval token bound to the exact command, requesting user, timestamp, and execution context. Reject modified commands after approval.
5. Ensure approval checks occur immediately before execution and cannot be bypassed through aliases, functions, interpreters, or nested shell evaluation.
6. Align the implementation with every dangerous operation listed in SKILL.md, including recursive permission changes and destructive Docker operations.
7. Execute approved commands in a least-privileged sandbox with filesystem, process, device, and network restrictions.
8. Add bypass tests covering absolute paths, tabs and newlines, aliases, shell functions, interpreters, command substitutions, and equivalent destructive utilities.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill provides a persistent shell execution channel via tmux and accepts arbitrary command strings from input, which creates a broad command-execution capability without meaningful restriction or business justification in the provided context. The lightweight denylist only blocks a few substrings and is easily bypassed, so an agent or attacker could run many harmful commands, exfiltrate data, alter files, or maintain persistent state across invocations through the tmux session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code executes any non-denylisted command immediately, with no user-facing confirmation for routine commands, even though the capability is powerful enough to affect the host environment. Because the danger check is incomplete and bypassable, normal-looking commands can still be destructive or privacy-invasive, making silent execution especially risky in an agent setting.

Content

No source excerpt is available for this finding.