ClawHub
Back to skill

Security audit

pr0xteus

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and mostly transparent, but its setup asks users to execute an unpinned remote installer, optionally with root privileges.

Install only if you trust the publisher and can review the installer at the exact time of use. Prefer the per-user path, avoid sudo unless you need a shared system-wide stack, pin or verify the installer before running it, and treat returned proxy URLs, WireGuard files, Docker access, and PR0XTEUS_API_TOKEN as sensitive secrets.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup.md:19
Finding
Mutable Remote Installer Downloaded and Executed with Optional Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md:19-36` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash **Download the installer and read it before running it — never pipe `curl` straight into a shell.** Confirm it only fetches the pinned image, runs the image's `config init`, and installs the `pr0xteus` command — then run it. # 1. Download (do not pipe curl into a shell). curl -fsSL https://raw.githubusercontent.com/psyb0t/pr0xteus/main/install.sh -o pr0xteus-install.sh # 2. Inspect — read the whole thing. less pr0xteus-install.sh # 3a. Per-user install (no root): command -> ~/.local/bin, config -> # ~/.config/pr0xteus, just for the current user. bash pr0xteus-install.sh # 3b. Or system-wide: command -> /usr/local/bin, config -> /etc/pr0xteus # (root-owned, readable by the `docker` group so any docker-group operator # drives the one shared stack). sudo bash pr0xteus-install.sh --system ``` ### Technical Analysis The setup instructions download executable shell code from the mutable `main` branch of a personal GitHub repository and subsequently execute it. The download is not pinned to an immutable commit or versioned release artifact, and no cryptographic checksum or signature is verified. Consequently, the code executed during installation can differ from the code reviewed when the Skill was published. The recommendation to inspect the script with `less` is a useful precaution but does not provide machine-enforced authenticity or integrity. It is also unreliable in automated agent workflows, where visual inspection may not occur or may fail to identify a concealed malicious change. The system-wide installation command executes the remotely sourced script through `sudo`, expanding the potential compromise from the invoking user account to the entire host. Although installation is necessary for the declared functionality, retrieving it from a mutable ...[truncated 1534 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the mutable `main`-branch URL with an immutable release artifact or commit-specific URL. 2. Publish a SHA-256 or stronger digest through a separately protected release channel and require verification before execution. 3. Prefer signed release artifacts and verify the signature against a documented, trusted maintainer key. 4. Fail closed when checksum or signature verification fails; do not permit an unverified fallback. 5. Vendor the reviewed installer inside the Skill package where practical, reducing runtime dependence on mutable remote code. 6. Require users to run the installer without root whenever possible. Separate narrowly scoped privileged operations from the main installer if system-wide changes are required. 7. Pin all container images by immutable digest in addition to a release tag. 8. Document the exact files, commands, Docker permissions, and system changes the installer performs so that operators can validate least privilege. A hardened example should follow this pattern: ```bash version='vX.Y.Z' expected_sha256='PUBLISH_AND_PIN_THE_VERIFIED_DIGEST' url="https://github.com/psyb0t/pr0xteus/releases/download/${version}/install.sh" curl --fail --show-error --location "$url" -o pr0xteus-install.sh printf '%s %s\n' "$expected_sha256" pr0xteus-install.sh | sha256sum --check - bash pr0xteus-install.sh ``` The digest must be populated with a trusted value fixed in the reviewed Skill rather than fetched from the same mutable location as the installer. ]]>

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
cell's control server. `GET /v1/cells/{containerID}` 404s when the ID isn't
tracked.

`DELETE /v1/cells/{containerID}` stops that cell's container and clears its
pool slot so the next request re-spawns; `204` on success, `404` when
untracked. Only destroy a cell your own task allocated, and only when the
user asked for it.
Confidence
78% confidence
Finding
The skill exposes a destructive control action that stops containers based on a caller-supplied `containerID`. Although the text says to only destroy a cell allocated by the caller and only on user request, this is policy guidance rather than an enforced technical control; an integrating agent could be induced to delete the wrong resource if it accepts untrusted IDs or fails to bind deletions to its own prior allocations.

Static analysis

No suspicious patterns detected.