ClawHub
Back to skill

Security audit

herdr-faq

Security checks for vulnerabilities and agentic risk

Overview

This skill is an agent-orchestration guide, but it recommends bypassing trust and approval safeguards for child coding agents.

Review carefully before installing. This skill is useful only if you intentionally want Herdr to drive child coding agents with broad automation. Avoid using the provided pre-trust and auto-approval recipes on untrusted repositories, and do not bypass classifier or trust prompts unless you have explicitly approved the exact directory and permissions involved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:311
Finding

Instructions Explicitly Recommend Bypassing Harness Safety Enforcement

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:81
Finding

Claude Workspace Trust Is Pre-Approved Without an Interactive Trust Decision

Content
View full analysis
"$CFG/.claude.json" P=$(herdr pane split --current --cwd "$D" --no-focus --env CLAUDE_CONFIG_DIR="$CFG" \ | jq -r .result.pane.pane_id) ``` ### Technical Analysis The recipe creates a Claude configuration file that sets `hasTrustDialogAccepted` to `true` for the selected directory before Claude starts. This suppresses the normal folder-trust decision rather than presenting it to the user. Although the configuration is placed in an isolated `/tmp/agentcfg` directory rather than the user's ordinary Claude configuration, the security boundary is still bypassed for the resulting agent session. Any project path assigned to `$D`, including an untrusted or attacker-controlled repository, is treated as trusted without an explicit user decision. The fixed path `/tmp/agentcfg` also makes the configuration non-unique across concurrent or same-host runs. The audited text does not set restrictive permissions or create the directory through a collision-resistant mechanism. ### Attack Path 1. An attacker supplies or influences the workspace path assigned to `$D`. 2. The recipe creates `/tmp/agentcfg/.claude.json`. 3. The generated configuration records the attacker-controlled workspace as having accepted the trust dialog. 4. Claude starts with `CLAUDE_CONFIG_DIR=/tmp/agentcfg`. 5. The folder-trust gate does not require an interactive user decision. 6. Claude processes files and instructions from the workspace under trusted-workspace ...[truncated 664 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:114
Finding

Antigravity Trust Configuration Is Persistently Modified to Suppress the Trust Dialog

Content
View full analysis
"$D/report.md" # pre-create the output file python3 - "$D" <<'PY' # pre-trust; the dialog is unanswerable (below) import json, pathlib, sys p = pathlib.Path.home() / ".gemini/antigravity-cli/settings.json" d = json.loads(p.read_text()) if p.exists() else {} tw = d.setdefault("trustedWorkspaces", []) # a list of exact paths, not a map if sys.argv[1] not in tw: tw.append(sys.argv[1]) p.write_text(json.dumps(d, indent=2) + "\n") PY ``` ### Technical Analysis The recipe directly edits `~/.gemini/antigravity-cli/settings.json` and appends the selected directory to `trustedWorkspaces`. This is a persistent user-level trust change performed before agent launch specifically to pre-empt the native trust dialog. Unlike a temporary session-only approval, this trust record survives the Skill run. Future Antigravity sessions may therefore treat the directory as trusted without asking the user again. The code does not normalize or validate the supplied path, request user approval, remove the entry afterward, preserve file permissions explicitly, or use locking and atomic replacement when updating the shared settings file. The finding concerns bypass and persistence of a security decision. It does not establish installation of a service or code-execution backdoor, so it is not classified as system persistence under T06. ### Attack Path 1. An attacker causes an untrusted path to be selected as `$D`, or supplies malicious content in that workspace. 2. The Python snippet opens the user's Antigravity settings. 3. The path is appended to the persistent `trustedWorkspaces` array. 4. Antigravity is launched and no l ...[truncated 858 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:66
Finding

Default Launch Recipes Enable Automatic Approval and Edit Acceptance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

P=$(herdr pane split --current --cwd "$D" --no-focus --env CLAUDE_CONFIG_DIR="$CFG"
| jq -r .result.pane.pane_id) herdr agent start cl1 --kind claude --pane "$P" --timeout 90000 -- --model claude-opus-5 herdr agent read cl1 --source detection --lines 40 # ALWAYS, before the first prompt herdr agent prompt cl1 "Carry out $D/brief.md." --wait --timeout 1800000 &

text

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
P=$(herdr tab create --workspace "$WS" --cwd "$D" --label ag1 --no-focus \
    | jq -r .result.root_pane.pane_id)      # one TAB per agent, never N panes in one tab
herdr agent start ag1 --kind agy --pane "$P" --timeout 120000 \
  -- --model gemini-3.7-flash-medium --effort medium --mode accept-edits
herdr agent read ag1 --source detection --lines 15   # read the banner, not the status
herdr agent prompt ag1 "Carry out $D/brief.md. Write your report to $D/report.md." \
  --wait --timeout 1800000 &                # then poll for the file, not the state

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md
wait on the report file, never a settled state. A first prompt
  can be swallowed entirely with `agent_prompt_stalled` and no trace in the composer;
  re-prompt, never `send-keys`. No session ref until the first prompt. Integration
  install target is `antigravity-cli`; `~/.gemini/config` must exist (or
  `ANTIGRAVITY_CLI_CONFIG_DIR`).

Integrations for all three are session-restore only - they never improve state

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

herdr agent start ag1 --kind agy --pane "$P" --timeout 120000
-- --model gemini-3.7-flash-medium --effort medium --mode accept-edits herdr agent read ag1 --source detection --lines 15 # read the banner, not the status herdr agent prompt ag1 "Carry out $D/brief.md. Write your report to $D/report.md."
--wait --timeout 1800000 & # then poll for the file, not the state

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md
## Drive

- **Wait on the artifact, not the state.** End every non-trivial brief with "write
  your full report to `<path>` and reply with only the path", and poll for the file.
  `idle` arrives on interrupted turns, on fleet parents that dispatched children, and
  for the whole life of a claude background MCP task (invariant 4) - a watcher on

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 27)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 31)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 54)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 147)May include surrounding context.

text
permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation source, and
configuration files.

"Object" form shall mean any form resulting from mechanical transformation or

Static analysis

No suspicious patterns detected.