Security audit

Truclaw Biometric

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real biometric approval guardrail, but it installs a persistent privileged hook that can inspect tool-call arguments and send them to external services while key privacy and approval details are under-specified.

Review and pin the exact plugin source before installing, preferably in an isolated environment. Be comfortable with tool names and arguments being sent to Anthropic, and consider self-hosting the relay. Avoid using this with secrets, private file contents, or high-impact automation until the authorization JWT claims and data minimization behavior are documented and verifiable.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:27
Finding: Unredacted Tool Arguments Are Disclosed to an External API
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:73
Finding: Unpinned Third-Party Code Is Installed and Granted a Privileged Tool Hook
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The privacy section states the relay only forwards push notifications and temporarily stores a signed JWT, while the later workflow says the plugin receives and verifies a JWT whose authorization decision is based on an isAbove21 field rather than a clear approval signal. This creates a documentation-level contradiction about what the JWT represents and what the approval decision actually means, which undermines the stated security intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.