T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skill.md:62- Finding
System-Wide CA Trust Creates an Over-Privileged TLS Interception Boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawsec 1.0.0
Security checks for vulnerabilities and agentic risk
Overview
This skill is a security proxy for AI traffic, but it asks users to enable broad HTTPS interception while logging sensitive plaintext and the audited package is missing the implementation it tells users to run.
Treat this as a Review item before installing. Only use it in an isolated test environment, prefer per-process CA settings over system-wide trust, avoid routing unrelated traffic through it, and do not rely on the published package until the missing implementation and its handling of CA keys, logs, permissions, redaction, and cleanup can be audited.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:116- Finding
Threat Logs May Persist Credentials and Other Sensitive Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:159- Finding
Security-Critical Implementation Is Missing from the Audited Package
- Content
View full analysis
=42.0.0` | ``` ### Technical Analysis The project directory contains only `skill.md` and `_meta.json`, while the documentation claims that the package includes a proxy implementation, tests, container definitions, and a dependency manifest. None of those advertised files were available for audit. This is especially significant because the missing implementation is supposed to perform TLS interception, generate and retain CA private keys, inspect credentials, write security logs, handle signals, and accept configuration paths. The audit therefore could not verify safe file permissions, command construction, parser behavior, certificate validation, destination restrictions, log redaction, dependency pinning, or container isolation. The documentation also directs users to run relative commands such as `python3 clawsec-monitor.py`. If invoked from an unintended working directory, a same-named local file could be executed. Alternatively, users may retrieve the missing files from an external location without package-integrity verification. ### Attack Path 1. The user installs or loads the Skill and attempts to follow its operational instructions. 2. The referenced implementation is absent from the package. 3. The user searches for or downloads an implementation from another source, or runs the documented relative command from a directory containing an unrelated same-named script. 4. The unverified script is granted access to proxied plaintext traffic, generate ...[truncated 978 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (17)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) | ### INJECTION patterns
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### INJECTION patterns | Pattern name | What it matches | |---|---| | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### INJECTION patterns | Pattern name | What it matches | |---|---| | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` | | `ssh_key_inject` | `echo ssh-rsa` (SSH key injection attempt) | ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` | | `ssh_key_inject` | `echo ssh-rsa` (SSH key injection attempt) | ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs users to enable full HTTPS MITM interception and install a locally generated CA into the system trust store, but it does not prominently warn about the privacy, integrity, and trust-boundary implications. This can expose all proxied TLS traffic in plaintext and creates a powerful interception capability that, if misused or left installed, undermines normal TLS protections for the host.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill instructs the user to run sudo commands that add a custom CA certificate as a trusted root in the macOS system keychain. Granting root-level trust to a locally generated interception CA materially changes the host security posture and enables transparent TLS interception across applications.
- Content
bash # macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
This step copies the generated CA into the OS certificate trust location with sudo, establishing system-wide trust for a man-in-the-middle certificate authority. If abused, compromised, or forgotten, this allows broad interception of TLS sessions and weakens the machine's trust model.
- Content
md -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt sudo update-ca-certificates # Per-process (no system trust required)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
Running update-ca-certificates with elevated privileges finalizes the system-wide installation of the interception CA. While this is administrative rather than directly malicious, it amplifies the impact of the MITM design by making the trust change effective across the host.
- Content
md # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt sudo update-ca-certificates # Per-process (no system trust required) export REQUESTS_CA_BUNDLE=/tmp/clawsec/ca.crt # Python requests
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
export REQUESTS_CA_BUNDLE=/tmp/clawsec/ca.crt # Python requests export SSL_CERT_FILE=/tmp/clawsec/ca.crt # httpx export NODE_EXTRA_CA_CERTS=/tmp/clawsec/ca.crt # Node.js export CURL_CA_BUNDLE=/tmp/clawsec/ca.crt # curl
text Then route agent traffic through the proxy:
Static analysis
No suspicious patterns detected.