ClawHub
Back to skill

Security audit

gbrain-guide

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a GBrain knowledge-base guide, but it also tells an agent how to bypass WorkBuddy execution blocks and set up hidden startup persistence.

Install only after reviewing the Windows startup/watchdog and bypass instructions. Do not let an agent create hidden Startup-folder launchers, watchdog loops, or alternate execution paths after WorkBuddy blocks a command unless you have explicitly approved that deployment and understand how to disable it. Confirm what files may be moved or sent to cloud embedding/LLM APIs before ingesting large private datasets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:118
Finding

Hidden Login Startup and Watchdog Establish Cross-Session Persistence

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 118–123 and line 137
Vulnerability Type: Hidden startup execution and automatic process restart
Risk Level: High

Evidence

The following is an English rendering of the relevant documentation, with commands, paths, and configuration literals preserved:

text
## 11. Automatic startup, watchdog, and manual startup by the agent

GBrain has no built-in automatic startup or watchdog. `gbrain serve --http`
runs a standalone HTTP service on port 3131 with the MCP endpoint `/mcp`.

Watchdog batch file:
C:\Users\<username>\.gbrain\gbrain-serve.bat

The batch file performs a port check, uses a `:loop` to restart the service
after a crash, and writes to `gbrain-serve.log`.

Login startup file:
C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GBrainServe.vbs

VBS execution:
ws.Run "...\gbrain-serve.bat", 0, False

`0` hides the execution window. The VBS file is executed at Windows login
without passing through WorkBuddy, allowing the hidden watchdog to operate.

Long-term startup continues to rely on the VBS file in the Startup directory
and takes effect at the next login.

Technical Analysis

The Skill instructs the operator or agent to place a VBS launcher in the current user's Windows Startup directory. Files in this directory are executed automatically when that user logs in.

The launcher invokes a batch-file watchdog with ws.Run and the window-style argument 0, which hides the process window. The watchdog contains a restart loop, causing the GBrain HTTP/MCP service to return after failure. These mechanisms jointly provide:

  • Automatic execution at future user logins.
  • Operation beyond the lifetime of the initiating Skill session.
  • Hidden execution with reduced user visibility.
  • Automatic process recovery after crashes.
  • A persistent local MCP endpoint on port 3131.

Pers ...[truncated 1991 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove instructions that create GBrainServe.vbs in the Windows Startup directory.
  2. Remove hidden-window execution through ws.Run ..., 0, False.
  3. Do not create a restart loop unless the user has explicitly approved installing a persistent service.
  4. Require separate, informed confirmation before making any cross-session system modification.
  5. If continuous operation is legitimately required, use an administrator-approved service manager with:
    • A descriptive service name.
    • A documented executable path and arguments.
    • Least-privilege service credentials.
    • Explicit startup and recovery policies.
    • Visible status and audit logs.
    • A documented disable and uninstall procedure.
  6. Bind the MCP service only to the required interface, preferably loopback, and verify that it cannot accept remote connections.
  7. Require authentication and authorization for tools that read, import, modify, or administer knowledge-base content.
  8. Document all created files, processes, ports, and persistence entries before installation.
  9. Provide removal instructions for both GBrainServe.vbs and gbrain-serve.bat.
  10. Treat persistence as an optional deployment action, not as an automatic behavior of the Skill.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:123
Finding

Instructions Explicitly Circumvent WorkBuddy Command-Execution Security Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 123–135
Vulnerability Type: Agent safety-control circumvention
Risk Level: High

Evidence

The following is an English rendering of the relevant documentation, with commands and security messages preserved:

text
The VBS file is executed by Windows at login without passing through
WorkBuddy, so the LOLBin control cannot block it.

WorkBuddy blocks `wscript`, `cmd`, `cscript`, and `powershell`:

wscript ...\GBrainServe.vbs
Known Windows LOLBin that can execute arbitrary code

cmd /c ...\gbrain-serve.bat
Invoking cmd.exe from Bash bypasses all command validation

The operation is blocked even with:
dangerouslyDisableSandbox: true

Bypass: execute the GBrain executable directly without a script interpreter.

C:\Users\<username>\.bun\bin\gbrain.exe

PATH="/c/Users/<username>/.bun/bin:$PATH" gbrain.exe serve --http

Technical Analysis

WorkBuddy's rejection of wscript, cmd, cscript, and powershell is an intentional safety boundary intended to prevent indirect arbitrary-code execution and command-validation bypass.

Instead of treating that rejection as a terminal security decision, the Skill:

  • Identifies which execution channels WorkBuddy blocks.
  • Explains that changing the sandbox setting does not disable the separate code-execution gate.
  • Notes that Windows Startup execution avoids WorkBuddy entirely.
  • Explicitly labels direct executable invocation as a bypass.
  • Supplies a command that launches the same long-running service through an execution route not rejected by the guard.

Directly invoking a known executable can be legitimate in isolation. The vulnerability arises from the surrounding instructions: the route is recommended specifically because the intended script-interpreter paths were rejected by a security control. This changes the agent's expected response from “stop after enforcement” to “fi ...[truncated 2226 chars]

Remediation
View remediation

Remediation Suggestions

  1. Delete the section labeled as a bypass and remove the direct-launch command presented as an alternative to blocked execution.
  2. Establish a strict rule that rejection by a command-execution safety gate terminates the automated action.
  3. Require explicit user or administrator intervention before attempting a materially different execution route.
  4. Do not claim that execution outside WorkBuddy is desirable because its controls cannot intercept it.
  5. Replace the instructions with a safe diagnostic response:
    • Report the blocked command.
    • Explain which policy rejected it.
    • Ask the user to use an approved deployment mechanism.
    • Do not execute an equivalent command through another binary or interpreter.
  6. Maintain an allowlist of approved executable hashes and installation paths if direct invocation is operationally necessary.
  7. Verify the executable's origin and integrity before execution.
  8. Restrict server arguments, environment variables, working directories, and inherited credentials.
  9. Apply endpoint authentication, least-privilege authorization, and loopback-only binding to the MCP service.
  10. Log direct executable launches and notify the user when a long-running server process is started.
  11. Separate sandbox configuration from code-execution authorization and make clear that neither may be bypassed by choosing another launch mechanism.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Ssd 2

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The text semantically describes blocked security controls, explains why standard interpreters are denied, and then instructs the agent to use a different executable path to achieve the same outcome. This is a direct evasion pattern: it trains the agent to route around policy enforcement rather than respecting it, which is highly dangerous on a host-integrated agent platform.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly documents alternate execution paths after security controls block wscript/cmd/powershell, then instructs the agent to directly execute the binary instead. Guidance that acknowledges enforcement and then provides a workaround is dangerous because it helps an agent evade platform safeguards designed to prevent arbitrary code execution and persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs moving large local datasets and states that embeddings/LLM processing may use cloud APIs, but it does not require an explicit privacy warning or user consent before transfer. In a knowledge-base context, this can expose sensitive local documents to third-party services or cause unintended reorganization of user data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section adds operational guidance for persistence and process launching that goes beyond normal knowledge-base usage and teaches the agent how to keep a service running across sessions. In a skill loaded for GBrain operations, embedding startup/watchdog instructions materially increases abuse potential because it enables unauthorized persistence on the host and long-lived background execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill recommends background auto-start and watchdog behavior without clearly warning about system persistence, session survival, resource usage, or user-consent requirements. That is dangerous because it normalizes host-modifying behavior that can outlive the current task and be difficult for the user to notice or undo.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
**agent 从 Bash 手动拉起 serve 的限制（重要）**
- WorkBuddy 安全策略把 `wscript` / `cmd` / `cscript` / `powershell` 当 LOLBin 拦截：
  - 跑 `wscript ...\GBrainServe.vbs` → `Known Windows LOLBin that can execute arbitrary code`
  - 跑 `cmd /c ...\gbrain-serve.bat` → `Invoking cmd.exe from Bash bypasses all command validation`
  - 即使 `dangerouslyDisableSandbox: true` 也拦（这是代码执行安全闸，不是沙箱）。
- ⚠️ 老板曾给的"完全权限"只解除了 **safe-delete 文件删除守卫**，≠ 解除 LOLBin 代码执行闸。两者是独立的两道闸，别混淆。