T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:81- Finding
Nonexistent Security Wrapper Is Presented as an Operational Shell Control
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawshell 0.1.0
Security checks for vulnerabilities and agentic risk
Overview
This skill claims to add a human-approval shell guard, but the package does not include the tools it tells users to rely on.
Review this before installing. The documented security model depends on tools that are not present in the package, so copying the TOOLS.md instructions could break shell use or create false confidence that risky commands require approval. Do not rely on this as a shell safety layer unless the publisher supplies the missing implementation, tool registration, fail-closed behavior, and tests proving dangerous commands are blocked or approved as described.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
package.json:1- Finding
Installation Pulls an Unrelated Third-Party Package Without Providing the Claimed Functionality
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 1. The agent calls `clawshell_bash` instead of `bash` 2. ClawShell analyzes the command against built-in and configurable risk rules 3. Based on risk level: - **Critical** (e.g. `rm -rf /`, fork bombs) — automatically blocked - **High** (e.g. `rm -rf`, `curl` to external URLs, credential access) — sends a push notification and waits for your approval - **Medium** (e.g. `npm install`, `git push`) — logged and allowed - **Low** (e.g. `ls`, `cat`, `git status`) — allowed
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 1. The agent calls `clawshell_bash` instead of `bash` 2. ClawShell analyzes the command against built-in and configurable risk rules 3. Based on risk level: - **Critical** (e.g. `rm -rf /`, fork bombs) — automatically blocked - **High** (e.g. `rm -rf`, `curl` to external URLs, credential access) — sends a push notification and waits for your approval - **Medium** (e.g. `npm install`, `git push`) — logged and allowed - **Low** (e.g. `ls`, `cat`, `git status`) — allowed
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json { "dependencies": { "package-lock.json": "^1.0.0" } }
Static analysis
No suspicious patterns detected.