P2claw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 0.1.1

Overview

The skill is coherent, but its installer has supply-chain risks that users should review before installing a network-exposing agent.

Review the installer path before installing. Prefer a pinned version and require checksum or signature verification instead of accepting the best-effort warning path. Avoid the curl-to-shell examples, and use foreground mode unless you deliberately want a persistent network service. Only expose localhost apps that are safe to make public.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:5

Finding

Mutable Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

' sh install.sh ``` 4. Pin the publisher verification key or expected digest independently inside the audited package. Do not retrieve the verification key from the same mutable endpoint. 5. Prefer version-specific, immutable installer URLs instead of a mutable `/install` endpoint. 6. Update the WSL error message to direct the user to the bundled script from inside WSL rather than recommending remote code execution. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:127

Finding

Installer Fails Open When Release Integrity Cannot Be Verified

Content

View full analysis

/dev/null || mktemp -d -t p2claw)" trap 'rm -rf "$TMP"' EXIT INT TERM say "downloading $URL" if ! curl -fSL --progress-bar -o "$TMP/$ASSET" "$URL"; then err "download failed. Verify that ${BLD}$ASSET${RST} exists at https://github.com/$REPO/releases/$VERSION" fi # ---------- verify checksum (best-effort) ----------------------------- SUMS_URL="https://github.com/$REPO/releases/download/$VERSION/SHA256SUMS" if [ -n "$SHA256_CMD" ] && curl -fsSL -o "$TMP/SHA256SUMS" "$SUMS_URL" 2>/dev/null; then say "verifying SHA-256 …" EXPECTED="$(grep -E "[[:space:]]$ASSET\$" "$TMP/SHA256SUMS" | awk '{print $1}' | head -n1)" if [ -z "$EXPECTED" ]; then warn "SHA256SUMS published but didn't list $ASSET; skipping check" else GOT="$(cd "$TMP" && $SHA256_CMD "$ASSET" | awk '{print $1}')" if [ "$EXPECTED" = "$GOT" ]; then ok "checksum verified" else err "checksum mismatch (expected $EXPECTED, got $GOT)" fi fi else warn "SHA256SUMS not published or no sha256 tool available; skipping integrity check" fi # ---------- extract + install ---------------------------------------- say "extracting …" tar -xzf "$TMP/$ASSET" -C "$TMP" # Most release tarballs unpack the binary at the root or in a single # top-level dir. Find it either way. SRC="" if [ -f "$TMP/$BIN_NAME" ]; then SRC="$TMP/$BIN_NAME" else SRC="$(find "$TMP" -type f -name "$BIN_NAME" -perm -u+x 2>/dev/null | head -n1 || true)" fi [ -n "$SRC" ] && [ -f "$SRC" ] || err "tarball did not contain an executable named $BIN_NAME" mkdir -p "$INSTALL_DIR" DEST="$INSTALL_DIR/$BIN_NAME" mv "$SRC" "$DEST" chmod +x "$DEST" ``` ### Technical Analysis The installer ...[truncated 3257 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

The install script ships **with this skill** at `scripts/install.sh`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

The install script ships **with this skill** at `scripts/install.sh`.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The script promotes a 'curl | sh' installation pattern, which executes remote content immediately without prior inspection. If the hosting domain, TLS path, or served script is compromised, users will run attacker-controlled shell code directly on their machines.

Content

Scanner excerpt · scripts/install.sh (reported line 5)May include surrounding context.

sh

# p2claw installer.
#
# Usage:
#   curl -fsSL https://p2claw.com/install | sh
#   curl -fsSL https://p2claw.com/install | sh -s -- --version v0.1.0
#   curl -fsSL https://p2claw.com/install | sh -s -- --prefix /usr/local/bin
#

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The explicit command chaining into 'sh' is the core dangerous behavior: shell execution is coupled directly to network retrieval. That removes the opportunity for inspection and makes any upstream compromise immediately code-execution-capable.

Content

Scanner excerpt · scripts/install.sh (reported line 5)May include surrounding context.

sh

# p2claw installer.
#
# Usage:
#   curl -fsSL https://p2claw.com/install | sh
#   curl -fsSL https://p2claw.com/install | sh -s -- --version v0.1.0
#   curl -fsSL https://p2claw.com/install | sh -s -- --prefix /usr/local/bin
#

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

This repeated usage example continues to encourage direct execution of a remotely fetched script. Adding arguments does not reduce the underlying risk that unreviewed network content is being piped into the shell.

Content

Scanner excerpt · scripts/install.sh (reported line 6)May include surrounding context.

sh

#
# Usage:
#   curl -fsSL https://p2claw.com/install | sh
#   curl -fsSL https://p2claw.com/install | sh -s -- --version v0.1.0
#   curl -fsSL https://p2claw.com/install | sh -s -- --prefix /usr/local/bin
#
# Env overrides:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

This is another instance of the same unsafe bootstrap pattern. The danger is amplified in installer documentation because users are likely to copy-paste it verbatim and grant immediate code execution.

Content

Scanner excerpt · scripts/install.sh (reported line 7)May include surrounding context.

sh

# Usage:
#   curl -fsSL https://p2claw.com/install | sh
#   curl -fsSL https://p2claw.com/install | sh -s -- --version v0.1.0
#   curl -fsSL https://p2claw.com/install | sh -s -- --prefix /usr/local/bin
#
# Env overrides:
#   P2CLAW_VERSION       pin to a release tag (e.g. v0.1.0)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The Windows/WSL guidance repeats the same remote-pipe-to-shell command, extending the unsafe pattern to another user path. Even though it is only instructional text, it directly encourages risky execution behavior by end users.

Content

Scanner excerpt · scripts/install.sh (reported line 73)May include surrounding context.

sh

1. Install WSL                ${BLD}wsl --install${RST}
  2. Open your Linux distro     (Ubuntu, Debian, …)
  3. Re-run inside WSL:         ${BLD}curl -fsSL https://p2claw.com/install | sh${RST}

If you already have WSL, open it now and try again.
EOF

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/install.sh (reported line 178)May include surrounding context.

sh

ALL_DIR"
DEST="$INSTALL_DIR/$BIN_NAME"
mv "$SRC" "$DEST"
chmod +x "$DEST"
ok "installed $DEST"

# ---------- PATH hint -------------------------------------------------
case ":${PATH-}:" in
  *":$INSTALL_DIR:"*) ;;
  *)
    warn "$INSTALL_DIR is not on \$PATH"
    cat >&2 <<EOF

Add it once and reopen the shell:

  ${BLD}echo 'export PATH="$INSTALL_DIR:\$PATH"' >> ~/.zshrc${RST}     # zsh
  ${BLD}echo 'export PATH="$INSTALL_DIR:\$PATH"' >> ~/.bashrc${RST}    # bash

Or invoke the binary by its full path: ${BLD}$DEST${RST}
EOF
    ;;
esac

# ---------- next steps ------------------------------------------------
cat <<EOF

${GRN}p2claw $VERSION ready.${RST}

Recommended next:

  ${BLD}$BIN_NAME service install${RST}              # always-on user-scope service (no sudo)
  ${BLD}$BIN_NAME expose <name> <port>${RST}     # publish a localhost upstream as a peer URL

Alternatives:

  ${BLD}$BIN_NAME run${RST}                          # foreground daemon (one-off sharing)
  ${BLD}$BIN_NAME ser

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill clearly instructs use of shell commands but declares no explicit tool scope or allowed-tools boundary. In an agent environment, missing tool restrictions increases the chance the agent can invoke broader shell capabilities than intended, which is dangerous because this skill also performs installation, networking, and service-management actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Installing a launchd or systemd user service creates persistence across logins and reboots. Persistence is not inherently malicious here, but it is security-relevant because a network-facing agent remains available beyond the immediate session and could continue exposing services longer than the user expects.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

### Option A — install as a user-scope service (recommended for users
who want it always-on)

**Ask permission first.** This writes a launchd plist (macOS) or
systemd `--user` unit (Linux) and starts it. Phrasing:

> "I'd like to install p2claw as a launchd user agent so it

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

"I'd like to install p2claw as a launchd user agent so it auto-starts on login and survives reboots. It writes ~/Library/LaunchAgents/dev.p2claw.agent.plist, no sudo required. OK to proceed?"

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This line explicitly states the service will auto-start on login and survive reboots by writing a plist. That is legitimate functionality, but from a security perspective it is persistence and should be treated as sensitive because it keeps a network-capable agent resident without requiring the user to manually restart it.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

"I'd like to install p2claw as a launchd user agent so it auto-starts on login and survives reboots. It writes ~/Library/LaunchAgents/dev.p2claw.agent.plist, no sudo required. OK to proceed?"

bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill includes a sudo command to install a system-scope service, modify resolver configuration, and add a CA root to the OS trust store. Even though it tells the operator to confirm first, this materially escalates privileges and changes host trust/network behavior, so misuse or social engineering around this step could have broad system impact.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

system scope:

bash

sudo p2claw service install --system

Adds MagicDNS: /etc/resolver/<parent>, a CA root in the OS trust

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill documents that exposing a route with an existing name will overwrite the previous route instead of failing. In a multi-step agent workflow, this can silently change a previously published endpoint and cause unintended persistence or redirection of traffic, especially if the agent does not re-confirm ownership of the existing route.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

text

Inspect routes before exposing — if the name is already taken, a new
`expose` will overwrite it. That's the agent's documented behavior
(replace, not error), but it might surprise the user if the existing
route was theirs.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The installer explicitly permits installing a downloaded binary even when no checksum file is published or no hash tool is available. That means integrity verification is optional rather than enforced, so a compromised release asset, CDN path, or repository could result in silent execution of a tampered binary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/install.sh (reported line 109)May include surrounding context.

sh

# GitHub's "latest" redirects to the tag; pull tag_name out of the
  # JSON without jq (sed is everywhere).
  VERSION="$(
    curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null \
      | sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' \
      | head -n1
  )"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 162)May include surrounding context.

sh

fi
[ -n "$SRC" ] && [ -f "$SRC" ] || err "tarball did not contain an executable named $BIN_NAME"

mkdir -p "$INSTALL_DIR"
DEST="$INSTALL_DIR/$BIN_NAME"
mv "$SRC" "$DEST"
chmod +x "$DEST"

Static analysis

No suspicious patterns detected.