ClawHub
Back to skill

Security audit

Dont Hack Me

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused Clawdbot security check that inspects one local config file and only changes it after user confirmation, though its backup step needs care because the file may contain secrets.

Use this only when you intend to let an agent inspect ~/.clawdbot/clawdbot.json. Review the report before approving fixes, and if auto-fix runs, verify or remove ~/.clawdbot/clawdbot.json.bak because it may contain old tokens or other secrets.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:200
Finding

Predictable Backup May Expose Secrets and Retain Revoked Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 200–202
Vulnerability Type: Insecure handling of secret-bearing backup files
Risk Level: Medium

Complete Code Snippet:

markdown
- **Always back up first.** Before writing any changes, copy the original:
  ```bash
  cp ~/.clawdbot/clawdbot.json ~/.clawdbot/clawdbot.json.bak
  ```

Technical Analysis

The Skill directs the agent to copy ~/.clawdbot/clawdbot.json to a fixed .bak path before applying configuration changes. The source configuration may contain gateway tokens, passwords, API keys, private keys, or other plaintext credentials.

The backup procedure does not explicitly enforce restrictive permissions on the resulting backup, validate that the destination is not a symbolic link, use exclusive file creation, or remove the backup after successful verification. Although the Skill separately recommends chmod 600 for the active configuration, that remediation does not cover clawdbot.json.bak.

If the source file is overly permissive, the backup may preserve insecure access characteristics depending on platform and environment. Token rotation also leaves the previous token in the backup. Furthermore, the predictable destination can be unsafe if an attacker with local access can pre-create or manipulate that path.

Attack Path

  1. The active configuration contains credentials and has insecure permissions.
  2. The Skill identifies one or more WARN or FAIL conditions.
  3. The user authorizes automatic remediation.
  4. Before remediation, the Skill copies the configuration to the predictable clawdbot.json.bak path.
  5. The active configuration is secured or its gateway token is replaced.
  6. The backup remains present with the original credentials and without an explicit permission-hardening step.
  7. A local attacker who can read the backup recovers the credentials. If the backup destination can be manipulated beforehand, the ...[truncated 757 chars]
Remediation
View remediation

Remediation Suggestions

  • Create backups with restrictive permissions from the outset, using mode 600 or stricter.
  • Use exclusive creation and refuse to follow symbolic links.
  • Avoid a predictable reusable destination; use a securely created temporary file in a directory accessible only to the current user.
  • Verify ownership and permissions immediately after backup creation.
  • Apply permission hardening to both the active configuration and every retained backup.
  • Remove the backup after successful post-change validation unless the user explicitly elects to retain it.
  • When rotating credentials, ensure backups containing superseded secrets are securely deleted or encrypted.
  • Check for an existing destination before copying and abort if its type, ownership, or permissions are unsafe.
  • Ensure failures during backup creation or permission hardening stop the remediation process before any configuration changes occur.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (7)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
- **PASS** if the token is >= 32 characters
- **WARN** if the token is 16–31 characters
- **FAIL** if the token is < 16 characters or empty
- **SKIP** if auth mode is `"password"` (passwords are user-chosen, don't judge length)
- **Severity:** HIGH — short tokens are vulnerable to brute-force

### Step 4 — DM Policy (per channel)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises generic invocation phrases for a privileged security-audit workflow that reads and may modify a sensitive local config file. Broad triggers increase the chance of accidental activation from ordinary conversation, which could lead to unintended disclosure of security posture or initiation of an auto-fix flow affecting user configuration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Phrases like 'check my security settings' and especially 'am I secure?' are highly ambiguous and likely to overlap with normal assistant conversation. In this skill's context, accidental triggering can cause sensitive local configuration inspection and offer config-changing remediation, making ambiguity materially riskier than in a read-only informational skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
### Step 6 — File Permissions

- **Check:** file mode of `~/.clawdbot/clawdbot.json`
- **Expected:** `600` or `400` (owner read/write only)
- **PASS** if permissions are `600` or `400`
- **WARN** if permissions are `644` or `640` (group/other can read)
- **FAIL** if permissions are `777`, `755`, `666`, or anything world-writable

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
- **Expected:** `600` or `400` (owner read/write only)
- **PASS** if permissions are `600` or `400`
- **WARN** if permissions are `644` or `640` (group/other can read)
- **FAIL** if permissions are `777`, `755`, `666`, or anything world-writable
- **Severity:** MEDIUM — loose permissions let other users on the system read your tokens

### Step 7 — Plaintext Secrets Scan

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

#6 File Permissions — FAIL / WARN

Run:

bash
chmod 600 ~/.clawdbot/clawdbot.json

#7 Secrets Scan — WARN

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The manifest prominently mixes a specific locale/language presentation and includes a Chinese invocation phrase, but does not state that users may interact in their preferred language. This can be a language-policy issue when a skill appears to prescribe a locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.