T01 · Skill Instruction Hijacking
Error
- Location
references/security-policy.md:1- Finding
Global instruction override language in the bundled security policy
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Security Suite
Security checks for vulnerabilities and agentic risk
Overview
This security-scanning skill is mostly purpose-aligned, but it needs Review because its bundled policy claims global installation authority and its scanner has containment and assurance gaps.
Review this before installing in an automated approval path. Do not let its bundled policy override platform or user rules, run scans with low filesystem privileges, avoid scanning untrusted archives that may contain symlinks until containment is fixed, and treat its pass/fail results as advisory rather than a complete security guarantee. Be aware that cloud reputation checks can contact the configured Tencent endpoint with the skill name and source when a skill_name is supplied.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
lib/static_scanner.py:125- Finding
Static scanner follows symbolic links outside the requested scan directory
- Content
View full analysis
List[str]: issues = [] _, ext = os.path.splitext(filepath) filename = os.path.basename(filepath) for hrf in HIGH_RISK_FILES: if filename.endswith(os.path.basename(hrf)): issues.append(f"Sensitive file included: {filepath}") if ext in ['.pyc', '.bin', '.zip', '.tar', '.gz', '.jpg', '.png', '.gif']: return issues try: with open(filepath, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() ``` ```python for root, dirs, files in os.walk(dirpath): for f in files: if f.startswith('.git') or f.endswith('.pyc'): continue fullpath = os.path.join(root, f) issues = self.scan_file(fullpath) ``` The displayed message has been translated into English; the control flow and file operations are unchanged. ### Technical Analysis The scanner recursively processes an untrusted directory and opens each discovered path without checking whether it is a symbolic link. It also does not resolve the path and verify that the resolved target remains beneath the requested scan root. An attacker who controls the directory being scanned can place a symbolic link whose apparent location is inside the package but whose target is an arbitrary file readable by the scanner process. Python's `open()` follows that link by default. Although the scanner does not directly return full file contents, it applies regular expressions to those contents. Results can disclose whether particular patterns occur, while read failures can expose path and error information. The scan also performs an unauthorized read outside its legitimate package boundary. ### Attack Path 1. An attacker constructs a Skill package containing a symbol ...[truncated 1050 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/static_scanner.py:47- Finding
Packages containing sensitive credential files can still be marked safe
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/runtime_protector.py:111- Finding
Runtime protection returns malicious input unchanged in the clean-input field
- Content
View full analysis
str: sanitized = text for pattern in self.ci_patterns: sanitized = pattern.sub('[removed]', sanitized) return sanitized ``` ### Technical Analysis The `check()` method advertises a `clean_input` result but assigns the original input directly to that field, including when the input has been classified as malicious. The separate `sanitize()` method is never called by `check()`. This contradicts the documented runtime-protection workflow, which describes continuing with a sanitized input. The current API creates a dangerous ambiguity: callers may reasonably assume that `clean_input` is safe to consume. The sanitizer itself addresses only command-injection patterns. It does not sanitize prompt-injection or SSRF matches and therefore would not provide complete protection even if called unconditionally. ### Attack Path 1. An attacker submits input matching a prompt-injection, command-injection, or SSRF signature. 2. `check()` correctly marks the request as malicious. 3. The method still stores the unchanged payload in `clean_input`. 4. An integration mistakenly trusts the field name or fails to enforce rejection strictly. 5. The unchanged payload is sent to a downstream agent, command-building routine, or URL-handling component. 6. The downstream component processes the original attack. ### Impact Assessment The direct impact depends on the downstream consumer. Potential consequences include agent instruction manipulation, command injection, or internal-resource requests if another component executes or interprets the returned text unsafely. The method does ...[truncated 225 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
lib/logic_auditor.py:125- Finding
Declared permissions are ignored by the least-privilege auditor
- Content
View full analysis
AuditResult: all_findings = [] for root, dirs, files in os.walk(dirpath): for f in files: if f.startswith('.git') or f.endswith('.pyc') or f == '__pycache__': continue fullpath = os.path.join(root, f) findings = self.audit_file(fullpath) all_findings.extend(findings) high_count = sum( 1 for f in all_findings if f.risk_level == 'high' ) is_safe = high_count == 0 ``` ### Technical Analysis The API accepts `declared_permissions`, and the Skill claims to compare behavior against the principle of least privilege. However, the parameter is never used. The auditor only applies line-oriented regular expressions to selected code extensions. It therefore cannot determine whether filesystem access, network access, command execution, environment-variable access, or other capabilities are consistent with declared permissions. A clean result may be interpreted as a least-privilege approval even though no such analysis occurred. ### Attack Path 1. A Skill declares excessive permissions or performs operations outside its declared scope. 2. A caller passes its permission declaration to `audit()`. 3. `audit_directory()` ignores the declaration. 4. The code avoids the limited regular-expression signatures. 5. The auditor returns `is_safe=True`. 6. A consumer treats the result as confirmation that permission use is appropriate. ### Impact Assessment This is primarily a security-assurance failure rather than a direct privilege-escalation primitive. It can allow overprivileged or undeclared behavior to pass an audit that is represented as enforcing least privilege. The ultimate privileges ...[truncated 142 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (26)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python }, { "name": "权限越权", "pattern": r'\.\./\.\./|/etc/passwd|/root/|\/home\/', "description": "可能存在路径遍历/越权读取系统文件", "risk_level": "high" },
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
python r'you are now', r'your new instruct.* are', # 越狱 r'DAN\|do anything now', r'reflectively\%20accessible', r'repeat the words above', # 敏感操作诱导
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
python r'execute the following commands', r'run the following code', r'ignore all safety guide', r'disregard safety proto', ] COMMAND_INJECTION_PATTERNS = [
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 80% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
python r'execute the following commands', r'run the following code', r'ignore all safety guide', r'disregard safety proto', ] COMMAND_INJECTION_PATTERNS = [
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 匹配实际执行，排除正则定义行 (r'^(?!.*#.*).*(base64|b64decode).*exec', '危险：编码后执行恶意代码'), (r'open\s*\(.*\/proc', '警告：读取进程信息'), (r'open\s*\(.*\.env', '警告：读取环境变量配置文件'), (r'requests\.post\s*\(.*pastebin', '警告：向外发送数据到第三方pastebin'), (r'__file__.*\.\./\.\./', '危险：路径遍历尝试'), ]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 匹配实际执行，排除正则定义行 (r'^(?!.*#.*).*(base64|b64decode).*exec', '危险：编码后执行恶意代码'), (r'open\s*\(.*\/proc', '警告：读取进程信息'), (r'open\s*\(.*\.env', '警告：读取环境变量配置文件'), (r'requests\.post\s*\(.*pastebin', '警告：向外发送数据到第三方pastebin'), (r'__file__.*\.\./\.\./', '危险：路径遍历尝试'), ]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 高危文件 HIGH_RISK_FILES = [ '.ssh/id_rsa', '.ssh/id_dsa', '.git/credentials', '.env',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 高危文件 HIGH_RISK_FILES = [ '.ssh/id_rsa', '.ssh/id_dsa', '.git/credentials', '.env', 'config.json',
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - 权限滥用：超出声明功能的高权限使用 - 隐私访问：未声明的敏感数据读取（照片、文档、聊天记录、密钥等） - 硬编码密钥：生产代码中包含真实凭证、API密钥 - 高风险操作：`rm -rf`/`sudo`/`chmod 777`等危险命令 - 结果处理： - ❌ 发现明确高危行为：直接拦截，终止安装流程 - ⚠️ 高权限但用途匹配、无明确恶意：进入第三层审计
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - 权限滥用：超出声明功能的高权限使用 - 隐私访问：未声明的敏感数据读取（照片、文档、聊天记录、密钥等） - 硬编码密钥：生产代码中包含真实凭证、API密钥 - 高风险操作：`rm -rf`/`sudo`/`chmod 777`等危险命令 - 结果处理： - ❌ 发现明确高危行为：直接拦截，终止安装流程 - ⚠️ 高权限但用途匹配、无明确恶意：进入第三层审计
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing natural-language content primarily in Chinese, including feature and behavior descriptions, but does not indicate that the language is optional or region-specific. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The changelog documents a material security behavior change: an earlier version states the code does not call external services by default, while a later version says a cloud intelligence endpoint is enabled out of the box. For a security-related skill, contradictory disclosure about default network egress can mislead users, cause unreviewed data transmission, and undermine informed consent and deployment decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content of the skill description, usage, and safety rules is presented only in Chinese. Under the policy, forcing a specific language without user opt-in or justification is a language/locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python skill contains its primary description entirely in Chinese, and later emits Chinese-only audit output. For a general-purpose auditing skill, this imposes a specific language/locale without offering user choice or documenting a region-specific constraint, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The report generated for users is emitted in Chinese-only strings such as the success/failure summaries and findings section labels. Because the skill does not provide a language option or explain a justified locale restriction, this is a natural-language policy issue.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring claims the component 'detects and blocks' attacks and 'automatically sanitizes input', but the primary check path only flags suspicious input and returns the original text unchanged in
clean_input. This can create a dangerous false sense of protection, causing downstream code to trust unmodified attacker-controlled input and continue processing it.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The top-level docstring presents the skill’s purpose entirely in Chinese, with no indication that language selection is configurable or optional. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
- Content
python r'system:|SYSTEM:|### System', r'\[SYSTEM\]|\<SYSTEM\>', # 注入后门 r'from now on you will', r'you are now going to act as', r'you are now', r'your new instruct.* are',
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The primary natural-language description of the skill is written only in Chinese and does not offer any language or locale choice. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring and multiple user-facing report strings are written only in Chinese, which effectively fixes the skill's output language without user opt-in. The file does not indicate that this is a region-specific tool or provide any mechanism for selecting another language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The scanner performs a network request that transmits the skill name and source to a remote cloud endpoint whenever cloud lookup is enabled, but there is no user-facing disclosure, consent flow, or obvious opt-in at the call site. In a security tool, silently sending analysis metadata off-host can leak proprietary project identifiers or usage patterns and may violate privacy or compliance expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document title and all operational instructions are presented only in Chinese, which effectively forces a specific language for a broadly applicable security policy. The file does not offer an opt-in language choice or explain that the policy is limited to a Chinese-language or region-specific environment.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - 权限滥用：超出声明功能的高权限使用 - 隐私访问：未声明的敏感数据读取（照片、文档、聊天记录、密钥等） - 硬编码密钥：生产代码中包含真实凭证、API密钥 - 高风险操作：`rm -rf`/`sudo`/`chmod 777`等危险命令 - 结果处理： - ❌ 发现明确高危行为：直接拦截，终止安装流程 - ⚠️ 高权限但用途匹配、无明确恶意：进入第三层审计
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file makes a privacy and safety assurance that only the skill name and source are transmitted and that no sensitive local data is shared, but this claim is not verifiable from the changelog itself and appears in tension with prior statements that the endpoint was only an optional example. Unsupported assurances in security tooling are dangerous because users may trust and deploy outbound telemetry they have not independently validated.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module documentation mixes English headings with Chinese-only descriptive content such as "完整四层纵深安全防御体系" and the exported feature descriptions. Under the policy rule for natural-language violations, this can be considered a language/locale constraint because the skill presents key descriptive information in a fixed language without any opt-in or alternative.
- Content