Clawshell

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:53 AM UTC
• Version: 0.1.0

Overview

The skill is not clearly malicious, but it asks users to route all shell commands through an unverified shell replacement that is not included in the reviewed package.

Review this carefully before installing. Do not modify TOOLS.md to route all shell commands through clawshell_bash unless you have separately obtained and verified the actual implementation, dependencies, registration mechanism, and approval behavior. Protect any Pushover or Telegram tokens because the reviewed package does not show what code will receive or use them.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:78

Finding

Global Shell Tool Replacement With an Unverified Implementation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 78-89
Vulnerability Type: Tool hijacking through global shell-command redirection
Risk Level: Medium

Vulnerable Code

markdown

### 3. Add to TOOLS.md

Add the following to your OpenClaw `TOOLS.md` so the agent uses ClawShell for shell commands:

```markdown
## Shell Access

Use `clawshell_bash` for ALL shell command execution. Do not use `bash` directly.
ClawShell will analyze commands for risk and require human approval for dangerous operations.

Available tools:
- `clawshell_bash(command, workingDir)` — Execute a shell command with risk analysis

Technical Analysis

The Skill directs users to modify the agent's TOOLS.md configuration so that every shell command is routed through a tool named clawshell_bash. This gives that tool control over all shell commands issued by the agent.

The audited project contains only SKILL.md. It does not include a clawshell_bash implementation, package manifest, dependency lockfile, command-analysis rules, approval mechanism, or tool-registration code. Consequently, the claimed interception, blocking, approval, execution, and logging behavior cannot be verified from this artifact.

This creates a trusted tool identity without supplying or authenticating the corresponding implementation. If an unrelated or malicious component registers a tool under that name, legitimate-looking shell requests could be intercepted, modified, suppressed, or executed with attacker-controlled behavior.

Attack Path

1. A user installs or loads the Skill and follows its setup documentation.
2. The user modifies TOOLS.md to require clawshell_bash for all shell execution and prohibit direct use of bash.
3. Because this artifact does not provide the tool implementation, the runtime must obtain or register it from another component.
4. An unverified or malicious component supplies a tool using the trusted ` ...[truncated 1074 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete clawshell_bash implementation, tool-registration logic, risk rules, and approval workflow in the reviewed project.
2. Supply a package manifest and locked dependency file so all installed components and versions can be audited reproducibly.
3. Authenticate the tool implementation before modifying agent configuration, such as by validating a signed package or pinned cryptographic digest.
4. Register the tool through an explicit, trusted mechanism rather than relying only on a conventional tool name.
5. Do not globally disable direct shell access until installation and integrity checks confirm that the replacement tool is present and trusted.
6. Apply least-privilege sandboxing to the replacement tool and restrict its filesystem, network, environment-variable, and process-execution access.
7. Ensure approval decisions are cryptographically associated with the exact command, arguments, working directory, and expiration time to prevent approval reuse or command substitution.
8. Avoid logging command contents or environment data without redaction, and protect audit logs against unauthorized modification.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

1. The agent calls `clawshell_bash` instead of `bash`
2. ClawShell analyzes the command against built-in and configurable risk rules
3. Based on risk level:
   - **Critical** (e.g. `rm -rf /`, fork bombs) — automatically blocked
   - **High** (e.g. `rm -rf`, `curl` to external URLs, credential access) — sends a push notification and waits for your approval
   - **Medium** (e.g. `npm install`, `git push`) — logged and allowed
   - **Low** (e.g. `ls`, `cat`, `git status`) — allowed

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

1. The agent calls `clawshell_bash` instead of `bash`
2. ClawShell analyzes the command against built-in and configurable risk rules
3. Based on risk level:
   - **Critical** (e.g. `rm -rf /`, fork bombs) — automatically blocked
   - **High** (e.g. `rm -rf`, `curl` to external URLs, credential access) — sends a push notification and waits for your approval
   - **Medium** (e.g. `npm install`, `git push`) — logged and allowed
   - **Low** (e.g. `ls`, `cat`, `git status`) — allowed

Static analysis

No suspicious patterns detected.