Security audit

AuditClaw GRC

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent GRC tool, but it handles cloud and identity credentials in ways users should review carefully before installing.

Install only if you are comfortable with a local GRC database and local credential files under ~/.openclaw/grc. Do not paste cloud or identity-provider secrets into chat; prefer short-lived, read-only, provider-native auth and verify which account is being used before running scans. Run URL scanners only against domains you control, and review evidence ZIP contents before sharing them.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/db_query.py:3032
Finding: Cloud Secrets Are Collected Through Chat and Exposed in Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/check_headers.py:73
Finding: Unrestricted URL Scanning Permits Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/export_evidence.py:99
Finding: Evidence Export Path Validation Can Be Bypassed by Prefix-Collision Paths
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/credential_store.py:214
Finding: Configured Authentication Can Silently Fall Back to More Privileged Ambient Credentials
Content: View full analysis
12 else "****" result["secret_available"] = True return result ``` The authentication provider expects a `secret` field that is never returned: ```python if cred and cred.get("auth_method") == "access_key": secret = cred.get("secret", {}) if isinstance(secret, dict) and secret.get("access_key_id"): return boto3.Session( aws_access_key_id=secret["access_key_id"], aws_secret_access_key=secret["secret_access_key"], region_name=secret.get("region", "us-east-1"), ) # Fallback: default boto3 session (env vars / ~/.aws/credentials) return boto3.Session() ``` The same mismatch affects stored GitHub tokens and private keys: ```python private_key = cred.get("secret") if app_id and installation_id and private_key: from github import GithubIntegration import time import jwt as pyjwt now = int(time.time()) payload = { "iat": now - 60, "exp": now + (10 * 60), "iss": app_id, } encoded_jwt = pyjwt.encode(payload, private_key, algorithm="RS256") integration = GithubIntegration(app_id, private_key) token = integration.get_access_token(installation_id).token return Github(token) if cred and cred.get("auth_method") == "personal_token": secret = cred.get("secret") if secret: tok ...[truncated 3179 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (49)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 86)May include surrounding context.
md
AuditClaw uses modern, secure authentication for all cloud integrations: - **AWS**: IAM Roles with AssumeRole (no static access keys) - **GitHub**: GitHub App tokens (no personal access tokens) - **Azure**: Certificate-based service principals (no client secrets) - **GCP**: Service account impersonation (no key files) - **IDP**: OAuth 2.0 / domain-wide delegation

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · assets/policy_templates/access-control.md (reported line 154)May include surrounding context.
md
AuditClaw uses modern, secure authentication for all cloud integrations: - **AWS**: IAM Roles with AssumeRole (no static access keys) - **GitHub**: GitHub App tokens (no personal access tokens) - **Azure**: Certificate-based service principals (no client secrets) - **GCP**: Service account impersonation (no key files) - **IDP**: OAuth 2.0 / domain-wide delegation

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A description-behavior mismatch is dangerous because users and orchestrators rely on the manifest to understand runtime behavior and risk. If the underlying skill opens a local web server on port 8080 and primarily serves dashboard files without declaring that network-listening behavior, it introduces an undeclared attack surface, possible local data exposure, and bypasses informed consent for network capabilities.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · assets/frameworks/cis-controls.json (reported line 6)May include surrounding context.
json
{ "$schema": "framework-definition-v1", "id": "hitrust", "name": "HITRUST CSF v11", "version": "11.0", "description": "The HITRUST Common Security Framework (CSF) is a certifiable security framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. HITRUST CSF harmonizes the requirements of multiple authoritative sources including ISO 27001, NIST, HIPAA, PCI DSS, and COBIT to provide a unified framework for managing information risk across healthcare and other regulated industries.", "domains": [ { "id": "HITRUST-00", "name": "Information Security Management Program", "description": "Establish

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · assets/frameworks/cmmc.json (reported line 6)May include surrounding context.
json
{ "$schema": "framework-definition-v1", "id": "hitrust", "name": "HITRUST CSF v11", "version": "11.0", "description": "The HITRUST Common Security Framework (CSF) is a certifiable security framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. HITRUST CSF harmonizes the requirements of multiple authoritative sources including ISO 27001, NIST, HIPAA, PCI DSS, and COBIT to provide a unified framework for managing information risk across healthcare and other regulated industries.", "domains": [ { "id": "HITRUST-00", "name": "Information Security Management Program", "description": "Establish

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · assets/frameworks/fedramp.json (reported line 6)May include surrounding context.
json
{ "$schema": "framework-definition-v1", "id": "hitrust", "name": "HITRUST CSF v11", "version": "11.0", "description": "The HITRUST Common Security Framework (CSF) is a certifiable security framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. HITRUST CSF harmonizes the requirements of multiple authoritative sources including ISO 27001, NIST, HIPAA, PCI DSS, and COBIT to provide a unified framework for managing information risk across healthcare and other regulated industries.", "domains": [ { "id": "HITRUST-00", "name": "Information Security Management Program", "description": "Establish

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · assets/frameworks/hipaa.json (reported line 6)May include surrounding context.
json
{ "$schema": "framework-definition-v1", "id": "hitrust", "name": "HITRUST CSF v11", "version": "11.0", "description": "The HITRUST Common Security Framework (CSF) is a certifiable security framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. HITRUST CSF harmonizes the requirements of multiple authoritative sources including ISO 27001, NIST, HIPAA, PCI DSS, and COBIT to provide a unified framework for managing information risk across healthcare and other regulated industries.", "domains": [ { "id": "HITRUST-00", "name": "Information Security Management Program", "description": "Establish

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · assets/frameworks/hitrust.json (reported line 6)May include surrounding context.
json
{ "$schema": "framework-definition-v1", "id": "hitrust", "name": "HITRUST CSF v11", "version": "11.0", "description": "The HITRUST Common Security Framework (CSF) is a certifiable security framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. HITRUST CSF harmonizes the requirements of multiple authoritative sources including ISO 27001, NIST, HIPAA, PCI DSS, and COBIT to provide a unified framework for managing information risk across healthcare and other regulated industries.", "domains": [ { "id": "HITRUST-00", "name": "Information Security Management Program", "description": "Establish

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · assets/frameworks/cis-controls.json (reported line 442)May include surrounding context.
json
}, { "id": "CC6.2", "title": "Controls access credentials", "description": "Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users.", "category": "Logical and Physical Access Controls", "priority": 5,

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · assets/frameworks/soc2.json (reported line 177)May include surrounding context.
json
}, { "id": "CC6.2", "title": "Controls access credentials", "description": "Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users.", "category": "Logical and Physical Access Controls", "priority": 5,

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth_provider.py (reported line 23)May include surrounding context.
python
Auth precedence: 1. Stored IAM Role credential -> STS AssumeRole -> temporary session 2. Stored access key credential -> Session with explicit keys 3. Default boto3 Session (env vars, ~/.aws/credentials, instance profile) Returns: boto3.Session

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth_provider.py (reported line 62)May include surrounding context.
python
Auth precedence: 1. Stored IAM Role credential -> STS AssumeRole -> temporary session 2. Stored access key credential -> Session with explicit keys 3. Default boto3 Session (env vars, ~/.aws/credentials, instance profile) Returns: boto3.Session

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/credential_store.py (reported line 107)May include surrounding context.
python
# Determine filename based on auth method filenames = { "iam_role": "session.json", "access_key": "credentials.json", "github_app": "private-key.pem", "personal_token": "token.txt", "service_principal": "certificate.pem",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/credential_store.py (reported line 111)May include surrounding context.
python
"github_app": "private-key.pem", "personal_token": "token.txt", "service_principal": "certificate.pem", "client_secret": "secret.txt", "service_account": "key.json", "sa_impersonation": "config.json", "oauth2": "oauth.json",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/credential_store.py (reported line 118)May include surrounding context.
python
"api_token": "token.txt", "domain_delegation": "sa-key.json", } filename = filenames.get(auth_method, "credential.json") credential_path = _write_secret(provider, filename, secret_data) conn = sqlite3.connect(db_path, timeout=10)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/credential_store.py (reported line 290)May include surrounding context.
python
"api_token": "token.txt", "domain_delegation": "sa-key.json", } filename = filenames.get(auth_method, "credential.json") credential_path = _write_secret(provider, filename, secret_data) conn = sqlite3.connect(db_path, timeout=10)

Unvalidated Output Injection

High

Category: Output Handling
Confidence: 95% confidence
Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
Content: Scanner excerpt · scripts/db_query.py (reported line 2647)May include surrounding context.
python
updates.append("updated_at = ?") params.append(now) params.append(response_id) conn.execute( f"UPDATE questionnaire_responses SET {', '.join(updates)} WHERE id = ?", params )

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/db_query.py (reported line 2986)May include surrounding context.
python
"github": { "provider": "github", "title": "GitHub Integration Setup", "auth_method": "GitHub App (recommended) or Personal Access Token (legacy)", "checks_unlocked": "9 compliance checks: branch protection, secret scanning, 2FA enforcement, Dependabot alerts, code scanning, license, CODEOWNERS, signed commits, audit logs", "steps": [ {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/db_query.py (reported line 2996)May include surrounding context.
python
"github": { "provider": "github", "title": "GitHub Integration Setup", "auth_method": "GitHub App (recommended) or Personal Access Token (legacy)", "checks_unlocked": "9 compliance checks: branch protection, secret scanning, 2FA enforcement, Dependabot alerts, code scanning, license, CODEOWNERS, signed commits, audit logs", "steps": [ {

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup guide explicitly instructs users to send cloud credentials and secret values to the assistant in chat-style interactions. That is highly dangerous because it normalizes direct disclosure of privileged secrets into an LLM/tooling channel that may be logged, retained, or exposed beyond the intended recipient.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section specifically asks the user to send full GCP service-account JSON key material to the assistant. A service-account key is a reusable bearer secret that can provide broad cloud access; exposing it through chat creates immediate risk of account compromise, persistence, and misuse far beyond the GRC function of the skill.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The identity-provider setup flow asks users to provide API tokens and admin key details via chat instructions. Those secrets often grant direct access to identity systems, making compromise especially severe because they can expose user directories, security policies, MFA state, and administrative actions.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · CONTRIBUTING.md (reported line 56)May include surrounding context.
md
3. Add the action name to the `ACTIONS` dispatch dictionary 4. Write tests in a new or existing test file 5. Update `skills/auditclaw-grc/references/db-actions.md` with the action reference 6. Add the command to the Quick Command Reference in `skills/auditclaw-grc/SKILL.md` ### Adding a New Framework

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown advertises 'Full CRUD' across compliance data and an 'Auto-generated Trust Center' but does not include any user-facing warning that these actions may create, modify, delete, or publish potentially sensitive organizational information. For a skill description, this omits disclosure about behaviors that could affect user data and privacy.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares executable installation and clearly instructs use of Python scripts, filesystem writes, network scans, environment-based cloud credentials, and shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a policy/consent gap: an agent may invoke capabilities broader than a user expects, especially in a skill that can read secrets from env vars, write local databases, and make outbound requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.