ClawHub
Back to skill

Security audit

Phy Session Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a local source-code scanner for session and cookie security issues, with no hidden persistence or data exfiltration behavior found.

Install this as a lightweight heuristic audit helper, not as a complete security review. Run it only on code paths you intend to scan, be careful with CI logs because findings can include short code snippets, and manually verify results especially for Koa, Fastify, FastAPI, Rails, and CSRF coverage.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
alse`, `set_cookie(key, value)` without `httponly=True`.

### SS002 — Missing Secure Flag (HIGH)
Session cookies without `Secure` flag are sent over plain HTTP connections (if the browser is redirected or the user types http://). Attacker on same network can intercept with passive MITM.

### SS003 — Missing SameSite (HIGH)
Without `SameSite=Strict` or `SameSite=Lax`, the browser sends session cookies on cross-origin requests — enabling CSRF attacks even if a CSRF token library is used but misconfigured. Default before Chrome 80 was `SameSite=None`.

### SS004 — Session Token in URL (CRITICAL)
Finds `req.query.token`, `request.args.get('session_id')`, `?auth=`, `?session=`, `?token=` used as authentication. URL tokens appear in server logs, browser history, Referer headers, and CDN access logs.

### SS005 — Session Fixation (CRITICAL)
After successful login (`password.check()`, `authenticate()`, `login(user)`, `bcrypt.compare()`), the session ID must be regenerated. Finds logi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 521)May include surrounding context.

md
cwe="CWE-922: Insecure Storage of Sensitive Information",
                fix=(
                    "Store JWT in HttpOnly cookie: res.cookie('token', jwt, { httpOnly: true, secure: true })\n"
                    "   If SPA: store access token in memory + refresh token in HttpOnly cookie."
                ),
            ))
    return findings

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest and module docs claim coverage for Express/Koa/Fastify, Flask/Django/FastAPI, Go net/http, Spring Boot, and Rails. However, the regexes implemented target patterns like app/router methods, Flask-style decorators, Django settings, Java servlet APIs, and generic cookie calls, without clear Koa, Fastify, FastAPI route, or Rails-specific session/cookie/query handling patterns, so the claimed supported-framework coverage is broader than the actual implementation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation says the CSRF check will skip if a guard pattern exists anywhere in the file and the emitted finding message says 'no CSRF protection found in project,' implying project-wide awareness. In code, check_ss006_missing_csrf receives only the current file's content at L614 and uses that per-file content at L482, so the behavior is narrower than described and the message overstates what was checked.

Content

No source excerpt is available for this finding.