ClawHub
Back to skill

Security audit

Pastewatch MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate secret-protection purpose, but it recommends installing an unpinned external binary and running it as a persistent system-wide proxy that can inspect LLM API traffic.

Install only if you trust the publisher and release process. Prefer a pinned, signed, or package-manager-verifiable build, and avoid the system-wide systemd setup unless you need it. If you use the proxy, run it with the least privilege practical and understand that it can inspect sensitive prompts, headers, and provider traffic passing through it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:89
Finding

Persistent System-Wide API Proxy Service

Content
View full analysis
/etc/systemd/system/pastewatch-proxy.service << 'EOF' [Unit] Description=Pastewatch API Proxy (secret redaction) After=network-online.target Before=chainwatch-intercept.service [Service] Type=simple ExecStart=/usr/local/bin/pastewatch-cli proxy \ --port 9998 --upstream https://api.anthropic.com \ --severity high --audit-log /var/log/pastewatch-proxy.log Restart=always RestartSec=3 MemoryMax=128M [Install] WantedBy=multi-user.target EOF # 2. Update chainwatch to forward to pastewatch (not Anthropic directly) # Change --upstream from https://api.anthropic.com to http://localhost:9998 # 3. Enable and start systemctl daemon-reload systemctl enable pastewatch-proxy systemctl start pastewatch-proxy systemctl restart chainwatch-intercept ``` ### Technical Analysis The instructions create a system-level service under `/etc/systemd/system`, enable it for automatic startup, and configure it to restart continuously. They also direct the user to modify another proxy service so that API requests are routed through the downloaded `pastewatch-cli` executable. Continuous execution is relevant to an API proxy, but a root-managed, boot-enabled service is not required for the Skill's basic MCP scanning and redaction functionality. A foreground process or unprivileged per-user service would provide the relevant functionality with a smaller privilege and persistence footprint. Because the proxy is positioned in the outbound LLM request path, it can inspect and modify prompts, credentials, API headers, responses, and other data sent between the agent and its upstream provider. The reviewed project contains no source code for the executable, so its actual handling of intercepted traffic cannot be independently verified from ...[truncated 1834 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:19
Finding

Mutable Remote Executable Download and Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Guard — Block Secret-Leaking Commands

bash
pastewatch-cli guard "cat .env"              # BLOCKED if .env has secrets
pastewatch-cli guard "psql -f migrate.sql"   # scans SQL file
pastewatch-cli guard "docker-compose up"     # scans env_files

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Guard — Block Secret-Leaking Commands

bash
pastewatch-cli guard "cat .env"              # BLOCKED if .env has secrets
pastewatch-cli guard "psql -f migrate.sql"   # scans SQL file
pastewatch-cli guard "docker-compose up"     # scans env_files

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

3. Enable and start

systemctl daemon-reload systemctl enable pastewatch-proxy systemctl start pastewatch-proxy systemctl restart chainwatch-intercept

text

Static analysis

No suspicious patterns detected.