Security audit

MaskClaw: Evolutionary Personalized Privacy Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill is a privacy-masking suite, but it stores sensitive behavior data and can automatically generate and publish persistent user skills from model output.

Install only in a controlled environment after disabling or gating automatic publishing, restricting MiniCPM to a trusted local endpoint, removing raw previews/correction values from logs, adding retention/deletion and encryption controls, and fixing path validation before using real user data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: scripts/evolution_mechanic.py:1218
Finding: Persistent Skill poisoning through untrusted evolution inputs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/evolution_mechanic.py:1414
Finding: Path traversal permits out-of-root Skill writes and recursive deletion
Content: View full analysis
str: if "/" in draft_name: return draft_name return f"general/{draft_name}" def _next_version(self, user_id: str, skill_name: str) -> str: root = self.user_skills_root / user_id / skill_name if not root.exists(): return "v1.0.0" ``` A second write uses the same unsanitized user identifier: ```python catalog_path = self.user_skills_root / user_id / "SKILL_CATALOG.md" catalog_path.write_text("\n".join(lines), encoding="utf-8") ``` ### Technical Analysis `user_id` and `draft_name` are used as filesystem path components without rejecting absolute paths, separators, `..` components, or platform-specific traversal syntax. `pathlib` does not automatically constrain a composed path to its intended root. A malicious identifier can therefore make `skill_dir` or `catalog_path` resolve outside `user_skills_root`. The failure handler increases the impact because it recursively deletes the computed `skill_dir` without verifying that the directory remains under the configured Skill root or that it was exclusively created by the current transaction. ### Attack Path 1. An attacker supplies a crafted `user_id` or `draft_name`, such as one containing parent-director ...[truncated 919 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/behavior_monitor.py:197
Finding: Sensitive behavior and correction data is retained in plaintext without enforced expiration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/evolution_mechanic.py:179
Finding: Sensitive correction records can be transmitted to an arbitrary plaintext HTTP endpoint
Content: View full analysis
None: ... self.minicpm_url = minicpm_url ``` The configured destination is used without validation: ```python def _call_minicpm(self, prompt: str, timeout: int = MINICPM_TIMEOUT) -> str: data = urlparse.urlencode({"prompt": prompt}).encode("utf-8") req = urlrequest.Request(self.minicpm_url, data=data, method="POST") try: with urlrequest.urlopen(req, timeout=timeout) as resp: payload = json.loads(resp.read().decode("utf-8")) if str(payload.get("status")) != "success": raise RuntimeError(str(payload.get("message", "MiniCPM error"))) return str(payload.get("response", "")) ``` Correction records are included in prompts: ```python traces = self.skill_db.get_pending_traces(user_id, min_corrections=1) corrections_summary = [] for t in traces[:3]: corrections_summary.append({ "session_id": t.get("session_id", "")[:50], "app_context": t.get("app_context", ""), "corrections": t.get("corrections", [])[:2], }) ``` ### Technical Analysis The default endpoint is loopback, but the constructor accepts any caller-provided URL. There is no validation that the destination is local, trusted, authenticated, or protected by TLS. `urlopen()` may also follow redirects according to its default behavior. Prompts can contain user correction reco ...[truncated 1163 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/smart_masker.py:72
Finding: Smart Masker prints OCR-extracted sensitive text before masking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/smart_masker.py:50
Finding: Documented privacy-masking API is absent from the implementation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:75
Finding: Runtime dependencies are installed without version or integrity pinning
Content: View full analysis
= 3.10 pip install rapidocr opencv-python numpy transformers chromadb ``` ### Technical Analysis The installation instructions retrieve mutable latest versions of multiple third-party packages and their transitive dependencies. No lockfile, exact version constraints, package hashes, trusted index configuration, or reproducible build process is provided in the audited artifact. This does not prove that any currently named package is malicious. However, it creates a supply-chain exposure because the effective code installed in the environment can change after the Skill itself has been reviewed. ### Attack Path 1. A user follows the project installation instructions. 2. The package installer resolves the latest available versions and transitive dependencies from its configured index. 3. A compromised release, account takeover, dependency-confusion package, or malicious index serves altered code. 4. Installation hooks or imported package code execute with the privileges of the installation or runtime process. 5. The compromised dependency can access screenshots, OCR output, behavior logs, model prompts, and generated Skills handled by this project. ### Impact Assessment A malicious dependency would execute with the privileges of the Python environment. It could read or modify all project-accessible data, including privacy-sensitive screenshots and logs, and could make network requests or alter generated policy files. The precise scope is determined by deployment privileges and package-index trust. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: This variant identifies materially risky declared behavior: persistent logging of user behavior, remote API use, publishing/updating skills, and automatic rule evolution are powerful capabilities that exceed a simple privacy-masking tool. In this context, the danger is not merely mismatch but under-disclosed capability expansion that could expose sensitive activity data or permit unauthorized modification of agent behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: This variant identifies materially risky declared behavior: persistent logging of user behavior, remote API use, publishing/updating skills, and automatic rule evolution are powerful capabilities that exceed a simple privacy-masking tool. In this context, the danger is not merely mismatch but under-disclosed capability expansion that could expose sensitive activity data or permit unauthorized modification of agent behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: This variant identifies materially risky declared behavior: persistent logging of user behavior, remote API use, publishing/updating skills, and automatic rule evolution are powerful capabilities that exceed a simple privacy-masking tool. In this context, the danger is not merely mismatch but under-disclosed capability expansion that could expose sensitive activity data or permit unauthorized modification of agent behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This variant identifies materially risky declared behavior: persistent logging of user behavior, remote API use, publishing/updating skills, and automatic rule evolution are powerful capabilities that exceed a simple privacy-masking tool. In this context, the danger is not merely mismatch but under-disclosed capability expansion that could expose sensitive activity data or permit unauthorized modification of agent behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This variant identifies materially risky declared behavior: persistent logging of user behavior, remote API use, publishing/updating skills, and automatic rule evolution are powerful capabilities that exceed a simple privacy-masking tool. In this context, the danger is not merely mismatch but under-disclosed capability expansion that could expose sensitive activity data or permit unauthorized modification of agent behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This variant identifies materially risky declared behavior: persistent logging of user behavior, remote API use, publishing/updating skills, and automatic rule evolution are powerful capabilities that exceed a simple privacy-masking tool. In this context, the danger is not merely mismatch but under-disclosed capability expansion that could expose sensitive activity data or permit unauthorized modification of agent behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code packages user-derived session traces and correction data into prompts sent to MiniCPM for analysis, which can expose behavioral history and potentially sensitive fields to an LLM service. In a privacy-protection product, exporting exactly the data being protected is a strong contradiction and can lead to privacy leakage, secondary use, or retention outside the expected trust boundary.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill metadata declares no explicit tool scope or permissions even though the documentation describes capabilities that imply filesystem access, network access, and rule publication. In an agent environment, missing scope declarations weaken review and sandboxing because operators cannot reliably constrain what the skill is allowed to do before installation or execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly presents behavior monitoring and shows logging of user ID, app context, scenario tags, fields, and PII type, but it does not provide an upfront warning that sensitive user actions and context are recorded. In a privacy-branded skill, this omission is especially dangerous because users may trust it to reduce exposure while it simultaneously creates new sensitive telemetry.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The self-evolution section describes automatic optimization, sandbox testing, and publish/mount behavior without a clear warning that the skill may modify or deploy updated rules autonomously. In an agent system, silent self-modification or auto-publication can alter enforcement behavior, introduce regressions, or expand privileges without adequate human review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file title and all instructional content are written as a required Chinese SOP template, and there is no indication that users may choose another language or locale. This creates a natural-language policy concern because the skill appears to force a specific language without explicit user opt-in or a documented locale-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The architecture explicitly describes capturing user correction logs and forwarding processed screenshots plus metadata to a cloud agent, but the document does not mention explicit user notice, consent, retention limits, or privacy controls. In a privacy-focused product, silent behavior logging and cloud transmission can create compliance, trust, and data-governance risks even if the screenshots are intended to be masked first.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is written as a prompt-template document in Chinese, and multiple embedded templates instruct the model to produce outputs in Chinese phrasing and field descriptions. Because the file does not indicate that Chinese is optional, user-selected, or required for a justified region-specific context, it creates a language/locale policy concern under the natural-language policy rule.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file describes collecting and storing user personalized privacy rules, historical behavior patterns, and UI-context matching data, which can affect user privacy and data handling. The document does not include any warning or disclosure to users about retention, monitoring, or privacy implications of these behaviors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown explicitly proposes collecting detailed user behavior and correction logs, including value_preview and sensitive classifications such as medical records, but does not describe consent, minimization, encryption, retention enforcement, or user-facing disclosure. In a privacy-protection skill, silently persisting rich correction logs materially increases exposure of sensitive data and creates a high-value local or server-side surveillance dataset if accessed by attackers or mishandled internally.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The design is internally inconsistent: early sections frame generation as structured privacy-rule extraction, while later sections describe evolving SOPs and publishing them as user skills. That ambiguity is dangerous because implementers may permit a broader class of model-generated outputs than intended, allowing the evolution system to cross from passive policy generation into active agent behavior modification without equivalent safeguards.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document describes a self-evolution pipeline that does not stop at deriving privacy rules, but culminates in publishing new artifacts into user_skills/. That expands the trust boundary from data-driven rule tuning into behavior-changing skill generation, creating a pathway for unreviewed logs or model outputs to influence executable agent capabilities and potentially introduce unsafe or prompt-injected behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Behavior Monitor API explicitly documents persistent logging of user-linked identifiers, app context, relationship tags, fields, and PII types into JSONL/session trace artifacts, but provides no retention limits, consent expectations, minimization guidance, or access controls. In a privacy-protection skill, this creates a real privacy/security risk because operators may deploy broad surveillance-style logging that centralizes sensitive behavioral and personal data, increasing exposure in the event of misuse or compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The log_event docstring says the function writes old-format logs to both behavior_log.jsonl and correction_log.jsonl for compatibility. In actual code, the only old-format write path is conditional writing to correction_log.jsonl, and there is no behavior_log.jsonl write implementation in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code persists user_id together with app context, field names, value previews, correction values, and PII type metadata to disk under predictable per-user paths, without any access-control, minimization, encryption, or consent enforcement in this module. In a privacy-protection skill, local persistence of sensitive behavioral and PII-adjacent data is particularly risky because compromise of the host, backups, or other local processes could expose user activity and identifiers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Structured session traces are appended to disk with detailed action histories, fields, relationship tags, agent intent, and possible correction data, creating rich behavioral profiles tied to a user. In the context of an endpoint privacy-protection suite, storing this telemetry locally without built-in privacy controls undermines the product's trust boundary and increases the blast radius of any local file disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The demo script records detailed user activity metadata to disk, including user ID, scenario tags, app context, relationship tags, and previews of sensitive content, but this file provides no notice, consent flow, retention control, or minimization safeguards. In a privacy-protection skill, silently persisting behavior traces can itself create a new privacy and compliance risk if logs are accessed by unauthorized parties or retained longer than necessary.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 82% confidence
Finding: Optional imports allow security-relevant components such as FinalSandbox, SemanticEvaluator, ChecklistEvaluator, and SkillDB to become None, but the code does not enforce a fail-closed initialization path for missing safeguards. In practice this creates an unsafe-default design where a mispackaged or degraded environment may disable validation or break trust assumptions rather than halting securely.
Content: Scanner excerpt · scripts/evolution_mechanic.py (reported line 54)May include surrounding context.
python
except ImportError: ChromaManager = None ChecklistEvaluator = None FinalSandbox = None SemanticEvaluator = None SemanticTestResult = None SkillDB = None

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTTP LLM call sends prompt material derived from traces and corrections without any user-facing notice, consent check, or code-level policy enforcement around sensitive content. Because the skill is explicitly marketed for endpoint privacy protection, hidden transmission of behavioral data is especially dangerous and undermines user expectations and compliance posture.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module autonomously generates, validates, and publishes new skills/SOPs into the user_skills tree, which materially expands the system's authority beyond passive privacy masking/monitoring. In a privacy-focused skill, self-modifying and self-publishing behavior increases the risk of policy drift, unsafe automation, and deployment of unreviewed behaviors under the guise of privacy protection.
Content: No source excerpt is available for this finding.