ClawHub
Back to skill

Security audit

OCMAP Pairing Auth

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill guides a security-sensitive pairing flow, but its credential handling and persistent device trust are disclosed, scoped, and aligned with its purpose.

Before installing, understand that this skill is meant to help implement persistent trusted-device pairing. Treat the pairing code, nonce, and especially bootstrap auth as temporary secrets: keep them short-lived, single-use, rate-limited, out of logs and renderer storage, and provide a clear revoke or forget-device path. Do not expose the long-lived trusted token in browser/UI state.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Desktop/client call. Requires a successful websocket connect + handshake first.

Before calling `pairing.exchangeCode`, the client should use the short-lived bootstrap auth from `pairing.createCode` in the initial `connect.auth` payload so the gateway accepts the first connection without asking the user for a long-lived gateway token.

**Request**
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- derive `deviceId` from the public key and compare
- rebuild the canonical signature payload and verify signature
- call into existing device-pairing approval logic with `silent: true`
- auto-approve the synthetic pending request
- read back the issued trusted-device token
- mark the code used
- return trust material
Confidence
85% confidence
Finding
The auto-approval step removes a human authorization checkpoint and turns possession of the pairing code, bootstrap auth, and signing key into sufficient authority to enroll a trusted device. In this pairing context that can be legitimate, but it is still security-sensitive because any weakness in code secrecy, bootstrap-token handling, replay protection, or signature validation immediately becomes a silent trusted-device enrollment path.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The document explicitly instructs exposing the bootstrap auth token in a UI modal alongside the pairing code and nonce, but gives no guidance on masking, limited display, copy controls, redaction from logs, or user warnings about handling it as a secret. Because bootstrap auth is an authentication credential for the initial connect flow, displaying it casually increases the chance of shoulder-surfing, screenshots, clipboard leakage, or accidental persistence in renderer/UI state.

Static analysis

No suspicious patterns detected.