ClawHub
Back to skill

Security audit

Agent Sentinel

Security checks for vulnerabilities and agentic risk

Overview

The main scanner is local and readable, but the package includes an under-disclosed CI verifier that can execute Python code from untrusted skill folders.

Install only if you intend to use the documented agent_sentinel.py scan command. Do not run ci/verify_product.py against third-party or untrusted skill folders unless it is inside a hardened sandbox with no secrets and limited filesystem/network access.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout
Confidence
98% confidence
Finding
This function executes an arbitrary Python file from the target product folder to probe for a `self-test` mode. Because the tool is intended to scan untrusted skills before installation, running the candidate skill code during verification defeats the security boundary and can trigger arbitrary code execution on the CI runner or analyst machine.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):
Confidence
98% confidence
Finding
This directly executes discovered `test_*.py` files from the untrusted product folder. In the context of a pre-installation scanner, attacker-supplied test files can run arbitrary code, exfiltrate CI secrets, alter the workspace, or tamper with verification results.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises a local offline scanner and declares no permissions, yet the package behavior indicates file access, network retrieval, and shell execution capabilities. That gap is dangerous because users may install or run the skill under a lower-trust assumption, while the actual implementation can fetch remote content and execute commands, expanding the attack surface and enabling supply-chain abuse if the code or dependencies are modified.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The stated purpose is scanning skills for risky permissions, but the implementation reportedly performs broader CI and package-validation tasks, including compiling Python and executing self-tests via subprocess. That mismatch is high risk because a user expecting passive analysis may instead run code execution paths against untrusted skill content or local tooling, which can trigger arbitrary commands during 'verification' and undermine the security boundary the tool claims to provide.

Static analysis

No suspicious patterns detected.