ClawHub
Back to skill

Security audit

clawdbot-macos-build

Security checks for vulnerabilities and agentic risk

Overview

This build skill is not deceptive, but it builds and launches a sensitive macOS app from unpinned remote code, so users should review it carefully before use.

Install only if you specifically intend to build Clawdbot from source on macOS. Before running it, pin or verify the upstream commit or signed release, use a frozen lockfile where possible, inspect the packaging script, avoid running repository-provided commands with sudo, and consider building in an isolated account or VM before granting Accessibility, Screen Recording, Microphone, Camera, or similar permissions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:20
Finding

Execution of Unpinned Remote Source Code and Dependencies

Content
View full analysis
Remediation
View remediation
``` 2. Prefer a signed release tag and verify its signature before executing repository content: ```bash git verify-tag ``` 3. Publish the expected commit hash and release-artifact checksums through a trusted channel, then verify them locally before building. 4. Require a committed lockfile and immutable dependency resolution: ```bash pnpm install --frozen-lockfile ``` 5. Disable dependency lifecycle scripts during initial installation where the project supports it: ```bash pnpm install --frozen-lockfile --ignore-scripts ``` Any lifecycle scripts that are genuinely required should be identified, reviewed, and executed explicitly. 6. Review `package.json`, the lockfile, workspace build definitions, and `scripts/package-mac-app.sh` at the pinned revision before running them. 7. Run the build under a non-administrative account or isolated build environment with minimal filesystem, credential, and network access. 8. Do not combine general build execution with elevated privileges. Perform the fixed Xcode license operation separately, and never run `pnpm` or repository-provided scripts with `sudo`. 9. Prefer verified, Developer ID-signed, and notarized release artifacts from a trusted publisher when source compilation is not required. 10. Verify the identity, signature, entitlements, and packaged contents of the resulting application before copying it into `/Applications` or granting sensitive macOS permissions. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Chaining Abuse

High
Category
Tool Misuse
Confidence
83% confidence
Finding

The chained command performs rm -rf clawdbot-build in /tmp immediately before cloning, which normalizes destructive shell patterns and reduces opportunities for user review. Although targeted at a specific directory, chaining deletion with network retrieval in one line increases the chance of accidental misuse, path confusion, or copy/paste execution in an unintended context.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

bash
# Clone repo
cd /tmp && rm -rf clawdbot-build && git clone https://github.com/clawdbot/clawdbot.git clawdbot-build

# Install + build
cd /tmp/clawdbot-build

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
pnpm ui:build

# Accept Xcode license (one-time)
sudo xcodebuild -license accept

# Build macOS app with ad-hoc signing
ALLOW_ADHOC_SIGNING=1 bash scripts/package-mac-app.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

4. Accept Xcode License

Required once per Xcode update. If you get "license not agreed" errors during Swift build, run:

bash
sudo xcodebuild -license accept

5. Package macOS App (scripts/package-mac-app.sh)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

4. Accept Xcode License

Required once per Xcode update. If you get "license not agreed" errors during Swift build, run:

bash
sudo xcodebuild -license accept

5. Package macOS App (scripts/package-mac-app.sh)

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description describes when to use the skill in broad natural language rather than with specific trigger phrases or constraints. It does not provide negative examples or delimit when this build skill should not activate, which could lead to unintended invocation for general installation or macOS-app-related requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.