ClawHub
Back to skill

Security audit

proof-loop

Security checks for vulnerabilities and agentic risk

Overview

The scanners returned a benign verdict because the reported findings were treated as expected for the skill’s purpose, though overall confidence is medium and some references were unresolved.

The verdict is benign, but it does not mean risk-free. AIG completed with no findings; Skillspector inspected all listed components but marked its analysis partial because some local references were missing or ambiguous. Consider whether the detected file and shell capabilities fit your needs, and remember that runtime permissions were not verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · docs/security-review.md (reported line 10)May include surrounding context.

md
## Reviewed scanner false positives

The navigation-label checker is a demo fixture, not the skill implementation. Local initialization writes task artifacts by design; it does not self-modify the installed skill. Tests use argument-list subprocess calls, not shell interpolation. German/English strings are fixture expectations, not a language policy imposed on users. The workflow table grants no destructive-action authority.

## Trust boundary

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/init_task.py (reported line 35)May include surrounding context.

python
def write(path: Path, content: str, force: bool) -> None:
    if path.exists() and not force:
        raise SystemExit(f"Refusing to overwrite existing file: {path}")
    path.write_text(content, encoding="utf-8")

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · bin/proof-loop (reported line 23)May include surrounding context.

text
def run_python(script: str, args: list[str]) -> int:
    return subprocess.call([sys.executable, str(ROOT / "scripts" / script), *args])


def load_json(path: Path) -> Any:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · examples/demo-repo/run_demo.py (reported line 19)May include surrounding context.

python
def run(cmd: list[str], cwd: Path) -> subprocess.CompletedProcess[str]:
    print("$ " + " ".join(cmd))
    result = subprocess.run(cmd, cwd=cwd, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
    print(result.stdout.strip())
    print(f"exit={result.returncode}")
    return result

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/workflow.md (reported line 100)May include surrounding context.

md
| Failure | Prevention |
|---------|-----------|
| Agent claims done without checking | Verifier is separate, required |
| ACs drift during build | Spec is frozen before build starts |
| Later sessions can't tell what was verified | Verdict artifacts stay in repo |
| Builder judges own work | Fresh verifier is a hard rule |

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_artifact_regressions.py (reported line 17)May include surrounding context.

python
task = Path(tmp) / SOURCE.name
            shutil.copytree(SOURCE, task)
            change(task)
            result = subprocess.run(["python3", str(ROOT / "bin/proof-loop"), command, str(task)], capture_output=True, text=True)
            self.assertNotEqual(result.returncode, 0, result.stdout)
            self.assertNotIn("Traceback", result.stderr)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_cli.py (reported line 22)May include surrounding context.

python
argv = [str(a) for a in args]
    if Path(argv[0]).parent == ROOT / "bin":
        argv.insert(0, sys.executable if Path(argv[0]).name == "proof-loop" else "bash")
    return subprocess.run(
        argv,
        cwd=cwd,
        text=True,

Scope Creep

Low
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · examples/role-briefs/fixer.md (reported line 20)May include surrounding context.

md
## Hard Boundaries

- Do not broaden scope.
- Do not rewrite unrelated code.
- Do not write final sign-off.