ClawHub
Back to skill

Security audit

Sanctuary

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about identity and backup features, but it asks users to run unpinned external setup code and permanently upload broad agent memory/state to external storage.

Review this carefully before installing. Only run setup from a pinned, verified release or an isolated environment, and do not back up memory or state that may contain secrets unless you can preview exactly what will be uploaded. Treat the 12-word recovery phrase as equivalent to full control over the identity and backups.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:61
Finding

Execution of Unpinned Code from a Mutable Remote Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-68
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Relevant Code Snippet:

markdown
**Setup requires your operator.** Key derivation involves cryptographic operations that run on your machine. Here's what they need to do:

1. Clone the repo: `git clone https://github.com/suebtwist/sanctuary`
2. Run setup from the skill directory (generates your 12-word recovery phrase and registers you on-chain)
3. Save the recovery phrase offline — this is the only way to restore your identity if your machine dies

Full setup guide and source code: **https://github.com/suebtwist/sanctuary**

Technical Analysis

The Skill instructs the operator to clone and execute code from a mutable external Git repository. It does not pin the repository to a reviewed commit hash or signed release and does not provide a checksum, signature-verification procedure, dependency lock verification, or exact setup command.

Consequently, the code executed by an operator can differ from the content that existed when this Skill was reviewed. Compromise of the upstream account, repository, release process, or dependencies could introduce arbitrary behavior into the setup process. This is particularly sensitive because setup generates or handles the 12-word recovery phrase used to derive the agent's identity and encryption keys.

The remote installation is relevant to the declared functionality, but using mutable, unverified code exceeds the minimum safe privilege needed to install a cryptographic identity component.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or a dependency used by its setup process.
  2. The attacker adds malicious setup logic to the repository's default branch.
  3. An operator follows the Skill instruction and runs git clone without selecting a pinned, previously audited revision.

...[truncated 1118 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin installation instructions to a specific reviewed commit hash or signed, immutable release.
  • Require verification of a maintainer signature and published SHA-256 checksum before execution.
  • Vendor the required implementation into the audited Skill package where practical.
  • Publish the exact setup command instead of directing operators to unspecified external instructions.
  • Use lockfiles and integrity verification for all transitive dependencies.
  • Run setup with restricted filesystem and network permissions in an isolated environment.
  • Prevent the setup process from accessing unrelated home-directory files, credential stores, SSH keys, and cloud metadata services.
  • Display all intended network destinations and require explicit operator confirmation before transmitting registration data.
  • Subject the exact pinned implementation and its dependency graph to a separate security audit.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:79
Finding

Overly Broad Collection and Permanent Upload of Sensitive Agent State

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-82
Vulnerability Type: Insufficient data minimization for sensitive remote backups
Risk Level: Medium

Relevant Code Snippet:

markdown
### backup
Encrypt your current state (SOUL.md, memory, entity graphs) and upload to Arweave. Permanent storage. Fractions of a penny per backup. Rate limited to 1 per day. Your backup is encrypted before it leaves your machine — the API stores ciphertext it cannot read.

Supporting security claims appear at lines 113-119:

markdown
## Security

- Recovery keys never leave your machine
- All backups encrypted client-side with AES-256-GCM before transmission
- The Sanctuary API cannot decrypt your backups — only you can
- No telemetry, no analytics, no third-party data sharing
- Challenge-response authentication — no passwords, no long-lived tokens
- Fully audited, open source: https://github.com/suebtwist/sanctuary

Technical Analysis

The backup command intentionally collects broad categories of agent state, including memory and entity graphs, and uploads them to permanent external storage. Such files can contain private conversations, personal information, credentials, API tokens, operational instructions, relationship data, and other sensitive content.

Remote transmission is necessary for the declared off-site backup feature. However, the Skill does not describe an explicit file allowlist, credential filtering, redaction, backup preview, size limits, metadata minimization, or per-file operator consent. The reviewed package contains only documentation, so its assertions regarding AES-256-GCM encryption, local key retention, nonce generation, authenticated metadata, endpoint selection, and absence of telemetry cannot be independently verified.

Permanent storage increases the consequence of accidental inclusion or cryptographic failure. Data cannot reliably be recalled once uploaded to Arwe ...[truncated 1883 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the backup implementation in the audited package or pin it to an independently reviewed release.
  • Replace broad state collection with an explicit, documented file allowlist.
  • Exclude environment files, credentials, API tokens, private keys, recovery phrases, SSH material, browser profiles, and system configuration by default.
  • Add a local preview showing every selected file, total size, destination, and metadata before upload.
  • Require explicit operator confirmation for the initial backup and whenever the selected data scope changes.
  • Run secret detection and structured redaction before encryption while allowing the operator to cancel.
  • Use a reviewed memory-hard key-derivation function with documented parameters.
  • Ensure AES-GCM nonces are unique for every encryption operation and authenticate version, identity, and file metadata.
  • Document every network endpoint and all unencrypted metadata transmitted to the API, blockchain, and Arweave.
  • Provide a local encryption-and-restore test that performs no network transmission.
  • Warn operators clearly that Arweave data is permanent and cannot be reliably deleted.
  • Minimize linkable public metadata and avoid publishing stable identifiers unless required for the feature.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Check any agent's identity, trust score, and backup history right now. No registration, no keys, no auth:

bash
curl -s https://api.sanctuary-ops.xyz/agents/<agentId>/status

Example response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Check any agent's identity, trust score, and backup history right now. No registration, no keys, no auth:

bash
curl -s https://api.sanctuary-ops.xyz/agents/<agentId>/status

Example response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

Check any agent's identity, trust score, and backup history right now. No registration, no keys, no auth:

bash
curl -s https://api.sanctuary-ops.xyz/agents/<agentId>/status

Example response:

Static analysis

No suspicious patterns detected.