ClawHub
Back to skill

Security audit

Port Scanner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward port scanner, but it can actively probe arbitrary hosts without clear authorization warnings or confirmation safeguards.

Install only if you intend to use it for systems you own or are explicitly authorized to test. Treat invocations as active network scanning: scans may be logged, trigger monitoring, or create operational noise, especially with large port ranges or high worker counts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list is broad enough to invoke an active network-scanning capability from generic phrases like 'network recon' or 'what ports are open'. Because port scanning can probe external or internal systems and may violate policy or disrupt monitoring controls, overly permissive activation increases the chance of unintended or unauthorized scans.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The manifest presents active TCP scanning as a routine utility but does not warn that it sends network probes, may trigger IDS/IPS alerts, and should only be used on authorized targets. Without that warning, users may launch scans against third-party or production systems without understanding legal, operational, or detection consequences.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This code actively connects to target ports and, for HTTP-like services, sends probe data to elicit banners. Although the file has a brief docstring and CLI description, it does not warn the user that it will initiate network scanning against a host, which is a safety-relevant operation that may affect system integrity or trigger monitoring.

Static analysis

No suspicious patterns detected.