ClawShield Lite – AI Skill Security Scanner

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.0

Overview

This is a simple local pattern scanner, and the reported dangerous strings are scanner test examples rather than hidden harmful behavior.

Install only if you want a lightweight local heuristic checker. Do not rely on its SAFE output as proof that a skill is safe; it can miss obfuscated or semantically equivalent risky code and should be supplemented with manual review or stronger static analysis.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:32

Finding

Trivial Obfuscation Bypasses Security Detection and Produces a False SAFE Result

Content

View full analysis

= 3 or total >= 3: risk_level = "HIGH RISK" else: risk_level = "MEDIUM RISK" ``` ### Technical Analysis The scanner detects risks exclusively through exact, case-sensitive substring comparisons. It performs no lexical normalization, tokenization, abstract syntax tree analysis, alias resolution, constant folding, or semantic examination. Consequently, dangerous behavior can evade detection when represented through aliases, split string literals, dynamic attribute lookup, dynamic imports, escaped identifiers, or alternative APIs. When no literal pattern matches, the scanner unconditionally assigns `SAFE`, even though the result only establishes that none of the limited configured strings occurred verbatim. For example, the following command-execution expression avoids the configured `os.system`, `exec(`, `eval(`, and `subprocess` strings: ```python getattr(__import__("o" + "s"), "sys" + "tem")("id") ``` The vulnerability is in the scanner's classification logi ...[truncated 1291 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:50

Finding

Confirmed High-Severity Execution Primitives Are Underclassified as Medium Risk

Content

View full analysis

= 3 or total >= 3: risk_level = "HIGH RISK" else: risk_level = "MEDIUM RISK" ``` ### Technical Analysis The scoring algorithm requires at least three total findings or three high-severity findings before returning `HIGH RISK`. As a result, one or two explicitly high-severity patterns are reported only as `MEDIUM RISK`. This conflicts with the meaning of the configured dangerous rules. A single use of `exec(`, `eval(`, `os.system`, or a process-execution API can be sufficient to execute attacker-controlled code or operating-system commands. The potential severity of such a primitive does not depend on finding three different textual indicators. For example, input containing only the following statement produces one high-severity issue but an overall `MEDIUM RISK` classification: ```python exec(user_input) ``` If downstream policy permits medium-risk submissions or subjects them to less scrutiny, this scoring behavior can weaken the intended security gate. ### Attack Path 1. An attacker creates a malicious skill using only one configured high-severity primitive. 2. The source is submitted to the scanner. 3. The dangerous pattern is detected and assigned issue severity `high`. 4. Because `high_count` and `total` are both below three, the overall result becomes `MEDIUM RISK`. 5. A workflow that blocks only `HIGH RISK` results may approve or insufficiently review the skill. 6. When the approved skill is executed, the dangerous primitive runs with the privileges available to that skill. ### Impact Assessment The scanner itself does not execute the submitted code, ...[truncated 515 chars]

Remediation

View remediation

= 1: risk_level = "HIGH RISK" elif total >= 1: risk_level = "MEDIUM RISK" else: risk_level = "SAFE" ``` 2. Base severity on the capability and data flow involved rather than only the number of matched strings. 3. Distinguish confirmed dangerous behavior from weak indicators and informational findings. 4. Define explicit fail-closed integration guidance: automated workflows should block confirmed high-severity findings regardless of the total issue count. 5. Add unit tests for zero findings, one medium finding, one high finding, multiple medium findings, and mixed-severity findings. 6. Keep issue-level and overall classifications consistent so that a report cannot contain a `high` issue while presenting an overall level below high without a documented justification. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 3)May include surrounding context.

text

__pycache__/
*.pyc
.env

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Usage

bash

echo "import os; os.system('rm -rf /')" | python main.py

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Usage

bash

echo "import os; os.system('rm -rf /')" | python main.py

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example explanation at L056 contains Arabic text ('خارج') embedded in otherwise English documentation. This introduces a language inconsistency that could violate a language/locale policy if users are not given a choice or the locale is not explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.