Security audit

safeclaw

Security checks for vulnerabilities and agentic risk

Overview

SafeClaw has a coherent security-checking purpose, but it tells the agent to run unreviewed parent-directory code with a shell command built from a user path.

Review this skill before installing or invoking it. The main risk is not the stated goal, which is reasonable, but that invocation depends on whatever `main.py` exists outside the reviewed package and passes user input through a shell-shaped command. Only use it in a controlled workspace where the checker implementation and dependencies are known, pinned, and trusted; avoid copying the example MCP server entries directly without pinning package versions and narrowing filesystem scope.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:22
Finding: Execution of Unbundled and Unaudited Code Outside the Skill Package
Content: View full analysis
" --format json ``` ```bash cd {baseDir}/../../ && uv run python main.py check --auto --format json ``` ### Technical Analysis The skill instructs the agent to leave the audited skill directory and execute `main.py` from a parent project directory. The audited package does not contain `main.py`, a dependency manifest, a lockfile, or the source code implementing the advertised security checks. As a result, the effective executable is outside the reviewed package boundary. Its behavior depends on mutable parent-directory content and on the Python environment selected or resolved by `uv run`. The artifact therefore cannot guarantee that the executed code is the intended non-invasive configuration checker. This also creates a trust-boundary problem: reviewing or installing the skill does not establish the integrity of the code that will run when the skill is invoked. ### Attack Path 1. An attacker gains the ability to create or replace `main.py` in the directory resolved by `{baseDir}/../../`, or modifies the dependency configuration used by `uv`. 2. A user invokes SafeClaw to inspect a configuration file. 3. The agent follows the documented command and changes into the parent project directory. 4. `uv run python main.py` executes the attacker-controlled or otherwise unaudited code. 5. The code runs with the privileges and filesystem/network access of the agent process. ### Impact Assessment Successful exploitation can result in arbitrary code execution under the account running the agent. Depending on the surrounding runtime permissions, the executed code could: - Read the configuration file supplied for analysis. - Access other files readable by the agent account. - Modify files writable by that account. - U ...[truncated 324 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Shell Command Injection Through User-Controlled Configuration Path
Content: View full analysis
" --format json ``` ### Technical Analysis The documented execution flow constructs a shell command by interpolating a user-provided configuration path into a command string. The path is surrounded by double quotes, but double quoting does not make arbitrary text safe for shell evaluation. Shell constructs such as command substitutions—`$(...)` and backticks—are evaluated inside double quotes. A value containing a closing quote can also terminate the intended argument and introduce additional commands or shell operators. The instructions do not require path validation, canonicalization, safe shell escaping, or execution through a structured argument array. The vulnerability is reachable when an agent substitutes the path into the command and passes the resulting string to a shell, as directed by the fenced `bash` example. ### Attack Path 1. An attacker persuades a user or agent to check a configuration path containing shell syntax, such as: ```text $(attacker-controlled-command) ``` or: ```text "; attacker-controlled-command; # ``` 2. The agent inserts the supplied value into the documented shell command. 3. The resulting command is interpreted by a shell. 4. The shell evaluates the command substitution or injected command separators. 5. The attacker-controlled command executes with the privileges of the agent process before or alongside the intended configuration check. ### Impact Assessment Successful exploitation permits arbitrary command execution with the permissions of the account running the skill. The injected command could read or modify accessible files, inspect inherited environment variables, access local credentials available to the process, or communicate over the ne ...[truncated 285 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: example-config.json:24
Finding: Unpinned Automatic npm Package Execution in Example Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented JSON output schema requires status and result values in Chinese (for example, 安全|注意|高危 and other Chinese field contents) while the rest of the skill is written in English. This creates a language/locale constraint without user opt-in or justification, which matches the policy-violation category for forced language behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Lines L66-L68 label the compliance levels as '安全', '注意', and '高危', which imposes a specific language in user-facing output. The file does not indicate that this is optional, configurable, or justified as a region-specific tool, so it may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.