ClawHub
Back to skill

Security audit

Incident Replay

Security checks for vulnerabilities and agentic risk

Overview

This forensic skill is purpose-aligned and not malicious, but it should be reviewed because it can copy broad workspace file contents into persistent local incident data without strong secret controls or symlink containment.

Install only if you are comfortable with local forensic copies of your workspace. Before use, set a narrow WORKSPACE_ROOT, aggressively exclude secrets, credentials, logs, agent memory, and unrelated projects, avoid running it in workspaces writable by untrusted users, and review snapshot/report files before sharing or committing them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
incident_capture.py:218
Finding

Plaintext Collection and Retention of Sensitive Workspace and Agent-Memory Content

Content
View full analysis
self.max_snapshot_size: raise RuntimeError( f"Snapshot exceeds MAX_SNAPSHOT_SIZE ({self.max_snapshot_size} bytes). " f"Adjust INCLUDE_PATTERNS or MAX_SNAPSHOT_SIZE." ) fhash = _file_hash(full_path) content = None if size <= self.max_file_size: try: with open(full_path, "r", encoding="utf-8", errors="replace") as fh: ...[truncated 2852 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
incident_capture.py:218
Finding

Workspace Boundary Bypass Through Symlink Following

Content
View full analysis
self.max_snapshot_size: raise RuntimeError( f"Snapshot exceeds MAX_SNAPSHOT_SIZE ({self.max_snapshot_size} bytes). " f"Adjust INCLUDE_PATTERNS or MAX_SNAPSHOT_SIZE." ) fhash = _file_hash(full_path) content = None if size <= self.max_file_size: try: with open(full_path, "r", encoding="utf-8", errors="replace") as fh: content = fh.read() except (OSError, IOError): pass files[rel_path] = FileEntry( path=rel_path, size=size, modified=stat.st_mtime, sha256=fhash, content=content, ) ``` ### Technical Analysis The implementation derives a lexical path beneath `WORKSPACE_ROOT`, but it does not resolve the path and verify that the final file remains inside that root. Both `os.stat()` and the ordinary `open()` call follow symbolic links. Consequently, a symbolic link whose directory entry is inside the workspace may point to a file anywhere else that is readable by the process. The ...[truncated 1994 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · incident_replay.py (reported line 298)May include surrounding context.

python
deletions += 1
            if ctype == "modified" and any(
                p in path.lower()
                for p in ["config", ".cfg", ".ini", ".yaml", ".yml", ".env"]
            ):
                config_changes += 1

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill describes functionality that reads and writes workspace data, including snapshots and reports, but does not declare any explicit tool scope or permissions boundaries. This increases the risk of overbroad file access because operators and automated systems cannot easily determine what filesystem capabilities the skill requires or constrain it to least privilege.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill prominently advertises capturing workspace state, including file content, but does not place an up-front warning that snapshots may collect secrets, credentials, tokens, or other sensitive material from the monitored workspace. In a forensics context this is particularly dangerous because users may snapshot broad directories and then persist or share incident artifacts that contain confidential data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger system is described in broad terms such as log patterns, file changes, and content scans without clear constraints, allowlists, or safe defaults. In a forensic tool that scans workspace contents and logs, underspecified trigger logic can lead to overcollection of sensitive data, noisy or misleading incident classification, and unsafe monitoring scope if users enable broad patterns without understanding the privacy impact.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The snapshot routine reads and stores full contents of every included file up to MAX_FILE_SIZE, then persists them to JSON snapshots on disk. In a forensic tool operating over an entire workspace, this can capture credentials, proprietary code, personal data, tokens, and incident artifacts far beyond metadata-only state capture, creating a high-risk local data hoard and secondary disclosure surface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The tool silently captures file contents from the workspace and saves them without any user-facing notice that sensitive data may be collected and retained. In incident-response scenarios, operators may point the tool at production workspaces containing secrets and regulated data, so lack of transparency materially raises the risk of accidental overcollection and unsafe retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Trigger output includes matched log excerpts and file-pattern evidence, which can surface sensitive strings directly in console output or JSON results. That creates a disclosure channel to terminals, CI logs, chat transcripts, or downstream systems consuming the output, especially in a forensic workflow where logs often contain tokens, PII, or internal identifiers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The trigger engine scans arbitrary file contents with configured regex patterns, turning a post-mortem state tool into a general content inspection mechanism. In this skill context, broad workspace scanning increases the chance of processing sensitive materials unrelated to the incident and exposing their existence or matching text through findings.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module description and implementation show that the skill does more than transient post-mortem analysis: it maintains a persistent incident store containing timelines, triggers, decisions, file changes, and notes. In a forensics context, those artifacts can contain sensitive operational data, so expanding from analysis into durable storage increases privacy and data-exposure risk if users do not explicitly expect or consent to retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The create_incident flow serializes and saves incident data without any explicit warning that analysis results will be retained on disk. Because the collected data can include log-derived decision points and file-change context from failure investigations, users may unknowingly persist sensitive material, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code unconditionally writes incident records to disk via _save_incident(), persisting potentially sensitive forensic data such as decision text, triggers, and file-change details. In this skill context, stored post-mortem artifacts may include secrets, internal paths, or operational metadata, making silent persistence more dangerous than ordinary application logging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The tool can persist full incident reports to disk, and those reports may contain sensitive forensic data such as decision chains, file diffs, triggers, and notes. In an incident-forensics context this materially increases exposure risk because users may unintentionally write confidential operational or security data to an insecure location without explicit warning or confirmation.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 181)May include surrounding context.

md
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documentation states that the software 'does not transmit data externally unless explicitly configured by the user,' which implies the existence of some external transmission behavior. However, the rest of the manifest consistently describes a local, stdlib-only forensic tool focused on snapshots, timelines, and local report generation, with no documented network/export feature. This is an intent-level contradiction in the documentation rather than a mere omission.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · incident_capture.py (reported line 50)May include surrounding context.

python
def _get(cfg: Any, name: str, default: Any = None) -> Any:
    if isinstance(cfg, dict):
        return cfg.get(name, default)
    return getattr(cfg, name, default)


class ReportGenerator:

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · incident_replay.py (reported line 51)May include surrounding context.

python
def _get(cfg: Any, name: str, default: Any = None) -> Any:
    if isinstance(cfg, dict):
        return cfg.get(name, default)
    return getattr(cfg, name, default)


class ReportGenerator:

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · incident_report.py (reported line 42)May include surrounding context.

python
def _get(cfg: Any, name: str, default: Any = None) -> Any:
    if isinstance(cfg, dict):
        return cfg.get(name, default)
    return getattr(cfg, name, default)


class ReportGenerator:

Static analysis

No suspicious patterns detected.