ClawHub
Back to skill

Security audit

agent-bom

Security checks for vulnerabilities and agentic risk

Overview

This security scanner is purpose-aligned, but it should be reviewed because it installs and runs an unpinned external package before handling sensitive local agent configuration.

Review before installing. If you use it, pin the package to the reviewed version, prefer an isolated environment, verify the package with an independent trusted verifier before scanning configs, and run only the specific scan you need. Expect agent-bom agents to inspect many local AI tool configuration files, and expect CVE enrichment to disclose package names or CVE IDs to vulnerability databases. Confirm cloud, proxy, and dashboard actions explicitly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:378
Finding

Unpinned Third-Party Package Is Installed and Executed Before Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (35)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
96% confidence
Finding

The skill explicitly declares access to local agent configuration files such as Claude settings, which can contain MCP server definitions, commands, URLs, and sometimes references to secrets or sensitive local tooling. Even if the stated intent is inventory and security scanning, broad automatic reads across many agent config locations materially increase exposure of sensitive local environment metadata and create privacy and reconnaissance risk if the tool is compromised or misused.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
- "~/Library/Application Support/Claude/claude_desktop_config.json"
      - "~/.config/Claude/claude_desktop_config.json"
      # Claude Code
      - "~/.claude/settings.json"
      - "~/.claude.json"
      # Cursor
      - "~/.cursor/mcp.json"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
96% confidence
Finding

Reading Codex CLI configuration from ~/.codex/config.toml is sensitive because such files may reveal model providers, endpoints, plugin/tool configuration, and environment variable references that help map the user's local agentic infrastructure. In a security scanner skill, this behavior is contextually expected, but it still creates a significant confidentiality risk because the scan reaches into private per-user configuration by default.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
# VS Code Copilot
      - "~/Library/Application Support/Code/User/mcp.json"
      # Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
96% confidence
Finding

Access to ~/.gemini/settings.json can expose private agent configuration, enabled tools, endpoints, and other local security-relevant metadata. The skill's stated purpose makes this behavior understandable, but enumerating and reading personal AI tool configs across the home directory remains a high-risk capability because it centralizes sensitive operational context.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
# Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose
      - "~/.config/goose/config.yaml"
      # Continue

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
96% confidence
Finding

Reading ~/.continue/config.json is a true security concern because Continue configs can describe models, endpoints, commands, and integration settings that reveal local attack surface and trust relationships. Although this is aligned with the scanner's inventory function, the breadth of cross-tool config harvesting amplifies the impact of any parsing bug, logging mistake, or future supply-chain compromise.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
# Goose
      - "~/.config/goose/config.yaml"
      # Continue
      - "~/.continue/config.json"
      # Zed
      - "~/.config/zed/settings.json"
      # Roo Code

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

md
skill_trust(skill_path="./SKILL.md")

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · discover/SKILL.md (reported line 46)May include surrounding context.

md
- "~/Library/Application Support/Claude/claude_desktop_config.json"
      - "~/.config/Claude/claude_desktop_config.json"
      # Claude Code
      - "~/.claude/settings.json"
      - "~/.claude.json"
      # Cursor
      - "~/.cursor/mcp.json"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · discover/SKILL.md (reported line 58)May include surrounding context.

md
# VS Code Copilot
      - "~/Library/Application Support/Code/User/mcp.json"
      # Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · discover/SKILL.md (reported line 60)May include surrounding context.

md
# Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose
      - "~/.config/goose/config.yaml"
      # Continue

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · discover/SKILL.md (reported line 64)May include surrounding context.

md
# Goose
      - "~/.config/goose/config.yaml"
      # Continue
      - "~/.continue/config.json"
      # Zed
      - "~/.config/zed/settings.json"
      # Roo Code

MCP Config Access

High
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · discover/SKILL.md (reported line 133)May include surrounding context.

md
# Check configuration health and prerequisites
agent-bom doctor

# List MCP server inventory
agent-bom mcp inventory

# Show all discovery paths

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

The skill declares access to local agent configuration files under the user's home directory, which may contain sensitive metadata such as MCP server definitions, local commands, URLs, and potentially security-relevant integration settings. Even if the stated intent is security discovery, reading broad config locations expands exposure to confidential local environment details and increases the blast radius if the tool mishandles parsing, logging, or downstream transmission.

Content

Scanner excerpt · scan/SKILL.md (reported line 51)May include surrounding context.

md
- "~/Library/Application Support/Claude/claude_desktop_config.json"
      - "~/.config/Claude/claude_desktop_config.json"
      # Claude Code
      - "~/.claude/settings.json"
      - "~/.claude.json"
      # Cursor
      - "~/.cursor/mcp.json"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

Access to ~/.codex/config.toml can expose local agent tooling configuration, endpoints, command paths, and other operational details that are sensitive in aggregate. In a security-scanning skill this access is contextually relevant, but it remains a real privacy and security risk because it touches user-specific configuration outside the immediate working directory.

Content

Scanner excerpt · scan/SKILL.md (reported line 63)May include surrounding context.

md
# VS Code Copilot
      - "~/Library/Application Support/Code/User/mcp.json"
      # Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

Reading ~/.gemini/settings.json exposes another assistant's local configuration and may reveal server endpoints, tool wiring, or other environment-specific information useful to an attacker or inappropriate to inspect without consent. The fact that this skill inventories agent infrastructure makes the access more understandable, but also means broad cross-tool discovery materially increases sensitivity.

Content

Scanner excerpt · scan/SKILL.md (reported line 65)May include surrounding context.

md
# Codex CLI
      - "~/.codex/config.toml"
      # Gemini CLI
      - "~/.gemini/settings.json"
      # Goose
      - "~/.config/goose/config.yaml"
      # Continue

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

Scanning ~/.continue/config.json similarly reaches into local agent configuration that may contain private topology and integration data. This is not obviously malicious, but it is a true overbroad local data access risk because the skill is authorized to inspect a wide set of unrelated application configs by default.

Content

Scanner excerpt · scan/SKILL.md (reported line 69)May include surrounding context.

md
# Goose
      - "~/.config/goose/config.yaml"
      # Continue
      - "~/.continue/config.json"
      # Zed
      - "~/.config/zed/settings.json"
      # Roo Code

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill declares outbound connections to external vulnerability services, which creates a real data exposure boundary even if it claims to transmit only package names and CVE IDs. In a tool that scans local configs and software inventories, sending package metadata off-host can reveal aspects of the user's environment, installed stack, or security posture to third parties.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
- "user-provided SKILL.md files (for skill_trust analysis)"
    file_writes: []
    network_endpoints:
      - url: "https://api.osv.dev/v1"
        purpose: "OSV vulnerability database — batch CVE lookup for packages"
        auth: false
      - url: "https://services.nvd.nist.gov/rest/json/cves/2.0"

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Sending CVE or package context to EPSS introduces another third-party egress path and expands the set of external services learning about scanned software components. While this is common for enrichment, it still increases privacy and operational security risk, particularly in enterprise or sensitive environments where software inventory itself is confidential.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
- url: "https://services.nvd.nist.gov/rest/json/cves/2.0"
        purpose: "NVD secondary enrichment — adds CWE IDs, dates, references (no key required)"
        auth: false
      - url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores"
        auth: false
      - url: "https://api.github.com/advisories"

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

GitHub advisory lookups are a legitimate scanner feature, but they are still an external transmission vector that can disclose package usage and timing of scans to a third party. Because this skill also performs broad local discovery, the surrounding context makes any outbound metadata sharing more sensitive than a narrow single-package checker.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md
- url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores"
        auth: false
      - url: "https://api.github.com/advisories"
        purpose: "GitHub Security Advisories — supplemental CVE lookup"
        auth: false
      - url: "https://api.snyk.io"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · analyze/SKILL.md (reported line 44)May include surrounding context.

md
file_reads: []
    file_writes: []
    network_endpoints:
      - url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores for CVEs found in scan"
        auth: false
      - url: "https://api.osv.dev/v1"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scan/SKILL.md (reported line 107)May include surrounding context.

md
file_reads: []
    file_writes: []
    network_endpoints:
      - url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores for CVEs found in scan"
        auth: false
      - url: "https://api.osv.dev/v1"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · analyze/SKILL.md (reported line 47)May include surrounding context.

md
- url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores for CVEs found in scan"
        auth: false
      - url: "https://api.osv.dev/v1"
        purpose: "OSV vulnerability database — CVE detail lookup"
        auth: false
    telemetry: false

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scan/SKILL.md (reported line 101)May include surrounding context.

md
- url: "https://api.first.org/data/v1/epss"
        purpose: "EPSS exploit probability scores for CVEs found in scan"
        auth: false
      - url: "https://api.osv.dev/v1"
        purpose: "OSV vulnerability database — CVE detail lookup"
        auth: false
    telemetry: false

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description lists "proxy" as a standalone invocation phrase, and the body repeats "proxy" / "MCP proxy" as when-to-use triggers. On its own, "proxy" is ambiguous and could match many unrelated user requests, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file uses "apply policy" and "policy enforcement" as activation language, but these phrases are generic and could refer to many unrelated organizational, security, or application policies. The trigger scope is not tightly constrained to MCP runtime enforcement in the invocation wording itself.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest's 'when' description uses ambiguous phrases like 'fleet', 'watch agents', and 'serve dashboard' without enough scope constraints, which weakens routing precision. In an agent environment, this can lead to over-selection of the skill for generic requests and may surface local-serving behavior in contexts where the user did not intend to run monitoring software.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match common operational language such as 'fleet', 'runtime status', or 'trust scores' without requiring clear security-scanning intent. This can cause the skill to activate in unrelated contexts and recommend or initiate actions like starting a local dashboard server, increasing the chance of unintended tool use or confusing security-relevant workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.