SysClaw Reporting

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:10 AM UTC
• Version: 4.0.0

Overview

This SysClaw client is purpose-related, but it should be reviewed because it recommends persistent notification polling with stored database credentials and writes external notification text into agent memory.

Install only in an environment where the SysClaw database, operator, and agent roles are trusted and least-privileged. Prefer manual notification checks over the cron workflow, avoid writing notifications into agent memory, keep database passwords in a protected secret store or 0600 credential file, pin the Python dependency, and treat all notification text as untrusted data rather than instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:115

Finding

Persistent Notification Polling Through a Recurring Cron Job

Content

View full analysis

/usr/local/bin/check-sysclaw-notifications.sh << 'SCRIPT' #!/bin/bash export SYSCLAW_DB_HOST="" export SYSCLAW_DB_PORT="5432" export SYSCLAW_DB_NAME="system_comm" export SYSCLAW_DB_USER="" export SYSCLAW_DB_PASSWORD="" bash "/scripts/check-notifications.sh" > "/memory/notifications.md" 2>/dev/null SCRIPT chmod +x /usr/local/bin/check-sysclaw-notifications.sh # Add to crontab (crontab -l 2>/dev/null; echo "*/15 * * * * /usr/local/bin/check-sysclaw-notifications.sh") | crontab - ``` ### Technical Analysis The installation instructions create an executable in `/usr/local/bin` and register it in the current user's crontab. The command consequently survives the current Skill invocation and executes every 15 minutes across later sessions. This persistence is not required for the Skill's core purpose of reporting issues, submitting requests, and checking responses. The documentation already provides an explicit `check-notifications.sh` command that can be run at session start. The recurring task therefore exceeds the minimum execution scope needed for the declared functionality. Writing to `/usr/local/bin` will commonly require elevated installation privileges. The cron task itself runs with the privileges of the user whose crontab was modified; it does not independently escalate privileges. The append operation also lacks duplicate detection, so repeated installation can create multiple identical scheduled entries. ### Attack Path 1. A user follows the documented post-install procedure. 2. A persistent wrapper is created under `/usr/local/bin`, potentially using elevated privileges. 3. The wrapper, including its configu ...[truncated 883 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:117

Finding

Plaintext Database Credentials in an Executable and Process Arguments

Content

View full analysis

/usr/local/bin/check-sysclaw-notifications.sh << 'SCRIPT' #!/bin/bash export SYSCLAW_DB_HOST="" export SYSCLAW_DB_PORT="5432" export SYSCLAW_DB_NAME="system_comm" export SYSCLAW_DB_USER="" export SYSCLAW_DB_PASSWORD="" bash "/scripts/check-notifications.sh" > "/memory/notifications.md" 2>/dev/null SCRIPT chmod +x /usr/local/bin/check-sysclaw-notifications.sh ``` The notification script then places the password in Python's command-line argument vector: ```bash python3 - "$agent_name" "$mark_read" \ "$DB_HOST" "$DB_PORT" "$DB_NAME" "$DB_USER" "$DB_PASSWORD" <<'PYEOF' ``` The issue-reporting script does the same: ```bash python3 - "$source" "$severity" "$title" "$category" "$details" "$source_host" \ "$DB_HOST" "$DB_PORT" "$DB_NAME" "$DB_USER" "$DB_PASSWORD" <<'PYEOF' ``` The resource-request script repeats this pattern: ```bash python3 - "$source" "$request_type" "$action" "$target" "$justification" "$urgency" "$payload" "$source_host" \ "$DB_HOST" "$DB_PORT" "$DB_NAME" "$DB_USER" "$DB_PASSWORD" <<'PYEOF' ``` ### Technical Analysis The documented wrapper permanently stores a plaintext database password in a shell script. The instructions only apply `chmod +x`; they do not explicitly restrict group or other read permissions. Depending on the user's umask and ownership, other local users or services may be able to read the credential. All three scripts additionally supply the password as a positional argument to `python3`. Command-line arguments can be exposed thr ...[truncated 1557 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:124

Finding

Untrusted Database Notifications Are Persisted in Agent Memory

Content

View full analysis

/scripts/check-notifications.sh" > "/memory/notifications.md" 2>/dev/null ``` ```bash Then at session start: `cat memory/notifications.md` ``` ### Technical Analysis The `sender`, `urgency`, and `message` values originate from the database and are rendered without trust labeling, content isolation, or sender authentication in the client. The output is then written directly to `memory/notifications.md`, a path explicitly intended to persist information across Agent sessions. An actor capable of inserting or modifying notifications can place instruction-like content in the `message` field. When that content is loaded into a later Agent session, it may be interpreted as op ...[truncated 1905 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes an outbound reporting/request skill for sending issues and requests to SysClaw through cross-agent communication. The supplied code instead implements an inbound notification reader: it connects to a PostgreSQL database, queries unread notifications for an agent, displays them, and optionally updates them to read. This is a materially different primary purpose. While both relate loosely to agent communication, the implemented behavior is about checking notifications, not reporting issues or submitting requests. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code aligns with the 'report system issues' portion of the description, but it does not implement the broader stated functionality of requesting resources or other SysClaw actions. Its sole behavior is to validate issue fields and insert a new open issue into a database table. That is materially narrower than the declared purpose, which claims support for many kinds of requests beyond issue reporting. The direct DB write may still be part of a communication system, so that alone is not the main problem; the main mismatch is the missing request-submission functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code clearly implements submission of SysClaw requests, which aligns with part of the description. However, the declared purpose also emphasizes reporting system issues (errors, warnings, info-level issues) for triage. This script does not provide an issue-reporting path or issue severity model beyond request urgency, and its accepted type values are request-oriented (access, software, resource, config, service, deployment, info) rather than issue-oriented. Also, the implementation is specifically a PostgreSQL-backed insert into agent_requests and notifications, which is narrower and more concrete than the declared 'cross-agent communication system.' This is a partial match but still a meaningful description-behavior mismatch because a major declared use case—issue reporting—is not actually implemented in this code chunk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest uses very broad trigger phrases such as install package, restart service, deploy, check status, and request access. Overbroad activation increases the chance that this high-impact skill is invoked in inappropriate contexts, causing agents to escalate operational or sensitive actions too readily and potentially route privileged requests without sufficient user intent verification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to create a system-wide executable under /usr/local/bin and a persistent cron entry that writes data into a local file path. This expands the skill's footprint beyond ad hoc reporting and creates persistence plus a recurring data flow that could expose notification contents or be abused if paths, script contents, or environment variables are tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions place database credentials in plaintext environment exports inside a persistent system-wide script. This is dangerous because credentials may be exposed to local users, backups, process/environment leakage, or accidental publication, and compromise of those credentials could enable unauthorized access to the SysClaw communication database.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The crontab instruction establishes persistent scheduled execution, which is a recognized persistence mechanism. In the context of an agent skill, persistence increases attack surface and can continue operating outside the user's immediate awareness, especially when combined with stored credentials and file writes.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

SCRIPT chmod +x /usr/local/bin/check-sysclaw-notifications.sh

Add to crontab

(crontab -l 2>/dev/null; echo "*/15 * * * * /usr/local/bin/check-sysclaw-notifications.sh") | crontab -

text

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Providing direct SQL insertion guidance bypasses any higher-level validation, authorization workflow, or message-format constraints that wrapper scripts or a proper API might enforce. If users follow this pattern broadly, they may submit malformed, unauthorized, or spoofed requests directly into backend tables, increasing the risk of misuse and weakening audit controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.