ClawHub
Back to skill

Security audit

StorageSaver

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real Mac storage watcher, but it should be reviewed because it runs mutable npm-installed code, can execute a user-supplied shell notification command, and stores detailed local disk inventories.

Install only from a package version and source you trust, prefer a pinned version, and check what NOTIFY_CMD will run before scheduling it. Treat the JSON and HTML reports as private because they can reveal filenames, project paths, installed apps, cloud-storage locations, and usage clues. Do not copy any suggested delete command until you have verified the target path and backup status.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned npm Package Is Downloaded and Executed

Content
View full analysis
Remediation
View remediation
npm install -g storagesaver@ ``` 2. Publish the official repository and npm package URLs so users can verify package provenance. 3. Provide an expected package integrity hash or signed release artifact. 4. Recommend installing locally rather than globally where practical. 5. Review and lock transitive dependencies for distributed installations. 6. Use trusted package provenance, release signing, and protected maintainer accounts. 7. Avoid npm lifecycle scripts unless required; document any scripts that execute during installation. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
watcher.js:878
Finding

Detailed Filesystem Inventory Is Persisted Without Explicit Restrictive Permissions

Content
View full analysis
f.startsWith('report-') && f.endsWith('.json')) .sort(); while (reports.length > MAX_REPORT_FILES) { try { fs.unlinkSync(path.join(OUTPUT_DIR, reports.shift())); } catch (_) {} } } catch (e) { log(`report save error: ${e.message}`); } ``` ### Technical Analysis The watcher persists the complete raw scan as plaintext JSON. The report can contain sensitive local metadata, including: - User directory and file paths - Large-file and media filenames - Installed application names - Application usage indicators - Development project locations - Cloud-storage and application-data paths - Cache and backup locations `fs.writeFileSync` is called without an explicit `mode`, and the containing directories are created without an explicit restrictive mode. Resulting permissions therefore depend on the process umask, existing directory permissions, inherited ACLs, and filesystem configuration. Under a permissive environment, another local account or process may be able to inspect these reports. The same configuration directory also contains logs and watcher state. Although those files expose less detail than the raw reports, they should be protected under the same least-privilege policy. ### Attack Path 1. The watcher scans the user's home directory and application-data locations. 2. It serializes the complete raw scan to `reports/report-.json`. 3. The report and its parent directories receive permissions determined by the runtime enviro ...[truncated 960 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (67)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
For a scheduled setup, clone or install the package once so `watcher.js`

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises notification support via NOTIFY_CMD and later executes that value through /bin/sh -c, allowing arbitrary shell command execution in the watcher's security context. This goes well beyond a read-only storage watcher and becomes dangerous if the environment can be influenced by another process, wrapper script, or untrusted scheduler configuration.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 614)May include surrounding context.

js
when = 'no usage signal found';
      }
      lines.push(`  • ${a.name.replace(/\.app$/, '')} — ${bytesHuman(a.bytes)} (${when})`);
      lines.push(`      $ trash ${shq(a.path)}    # or: rm -rf ${shq(a.path)}`);
      recoveryEstimate += a.bytes;
    }
    lines.push('');

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 665)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 666)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 667)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 668)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 674)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 675)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 676)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 677)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 678)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 683)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 684)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 685)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 686)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 687)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 688)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 738)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 785)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 792)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 665)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 666)May include surrounding context.

js
// Easy wins: Trash, caches, build artifacts >1 GB — each with a copy/paste command.
  const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },
    { label: 'npm cache',            bytes: raw.devCruft['npm cache'],                  cmd: "npm cache clean --force" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 667)May include surrounding context.

js
const easyCandidates = [
    { label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },
    { label: 'npm cache',            bytes: raw.devCruft['npm cache'],                  cmd: "npm cache clean --force" },
    { label: 'yarn cache',           bytes: raw.devCruft['yarn cache'],                 cmd: "yarn cache clean" },

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · watcher.js (reported line 668)May include surrounding context.

js
{ label: 'Empty Trash',          bytes: raw.userDirs.Trash,                         cmd: "rm -rf ~/.Trash/*  # or use Finder: right-click Trash → Empty Trash" },
    { label: 'Xcode DerivedData',    bytes: raw.devCruft['Xcode DerivedData'],          cmd: "rm -rf ~/Library/Developer/Xcode/DerivedData/*" },
    { label: 'Xcode Archives',       bytes: raw.devCruft['Xcode Archives'],             cmd: "rm -rf ~/Library/Developer/Xcode/Archives/*  # only if you don't need old app archives" },
    { label: 'iOS DeviceSupport',    bytes: raw.devCruft['Xcode iOS DeviceSupport'],    cmd: "rm -rf ~/Library/Developer/Xcode/iOS\\ DeviceSupport/*" },
    { label: 'npm cache',            bytes: raw.devCruft['npm cache'],                  cmd: "npm cache clean --force" },
    { label: 'yarn cache',           bytes: raw.devCruft['yarn cache'],                 cmd: "yarn cache clean" },
    { label: 'pnpm store',           bytes: raw.devCruft['pnpm store'],                 cmd: "pnpm store prune" },

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
watcher.js:126