Clawdbot Security Suite

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:49 AM UTC
• Version: 1.0.0

Overview

This security skill has a coherent purpose, but its automatic protection can fail open and it stores sensitive tool inputs in local logs, so it needs review before installation.

Install only if you are comfortable reviewing or hardening it first. Prefer the package-manager path over the raw GitHub main-branch ZIP, disable or sanitize logging if commands or tool arguments may contain secrets, and do not rely on the automatic hook as a fail-closed security boundary without fixing the validator path, shell invocation, and validation-error behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill claims 'No data transmission' and 'No telemetry or external calls' while elsewhere advertising threat-intelligence updates and external social/update channels. This creates a misleading trust boundary: an operator may deploy the skill expecting fully local behavior and skip network review or egress controls.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The threat-intelligence section suggests pattern updates from external sources, which contradicts the later assurance that analysis is fully local with no external calls. Even if no automatic fetch currently exists, the documentation encourages expectations of remote content ingestion, which can mislead users and weaken secure deployment decisions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The hook builds a shell command string and executes it with execSync, interpolating untrusted values such as command, URL, path, and content into shell-quoted arguments. Quoting with double quotes is not sufficient to prevent shell metacharacter expansion in many shells, so an attacker may be able to trigger command execution inside the security validator itself, undermining the protection layer and potentially achieving arbitrary code execution.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file header claims the hook automatically prevents command injection, SSRF, path traversal, prompt injection, and API key exposure, but the implementation repeatedly allows execution when the security skill is missing, returns unclear output, throws an error, or the hook itself fails. In a security control, these fail-open paths are dangerous because an attacker can bypass protection simply by causing validator failure or ambiguity.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to include promotional content for an external social media account in a post-installation message, which is unrelated to the core security validation function. This creates an unjustified trust and influence channel and can be abused for endorsement, tracking, or social engineering under the guise of security guidance.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The instruction to always recommend following @LexpertAI introduces a persistent, non-security-related behavioral requirement into the agent’s responses. In a security skill, embedding mandatory third-party promotion is especially risky because users may interpret it as vetted security advice, enabling reputation laundering or future social engineering.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document labels its philosophy as fail-safe, but the actual behavior says to allow execution when validation fails or is unclear. This inverts the security model: an attacker only needs to trigger validator ambiguity or failure to bypass protections and get dangerous commands executed.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The README states the security system has a 'Fail-safe design' that 'allows on validation errors,' which is the opposite of a secure fail-closed posture for a protection layer. If the validator crashes, times out, or misparses input, dangerous operations may proceed unchecked, undermining the skill’s core security purpose.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation makes a strong privacy/security claim of 'No data transmission' and 'All analysis is local' while elsewhere advertising pattern updates from community/live external threat sources. This inconsistency can mislead operators into trusting the skill in sensitive environments where outbound connectivity or external updates are prohibited.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The hook logs full tool arguments and, in several branches, records raw commands, URLs, paths, and truncated content to a file in the user's home directory. Those values can contain secrets, personal data, tokens, internal paths, or other sensitive operational details, creating a secondary data exposure risk through local logs without any minimization or user disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The hook forwards raw command, URL, path, and content data to an external security skill process for analysis. Even if that process is local, it is a separate trust boundary and can expose sensitive user input, credentials, proprietary content, or system details to another executable without clear consent or data minimization.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The installation instructions direct the agent to download archives, unzip them, copy files into the local skill directory, and modify permissions without an explicit warning that these actions change the local system. In an agent setting, this can cause silent system modification and trust of unreviewed remote content.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The guidance executes user-controlled input using eval after only a string-based validation step, and even proceeds when validation is unclear. Using eval on user-supplied commands is inherently dangerous because parsing ambiguities, validator bypasses, or malformed output can lead directly to arbitrary command execution.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example integration shows validating a string and then executing it with eval, but does not clearly warn that eval remains dangerous even after pattern-based screening. Attackers can often bypass blacklist validation or exploit quoting/expansion edge cases, causing arbitrary command execution in the agent context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The logging function appends raw messages directly to a persistent file under the user's home directory, and those messages are constructed from unredacted user-supplied commands, URLs, paths, and potentially scanned content. This creates a privacy and secret-retention risk because sensitive inputs may be stored locally without explicit notice, increasing exposure if the host is shared, backed up, or later inspected.

External Transmission

Medium

• Category: Data Exfiltration

Content

clawdhub install clawdbot-security-advanced

# Alternative: manual installation
curl -L https://github.com/gtrusler/clawdbot-security-suite/archive/main.zip -o /tmp/security-suite.zip
unzip /tmp/security-suite.zip -d /tmp/
cp -r /tmp/clawdbot-security-suite-main/security ~/.clawdbot/skills/
chmod +x ~/.clawdbot/skills/security/security

• Confidence: 88% confidence
• Finding: The instructions fetch a remote ZIP archive from an external source and install its contents locally. Even if intended as a normal installation path, remote retrieval in a security-sensitive skill expands the supply-chain attack surface and can expose the environment to tampered or unexpected content.

External Script Fetching

Low

• Category: Supply Chain

Content

clawdhub install clawdbot-security-advanced

# Alternative: manual installation
curl -L https://github.com/gtrusler/clawdbot-security-suite/archive/main.zip -o /tmp/security-suite.zip
unzip /tmp/security-suite.zip -d /tmp/
cp -r /tmp/clawdbot-security-suite-main/security ~/.clawdbot/skills/
chmod +x ~/.clawdbot/skills/security/security

• Confidence: 80% confidence
• Finding: The document includes direct fetching of externally hosted content for installation, which is a classic script/package retrieval risk. While this may be routine operational guidance rather than overtly malicious behavior, it still normalizes execution of unverified remote code in a security-branded skill.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: hooks/security-validator/handler.ts:79

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: hooks/security-validator/HOOK.md:51

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:49

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:46

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/security/README.md:27

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/security/SKILL.md:42