Neckr0ik Security Suite

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This security-suite skill is not clearly malicious, but it needs review because it can modify user files, relies on unpinned external scanner/fixer code, and may overstate compliance certification results.

Install only if you are comfortable running unpinned third-party scanner/fixer code on the target skill directory. Use scan and dry-run first, review diffs before applying fixes, avoid relying on generated certificates as real SOC 2, HIPAA, PCI-DSS, or GDPR compliance proof, and avoid writing reports over important existing files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: claw.json:18
• Finding: Unpinned External Dependencies Execute Security-Critical Code<![CDATA[ ## Vulnerability Details **File Location**: `claw.json:18-21`, `scripts/suite.py:18-26` **Vulnerability Type**: Supply-chain risk from unpinned executable dependencies **Risk Level**: High ### Vulnerable Code ```json "dependencies": [ "neckr0ik-security-scanner", "neckr0ik-security-fixer" ] ``` ```python # Import sibling modules sys.path.insert(0, str(Path(__file__).parent.parent / "neckr0ik-security-scanner" / "scripts")) sys.path.insert(0, str(Path(__file__).parent.parent / "neckr0ik-security-fixer" / "scripts")) try: from audit import audit_skill, Severity, Vulnerability from fixer import Fixer except ImportError: # If modules not available, use standalone pass ``` ### Technical Analysis The project delegates its scanning and automatic file-remediation operations to two dependencies that have no declared version or integrity constraint. Their source code is not included in the audited project, so their effective behavior cannot be verified from this package. The script also prepends dependency-controlled directories to `sys.path` and then imports generic module names, `audit` and `fixer`. Python executes top-level module code during import. Consequently, any malicious or compromised module resolved from these directories runs with the same operating-system permissions as the suite. The generic imports also increase module-resolution ambiguity. The implementation does not verify that the imported modules originated from an expected, trusted file before executing them. ### Attack Path 1. An attacker compromises one of the named dependency packages, introduces a malicious future version, or causes an attacker-controlled dependency directory to be installed at the expected sibling path. 2. The package manager resolves the dependency without an exact version or integrity hash. 3. The user invokes `scripts/suite.py`. 4. The script places the dependency's `scripts` directory at the front of `sys.path`. 5. Python imports and ex ...[truncated 710 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin both dependencies to exact, reviewed versions rather than resolving unconstrained releases. 2. Require cryptographic integrity verification through hashes, signed packages, or a trusted lockfile. 3. Audit the complete source of each dependency before permitting it to scan or modify repositories. 4. Replace `sys.path` manipulation and generic imports with normal package-qualified imports. 5. Verify imported module origins against approved installation paths before using them. 6. Run scanner and fixer dependencies with least privilege in an isolated environment that exposes only the target directory. 7. Separate scanning from modification and require explicit review before applying dependency-generated fixes. 8. Add continuous dependency monitoring and a documented update-review process. ]]>

other

Warning

• Location: scripts/suite.py:137
• Finding: Compliance Certificates Can Be Issued Without Affirmative Control Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/suite.py:137-166` **Vulnerability Type**: Inadequate compliance validation and fail-open control assessment **Risk Level**: Medium ### Vulnerable Code ```python def check_compliance(skill_path: str, framework: Framework, vulnerabilities: List[Vulnerability]) -> ComplianceResult: """Check compliance against a framework.""" framework_info = FRAMEWORKS.get(framework, FRAMEWORKS[Framework.SOC2]) controls = {ctrl: True for ctrl in framework_info["controls"]} findings = [] for vuln in vulnerabilities: # Map vulnerability to controls for prefix, affected_controls in framework_info["mappings"].items(): if vuln.id.startswith(prefix): for ctrl in affected_controls: if ctrl in controls: controls[ctrl] = False findings.append({ "control": ctrl, "control_name": framework_info["controls"][ctrl], "vulnerability": vuln.id, "severity": vuln.severity.value, "description": vuln.description, "file": vuln.file, "line": vuln.line, }) # Overall compliance compliant = all(controls.values()) return ComplianceResult( framework=framework, compliant=compliant, controls=controls, findings=findings, certificate_id=generate_certificate_id() if compliant else "NOT-COMPLIANT", timestamp=datetime.now().isoformat(), ) ``` ### Technical Analysis Every framework control is initialized to `True`. A control fails only when the external scanner returns a vulnerability whose identifier begins with one of a limited set of recognized prefixes. The absence of a recognized finding is ther ...[truncated 1825 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Initialize every control to `unknown` or `not_assessed`, not `passed`. 2. Mark a control as passed only after a defined test produces affirmative, auditable evidence. 3. Require all mandatory controls to be explicitly assessed before issuing any positive result. 4. Treat scanner errors, unavailable dependencies, unknown finding identifiers, and incomplete evidence as non-certifiable conditions. 5. Expand the assessment model to include framework-specific technical, administrative, and operational evidence. 6. Record which tests support each control, their timestamps, evidence references, and assessment limitations. 7. Clearly label generated output as a limited static-analysis report rather than an independent certification. 8. Prevent use of the word “certificate” and suppress certificate identifiers unless an authorized assessment process has validated all required controls. 9. Add tests proving that unassessed controls, scanner failures, and unrecognized vulnerability categories cannot result in a compliant status. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documentation claims a complete security and compliance suite, but the described behavior extends beyond the declared description and references supporting components not present in this file. Security tooling that overstates coverage or certification capability can create false assurance, causing users to trust scans, fixes, or compliance outputs that may be incomplete or unsupported.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill advertises capabilities that read and modify user files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the operational boundary unclear and can lead to over-broad execution in environments that rely on manifest-declared permissions for policy enforcement and user trust.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill describes auto-fix behavior that rewrites files and can apply all fixes automatically, but it does not prominently warn users that their files may be modified. In a security tool, silent or insufficiently disclosed mutation of source trees can cause data loss, unsafe changes, or unwanted bulk edits to sensitive code and configuration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The quick-start examples prominently include automatic remediation commands such as '--auto' without any adjacent caution about backups, destructive edits, or review before applying changes. Users commonly copy-paste quick-start commands, so unsafe examples materially increase the chance of accidental modification of production or sensitive files.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The module and CLI present framework-specific reporting and certification, implying certificate metadata should correspond to the selected framework. However, generate_certificate_id hardcodes a SOC2 prefix for every certificate, which contradicts the framework-specific certification behavior implemented elsewhere.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The fix command invokes scan-and-fix and apply_fixes, which are file-modifying operations, but this file provides only terse command help and progress messages after execution starts. There is no clear user-facing warning in code comments, docstrings, or prompts here that running fix/--auto will change files, which is a safety-relevant operation for a general security suite.

Description-Behavior Mismatch

Low

• Confidence: 96% confidence
• Finding: The manifest description enumerates scanner, fixer, and compliance reports for SOC2, HIPAA, and PCI-DSS. The code expands that advertised scope by defining a GDPR framework and exposing it through both the report and certify CLI commands, so the implemented behavior does not match the stated description.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The code writes report content to a user-supplied path using Path.write_text, and a similar write occurs for certificates. Although writing output files is part of the command purpose, this file does not disclose overwrite behavior or emit a confirmation when saving to an existing path.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The certify command saves generated certificate text to a caller-provided path with Path.write_text. This is a file-write operation with no explicit overwrite warning or confirmation in this file, which may surprise users if the target file already exists.