ClawHub
Back to skill

Security audit

MagBox

Security checks for vulnerabilities and agentic risk

Overview

MagBox is a disclosed local file handoff server scoped to two directories, with clear warnings about unauthenticated network access and optional user-level service persistence.

Install MagBox only if you want a local browser-accessible inbox/outbox. Keep the default loopback binding unless you intentionally need LAN access, never place credentials or confidential files in the served folders, and treat the service templates as an explicit opt-in because they keep the unauthenticated file bridge running across sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (19)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

md
Keep the process running. Defaults are `~/Inbox`, `~/Outbox`, and loopback port
9900. The directories are created if absent. New directories are owner-only;
existing directory permissions are unchanged. Keep these folders dedicated to
non-sensitive handoffs and controlled by their local owner. Do not run as root.

On the same machine open:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill exposes network-reachable file transfer behavior and relies on multiple environment variables, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, that omission can lead to over-broad execution assumptions, making it easier for the skill to access networking or environment-backed configuration without clear user review or policy enforcement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 103)May include surrounding context.

mkdir -p "$HOME/.config/systemd/user" cp templates/magbox.service "$HOME/.config/systemd/user/magbox.service" systemctl --user daemon-reload systemctl --user enable --now magbox.service

text

Stop: `systemctl --user stop magbox.service`.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 75)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 77)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 83)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 84)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 85)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 90)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/validation.md (reported line 15)May include surrounding context.

md
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · templates/magbox.plist (reported line 2)May include surrounding context.

text
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · templates/magbox.plist (reported line 22)May include surrounding context.

text
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tests/magbox.test.mjs (reported line 206)May include surrounding context.

js
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tests/magbox.test.mjs (reported line 207)May include surrounding context.

js
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tests/magbox.test.mjs (reported line 208)May include surrounding context.

js
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · templates/magbox.plist (reported line 2)May include surrounding context.

text
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- Edit both absolute paths. Run as a user LaunchAgent. See references/deploy.md.
     LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Beginning at the plist body, this template defines a macOS LaunchAgent that will execute a Node.js server automatically via RunAtLoad and KeepAlive. While likely intended for convenience, autorun persistence for a file-transfer service increases exposure because the service remains continuously available and could become a foothold if the backing server has weaknesses or if MAGBOX_BIND is changed from localhost to a LAN-facing address.

Content

Scanner excerpt · templates/magbox.plist (reported line 7)May include surrounding context.

text
LAN opt-in: change MAGBOX_BIND to a specific private interface address.
     Optional MAGBOX_HOSTS lists client-facing DNS names, separated by commas.
     0.0.0.0 listens on all IPv4 interfaces and also needs explicit MAGBOX_HOSTS. -->
<plist version="1.0"><dict>
  <key>Label</key><string>ai.magbox</string>
  <key>ProgramArguments</key><array>
    <string>/opt/homebrew/bin/node</string>

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The rendered document sets lang="en", which forces an English language context for the UI regardless of user preference. The file does not present this as an optional or user-selectable locale, and there is no documented region-specific justification in the code.

Content

No source excerpt is available for this finding.