Security audit
Security checks across malware telemetry and agentic risk
This recovery skill is mostly transparent about its purpose, but it gives agents broad authority to run repair shell commands, modify credentials/files, and sync manifests off-box, so it needs review before installation.
Install only if you intentionally want an agent-run workspace repair system. Review and sign manifests yourself, use `--dry-run` before restore/doctor, avoid broad or destructive recipes where possible, do not trust pulled manifests without verifying signatures/fingerprints, and treat any manifest containing restore commands or credential placeholders as sensitive.
def run_smoke(cmd, cwd, timeout=60):
try:
r = subprocess.run(["bash", "-lc", cmd], cwd=cwd, timeout=timeout,
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
return r.returncode == 0
except Exception:def check_ldd(path):
try:
r = subprocess.run(["ldd", path], capture_output=True, text=True, timeout=30)
return [l.split("=>")[0].strip() for l in r.stdout.splitlines()
if "not found" in l]
except Exception:t0 = time.time()
tmo = timeout or e.get("timeout_s", 1800)
try:
r = subprocess.run(["bash", "-lc", cmd], cwd=man.get("workspace", HOME),
timeout=tmo, start_new_session=True)
rc = r.returncode
except subprocess.TimeoutExpired:def _run():
try:
return subprocess.run(
["bash", "-lc", e["restore"]], cwd=man.get("workspace", HOME),
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
timeout=e.get("timeout_s", 300),t0 = time.time()
tmo = timeout or e.get("timeout_s", 1800)
try:
r = subprocess.run(["bash", "-lc", cmd], cwd=man.get("workspace", HOME),
timeout=tmo, start_new_session=True)
rc = r.returncode
except subprocess.TimeoutExpired:data = escrow_restore(e) # validate BEFORE touching disk
os.makedirs(os.path.dirname(p) or ".", exist_ok=True)
tmp = p + ".swr-tmp"
with open(tmp, "wb") as f:
f.write(data)
if e.get("mode"):
os.chmod(tmp, int(e["mode"], 8))def _run():
try:
return subprocess.run(
["bash", "-lc", e["restore"]], cwd=man.get("workspace", HOME),
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
timeout=e.get("timeout_s", 300),die(f"FINGERPRINT MISMATCH: file says {peer['fingerprint']}, computed {fp}")
peer["fingerprint"] = fp
name = a.name or peer.get("name") or fp[:11]
with open(os.path.join(PEERS_DIR, f"{name}.json"), "w") as f:
json.dump(peer, f, indent=2)
print(f"added peer '{name}'\n fingerprint {fp}")
print(" VERIFY this fingerprint with the peer over a second channel "if not shutil.which("age"):
raise RuntimeError("payload is age-encrypted but `age` is not installed")
cmd = ["age", "-d"] + (["-i", identity] if identity else [])
r = subprocess.run(cmd, input=o["body"].encode(),
capture_output=True, timeout=60)
if r.returncode:
raise RuntimeError(f"age decrypt failed: {r.stderr.decode()[:200]}")ident = load_identity()
if a.qr and shutil.which("qrencode"):
blob = base64.b64encode(json.dumps(ident).encode()).decode()
print(subprocess.run(["qrencode", "-t", "ANSIUTF8", blob],
capture_output=True, text=True).stdout)
print(json.dumps(ident, indent=2))
eprint(f"\nfingerprint: {ident['fingerprint']} "def qr(data):
if shutil.which("qrencode"):
try:
return subprocess.run(["qrencode", "-t", "ANSIUTF8", data],
capture_output=True, text=True,
timeout=15).stdout
except Exception:"restore": "chmod +x ~/run_swarm.sh"
},
{
"_kind_note": "tier 0 secret. The restore recipe re-authenticates, it does not just rewrite the file.",
"id": "clawhub-token",
"path": ".clawhub/TOKEN",
"kind": "file",# tier 2 — source, sentineled on the dir that silently empties swr add llama.cpp --id llama-src --kind tree --tier 2 \ --sentinel ggml/src/ggml.c --sentinel ggml/cmake/ggml-config.cmake.in \ --restore 'rm -rf ~/llama.cpp && git clone --depth 1 -q https://github.com/ggerganov/llama.cpp.git ~/llama.cpp' # tier 3 — models verified by exact byte count, resumable fetch swr add model.gguf --kind blob --tier 3 \
# tier 2 — source, sentineled on the dir that silently empties swr add llama.cpp --id llama-src --kind tree --tier 2 \ --sentinel ggml/src/ggml.c --sentinel ggml/cmake/ggml-config.cmake.in \ --restore 'rm -rf ~/llama.cpp && git clone --depth 1 -q https://github.com/ggerganov/llama.cpp.git ~/llama.cpp' # tier 3 — models verified by exact byte count, resumable fetch swr add model.gguf --kind blob --tier 3 \
# tier 3 — models verified by exact byte count, resumable fetch swr add model.gguf --kind blob --tier 3 \ --restore "cd ~ && rm -f model.gguf && curl -sSL --retry 3 --retry-all-errors -C - -o model.gguf '$URL'" # tier 4 — binaries, only after source is proven healthy swr add llama.cpp/build/bin --id llama-bins --kind tree --tier 4 \
"upstream": "https://huggingface.co/bartowski/Qwen_Qwen3-0.6B-GGUF/resolve/main/Qwen_Qwen3-0.6B-Q4_K_M.gguf",
"tier": 3,
"fragile": "large blob (484 MB) - likely exceeds snapshot size cap",
"restore": "cd ~ && rm -f Qwen3-0.6B-Q4_K_M.gguf && curl -sSL --retry 3 --retry-all-errors -C - -o Qwen3-0.6B-Q4_K_M.gguf 'https://huggingface.co/bartowski/Qwen_Qwen3-0.6B-GGUF/resolve/main/Qwen_Qwen3-0.6B-Q4_K_M.gguf'"
},
{
"_kind_note": "tree + sentinels = THE important one. Catches a directory that survives while its contents are emptied. Sentinels are only a SAMPLE, so pin files from risky subdirs (note ggml/src below) and set a tight min_files, or use `merkle` for exact detection.","min_files": 4986,
"tier": 2,
"fragile": "subdir 'src' can be swept by exclusion rules, leaving an empty shell",
"restore": "rm -rf ~/llama.cpp && git clone --depth 1 -q https://github.com/ggerganov/llama.cpp.git ~/llama.cpp"
},
{
"_kind_note": "tier 4 build output; 'build' is on every exclusion list. `needs` means a failed llama-src SKIPS this instead of running a doomed 6-min build.","upstream": "https://huggingface.co/bartowski/Qwen_Qwen3-0.6B-GGUF/resolve/main/Qwen_Qwen3-0.6B-Q4_K_M.gguf",
"tier": 3,
"fragile": "large blob (484 MB) - likely exceeds snapshot size cap",
"restore": "cd ~ && rm -f Qwen3-0.6B-Q4_K_M.gguf && curl -sSL --retry 3 --retry-all-errors -C - -o Qwen3-0.6B-Q4_K_M.gguf 'https://huggingface.co/bartowski/Qwen_Qwen3-0.6B-GGUF/resolve/main/Qwen_Qwen3-0.6B-Q4_K_M.gguf'"
},
{
"_kind_note": "tree + sentinels = THE important one. Catches a directory that survives while its contents are emptied. Sentinels are only a SAMPLE, so pin files from risky subdirs (note ggml/src below) and set a tight min_files, or use `merkle` for exact detection.",VirusTotal findings are pending for this skill version.
No suspicious patterns detected.