Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 1.0.1

Overview

The skill is a legitimate system-health checker, but it can guide an agent into broad credential, session, infrastructure, and history checks without enough scoping or redaction safeguards.

Install only if you intend to let the agent perform broad system diagnostics. Before running it, explicitly limit the scope, avoid raw grep/git-history secret scans unless output is redacted, and require confirmation before credential checks, remote checks, persistent tracking, file cleanup, history rewriting, service restarts, or session/tab termination.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: checks.md:13

Finding

Overly Broad Sensitive-Environment Reconnaissance

Content

View full analysis

Vulnerability Details

File Location: checks.md:13-69
Vulnerability Type: Excessive access to credentials, system configuration, sessions, and remote infrastructure
Risk Level: Medium

Vulnerable Code Snippets

markdown

- [ ] No secrets in plaintext files (.env with real values, hardcoded credentials)
- [ ] No secrets accidentally committed to git history

markdown

### Credentials
- [ ] Keychain secrets referenced in secrets-registry.json actually exist
- [ ] API tokens not expired (Cloudflare, Hetzner, etc.)
- [ ] SSH keys have correct permissions (600, not world-readable)
- [ ] VPN configuration exists and matches expected servers

markdown

## Integrations

### APIs & Services
- [ ] Configured APIs reachable (Brave, Telegram, etc.)
- [ ] Bot tokens valid (can authenticate)
- [ ] Rate limits not being hit chronically
- [ ] Webhook endpoints responding

### Resources & Performance
- [ ] Token usage patterns normal (no sudden 3x spikes)
- [ ] Model routing following defined rules (Haiku/Sonnet/Opus split)
- [ ] Browser sessions not accumulating (zombie tabs)
- [ ] No redundant tool calls (same file read 5x in one conversation)

### Nodes & External
- [ ] Paired nodes reachable
- [ ] Server SSH connections working
- [ ] Docker services on servers healthy (if applicable)

Technical Analysis

The Skill is activated by broad requests such as “audit,” “diagnose,” or “what's wrong,” but its check definitions extend into credential stores, API-token validity, SSH configuration, VPN configuration, active sessions, paired nodes, remote servers, and Docker services. These resources can contain or reveal security-sensitive operational data.

Although these checks are consistent with the declared system-diagnosis purpose, the Skill does not define an explicit consent boundary, scoped allowlist, or privilege separation before examining sensitive subsy ...[truncated 1688 chars]

Remediation

View remediation

Remediation Suggestions

1. Default broad trigger phrases to a non-sensitive local check limited to file structure, syntax, disk usage, and service availability.
2. Require explicit, informed confirmation before checking:
   • Keychain or credential registries
   • Git history for secrets
   • SSH keys and remote connections
   • VPN configuration
   • Session history
   • API-token validity
   • Paired nodes, servers, or Docker services
3. Present a scope preview before execution, identifying every directory, credential store, service, and remote system that will be accessed.
4. Introduce separate read-only capabilities for workspace, credential, session, and remote-infrastructure checks.
5. Use allowlists for files, repositories, hosts, and integrations rather than inspecting every resource available to the agent.
6. Prevent sensitive findings from being written to tracking files or persistent memory.
7. Redact credential values, host identifiers, usernames, and other sensitive metadata from reports and tool transcripts.
8. Require additional confirmation before any remediation action changes permissions, restarts services, terminates sessions, or modifies remote resources.

T09 · Insecure Skill Coding Practices

Error

• Location: remediation.md:5

Finding

Secret-Scanning Commands Expose Complete Credential-Bearing Lines

Content

View full analysis

Vulnerability Details

File Location: remediation.md:5-15
Vulnerability Type: Plaintext sensitive-data disclosure through command output
Risk Level: High

Vulnerable Code Snippet

markdown

### Secrets in plaintext
**Detection:** `grep -r "password\|api_key\|token" --include="*.env" --include="*.md"`
**Remediation:**
1. Rotate the exposed credential immediately
2. Move to Keychain: `security add-generic-password -a clawdbot -s NAME -w "VALUE"`
3. Update references to use `security find-generic-password`
4. Check git history: `git log -p -- <file>` — if committed, consider force push or repo recreation
**Auto-fixable:** No (requires credential rotation)

### SSH key permissions too open
**Detection:** `stat -f "%Lp" ~/.ssh/*`

A second unsafe history-search command appears at remediation.md:15:

markdown

**Detection:** `git log -p | grep -i "password\|token\|api_key"`

Technical Analysis

Standard grep output includes the complete text of every matching line. Consequently, the recursive search can print actual passwords, API keys, tokens, connection strings, and surrounding configuration data from Markdown and environment files.

The git-history command is especially sensitive because git log -p emits complete historical patches. Piping that output through grep still prints full matching lines, including credentials that were deleted from the current working tree but remain in repository history.

These commands do not redact values, restrict output to filenames, or prevent sensitive output from entering the agent's context. Tool results may consequently propagate secrets into conversation transcripts, telemetry, debugging logs, or persistent audit records. The broad keywords can also produce substantial unrelated sensitive context.

Attack Path

1. A health check reaches the plaintext-secret or committed-secret detection step.
2. The agent runs the docume ...[truncated 1161 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not print matching content. Return only a sanitized file identifier, line number, detector type, and redacted fingerprint.
2. Replace raw grep and git log -p pipelines with a secret scanner that redacts findings by default.
3. If basic shell tools must be used, first list candidate filenames without content and inspect them through a redaction layer that masks values after separators such as =, :, or quoted assignments.
4. Require explicit user consent before scanning repository history, because historical patches may contain credentials absent from the current tree.
5. Disable shell tracing and ensure scanner output is excluded from persistent memory, analysis logs, telemetry, and ordinary conversation transcripts.
6. Limit scans to an approved repository root and exclude dependency directories, archives, backups, generated output, and unrelated user files.
7. Report secret type and location without reproducing the secret. If correlation is necessary, use a short one-way fingerprint rather than any credential substring.
8. Treat every positive result as potentially compromised:
   • Revoke or rotate the credential
   • Review provider access logs
   • Remove the secret from current files
   • Rewrite repository history where appropriate
   • Update dependent services with the replacement credential
9. Avoid placing replacement secrets directly on command lines, because process listings and shell history may expose command arguments. Use a secure prompt, standard input, or a protected secret-management integration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad, natural-language expressions like 'what's wrong', 'diagnose', and 'something feels off', which can overlap with ordinary conversation and cause the skill to activate unintentionally. Because this skill performs system self-diagnosis over workspace, configuration, skills, and integrations, accidental invocation could expose sensitive system state or initiate intrusive checks without clear user intent.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · checks.md (reported line 10)May include surrounding context.

md

- [ ] memory/ folder structure valid, INDEX.md up to date
- [ ] No orphaned memory files (exist but not indexed)
- [ ] BOARD.md and BACKLOG.md not bloated (>100 lines of stale entries)
- [ ] No secrets in plaintext files (.env with real values, hardcoded credentials)
- [ ] No secrets accidentally committed to git history

### Memory Health

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · remediation.md (reported line 6)May include surrounding context.

md

## Security Issues

### Secrets in plaintext
**Detection:** `grep -r "password\|api_key\|token" --include="*.env" --include="*.md"`
**Remediation:**
1. Rotate the exposed credential immediately
2. Move to Keychain: `security add-generic-password -a clawdbot -s NAME -w "VALUE"`

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checks.md (reported line 26)May include surrounding context.

md

### Credentials
- [ ] Keychain secrets referenced in secrets-registry.json actually exist
- [ ] API tokens not expired (Cloudflare, Hetzner, etc.)
- [ ] SSH keys have correct permissions (600, not world-readable)
- [ ] VPN configuration exists and matches expected servers

### Gateway & Cron

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · remediation.md (reported line 16)May include surrounding context.

md

### SSH key permissions too open
**Detection:** `stat -f "%Lp" ~/.ssh/*`
**Remediation:** `chmod 600 ~/.ssh/id_*`
**Auto-fixable:** Yes

### Secrets committed to git

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guidance recommends history-rewriting actions such as git filter-branch/BFG and force-push without an explicit warning that these are disruptive and can permanently alter shared repository history. In an agent skill context, operational instructions may be automated or followed without full operator review, increasing the chance of irreversible damage or loss of audit history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes remediation guidance to archive or delete memory files older than 30 days, which could affect user data. The section presents the action as routine remediation but does not include an explicit warning about potential data loss, the need to verify files before deletion, or the impact of moving files automatically.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · remediation.md (reported line 84)May include surrounding context.

Fix SSH permissions

bash

find ~/.ssh -type f -name "id_*" ! -name "*.pub" -exec chmod 600 {} \;
find ~/.ssh -type f -name "*.pub" -exec chmod 644 {} \;
chmod 700 ~/.ssh

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · remediation.md (reported line 85)May include surrounding context.

Fix SSH permissions

bash

find ~/.ssh -type f -name "id_*" ! -name "*.pub" -exec chmod 600 {} \;
find ~/.ssh -type f -name "*.pub" -exec chmod 644 {} \;
chmod 700 ~/.ssh

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · remediation.md (reported line 86)May include surrounding context.

bash

find ~/.ssh -type f -name "id_*" ! -name "*.pub" -exec chmod 600 {} \;
find ~/.ssh -type f -name "*.pub" -exec chmod 644 {} \;
chmod 700 ~/.ssh

Clean old memory files

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The auto-fix template automatically moves files older than 30 days into an archive directory without any review gate, backup step, or validation of what matches the pattern. In an agent skill, unattended execution of file-moving commands can disrupt workflows, hide needed records, or cause unintentional data loss if assumptions about naming or retention are wrong.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file explicitly describes storing per-run analysis metadata in analysis-log.json, including timestamps, categories checked, and counts of findings, but it does not clearly warn the user that this data is persisted. Even though the data is operational rather than obviously secret, persistent logs can reveal workspace activity patterns, security posture trends, and user behavior over time, creating privacy and sensitivity concerns if retained unexpectedly or exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The heartbeat analysis section introduces recurring automated checks every 4 hours, but the warning about continuous background activity is minimal and does not clearly explain persistence, resource usage, or monitoring implications. Continuous analysis can surprise users, repeatedly touch workspace state, and generate ongoing metadata or behavioral signals without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Writing memory/health-status.md after each run creates a persistent status artifact, but the file does not clearly warn that security and operational health information may be stored on disk over time. Such a status file can expose historical system condition, unresolved issues, and security-relevant trends to anyone with access to the workspace or memory directory.

Content

No source excerpt is available for this finding.