ClawHub
Back to skill

Security audit

Untrusted Binary Sandbox

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent sandboxing guide for analyzing untrusted binaries and mostly instructs the agent to avoid risky execution unless the user explicitly approves it.

Install only if you need a structured workflow for inspecting suspicious binaries. Treat any generated sandbox as a starting point: pin container images by digest when possible, use a disposable VM for hostile samples, keep real secrets and funded wallets out of the environment, and require explicit approval before running any sample or enabling network access.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
## Non-Negotiables

- Do not run downloaded binaries, JARs, install scripts, release artifacts, or `curl | sh` flows unless the user explicitly approves dynamic execution.
- Prefer a sacrificial VM/VPS over a production host. Never mount production secrets, SSH keys, browser profiles, Docker socket, cloud credentials, or funded wallets.
- Never use a real private key during observation. Use invalid keys, empty throwaway wallets, or a tiny-fund wallet only in the final live tier after explicit approval.
- Pin artifact identity before execution: source URL, version, size, SHA-256, timestamp, and any signature/digest metadata.

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/docker-sandbox.md (reported line 40)May include surrounding context.

  • ./logs:/logs:rw
text

Never add `privileged: true`, `network_mode: host`, `/var/run/docker.sock`, `/`, `$HOME`, SSH directories, browser profiles, production `.env`, cloud credentials, or funded wallet mounts.

## Instrumentation Commands

Privileged Kubernetes Workload

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.

Content

Scanner excerpt · references/docker-sandbox.md (reported line 40)May include surrounding context.

  • ./logs:/logs:rw
text

Never add `privileged: true`, `network_mode: host`, `/var/run/docker.sock`, `/`, `$HOME`, SSH directories, browser profiles, production `.env`, cloud credentials, or funded wallet mounts.

## Instrumentation Commands

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill appears to contemplate network access and file creation/modification via scaffolding and dynamic sandbox workflows, but it does not declare any explicit tool scope such as permissions or allowed-tools. In a security-sensitive skill for handling untrusted binaries, missing least-privilege boundaries increases the chance that an agent could use broader capabilities than intended during analysis or execution planning.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/scaffold_sandbox.py (reported line 42)May include surrounding context.

python
RUN apt-get update \\
          && apt-get install -y --no-install-recommends \\
            ca-certificates strace procps iproute2 lsof file binutils findutils jq tini python3 \\
          && rm -rf /var/lib/apt/lists/*

        RUN useradd -r -u 10001 sandbox
        USER sandbox

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/scaffold_sandbox.py (reported line 42)May include surrounding context.

python
RUN apt-get update \\
          && apt-get install -y --no-install-recommends \\
            ca-certificates strace procps iproute2 lsof file binutils findutils jq tini python3 \\
          && rm -rf /var/lib/apt/lists/*

        RUN useradd -r -u 10001 sandbox
        USER sandbox

Chaining Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/scaffold_sandbox.py (reported line 42)May include surrounding context.

python
RUN apt-get update \\
          && apt-get install -y --no-install-recommends \\
            ca-certificates strace procps iproute2 lsof file binutils findutils jq tini python3 \\
          && rm -rf /var/lib/apt/lists/*

        RUN useradd -r -u 10001 sandbox
        USER sandbox

Static analysis

No suspicious patterns detected.