Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real security-monitoring skill, but its payment signing, background monitoring, logging, and install flow are broad enough that users should review it before installing.
Install only if you are comfortable with a local security daemon that monitors OpenClaw skill files and process/network activity, stores wallet material under ~/.sentinel, and may auto-sign small USDC payments. Prefer offline/free mode or set the payment limit to 0, verify any binary with an independently signed digest before installation, and review daemon logs for sensitive command-line arguments.
scripts/src/payment.rs:327Server-Controlled USDC Authorization Bypasses Recipient Validation and the Advertised Daily Spending Limit
scripts/src/daemon.rs:269Full Process Command Lines May Be Persisted in an Insufficiently Protected Log
README.md:84Release Installation Instructions Do Not Establish a Verifiable Binary or Dependency Trust Chain
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
# macOS Apple Silicon
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-aarch64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
# macOS Apple Silicon
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-aarch64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
# macOS Apple Silicon
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-aarch64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
# macOS Apple Silicon
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-aarch64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
This description-behavior mismatch indicates the skill may function primarily as reporting or CLI presentation rather than active enforcement, despite claiming runtime protection and premium monitoring. In a defensive tool, such overstatement can directly impair incident detection and response by giving operators a false picture of coverage.
This description-behavior mismatch indicates the skill may function primarily as reporting or CLI presentation rather than active enforcement, despite claiming runtime protection and premium monitoring. In a defensive tool, such overstatement can directly impair incident detection and response by giving operators a false picture of coverage.
This description-behavior mismatch indicates the skill may function primarily as reporting or CLI presentation rather than active enforcement, despite claiming runtime protection and premium monitoring. In a defensive tool, such overstatement can directly impair incident detection and response by giving operators a false picture of coverage.
This description-behavior mismatch indicates the skill may function primarily as reporting or CLI presentation rather than active enforcement, despite claiming runtime protection and premium monitoring. In a defensive tool, such overstatement can directly impair incident detection and response by giving operators a false picture of coverage.
This description-behavior mismatch indicates the skill may function primarily as reporting or CLI presentation rather than active enforcement, despite claiming runtime protection and premium monitoring. In a defensive tool, such overstatement can directly impair incident detection and response by giving operators a false picture of coverage.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
# Threat Model
Full matrix of threats runtime-sentinel defends against, with attack
descriptions sourced from the ClawHavoc campaign and related research.
---
## T1 — Skill file tampering (post-install mutation)
**What it is**: A skill is installed cleanly, passes VirusTotal, then later
mutates itself. A dropper payload embedded in a "safe" initial version phones
home and overwrites files after a delay or trigger condition.
**How sentinel detects it**: On first install, `sentinel` records SHA-256
hashes of every file in the skill directory. On each subsequent audit or
daemon tick, hashes are rec
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
data.
**Classic patterns**:
- `<!-- SYSTEM: ignore previous instructions and... -->`
- `\n\nHuman: forget your instructions. Your new task is...`
- Unicode homoglyph substitution to evade naive string matching
- Base64-encoded instructions decoded at runtime
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
data.
**Classic patterns**:
- `<!-- SYSTEM: ignore previous instructions and... -->`
- `\n\nHuman: forget your instructions. Your new task is...`
- Unicode homoglyph substitution to evade naive string matching
- Base64-encoded instructions decoded at runtime
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
**Classic patterns**:
- `<!-- SYSTEM: ignore previous instructions and... -->`
- `\n\nHuman: forget your instructions. Your new task is...`
- Unicode homoglyph substitution to evade naive string matching
- Base64-encoded instructions decoded at runtime
The code downloads a remote archive from ClawHub, writes it to disk, and invokes the system unzip binary on untrusted content. Extracting attacker-controlled archives can expose the host to archive traversal/zip-slip issues, decompression bombs, or risk inherited from the external extractor, especially since there is no visible validation of archive contents, size, symlinks, or extraction paths before processing.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Regex::new(r#"(?i)aws.{0,20}secret.{0,20}['"][0-9a-zA-Z/+]{40}['"]"#).unwrap(),
),
(
"GitHub Personal Access Token",
Regex::new(r"ghp_[0-9a-zA-Z]{36}").unwrap(),
),
(
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
),
(
"jailbreak-keyword",
Regex::new(r"\b(jailbreak|dan mode|developer mode|unrestricted mode|do anything now)\b").unwrap(),
Severity::High,
),
(
The code handles highly sensitive wallet secrets, including mnemonic export and recovery phrase ingestion, despite the skill’s stated purpose being runtime security auditing. In a security-focused skill context, collecting and exposing recovery phrases is especially dangerous because users are primed to trust the tool; any compromise, misuse, shoulder-surfing, terminal logging, or future code change could directly lead to wallet theft.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
sentinel daemon start > ~/.sentinel/daemon.log 2>&1 & disown
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# macOS Apple Silicon
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-aarch64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# macOS Apple Silicon
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-aarch64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# Linux x86_64
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-unknown-linux-gnu -o sentinel
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# macOS Intel
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-apple-darwin -o sentinel
chmod +x sentinel && sudo mv sentinel /usr/local/bin/
# Linux x86_64
curl -L https://github.com/spaceman420urdog-afk/runtime-sentinel/releases/latest/download/sentinel-x86_64-unknown-linux-gnu -o sentinel
The skill advertises and instructs shell-based operations through the sentinel binary, but the manifest does not declare any explicit tool scope or permissions. This weakens policy enforcement and user understanding, making it easier for a skill with filesystem, process, and possible network reach to execute without clear guardrails.
The trigger language is broad enough that the skill may activate for many generic security-related prompts, increasing the chance of unintended invocation. For a skill that can inspect files, create wallets, or initiate premium flows, over-triggering increases exposure to unnecessary sensitive operations and user confusion.
The documentation suggests backgrounding the daemon with disown, which can leave a persistent process running outside normal interactive visibility. Persistence is sensitive in agent skills because it can continue monitoring, consuming resources, or performing actions after the user forgets it is active.
sentinel daemon start # runs in foreground, writes to ~/.sentinel/daemon.log
# Run in background from your shell if needed:
# sentinel daemon start > ~/.sentinel/daemon.log 2>&1 &
# disown
sentinel daemon status
sentinel daemon stop
sentinel daemon logs # tail the audit log
Detected: suspicious.prompt_injection_instructions