Claw Shell Hardened

• Analyzed: May 10, 2026, 6:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: f0a629790f33cb874734c345431acb24a4026dcb87c53ad37009d9a942daf673
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides shell execution capabilities within a tmux session, which is an inherently high-risk functionality. The implementation in `handler.js` contains a critical shell injection vulnerability because it passes user-supplied commands into a shell-executed template literal (`execSync`) with inadequate escaping. Although the bundle includes extensive safety documentation and prompt-based guardrails (`SKILL.md`, `SAFETY.md`) from 'Faberlens' that suggest a defensive and 'hardened' intent, the technical implementation is flawed and allows for the bypass of the stated safety checks.