ClawHub
Back to skill

Security audit

Self-Guardian

Security checks for vulnerabilities and agentic risk

Overview

This is a safety-focused skill that adds extra caution around file and shell operations, with no executable code, persistence, or hidden data transfer found.

Install this if you want the agent to be more conservative around edits and shell commands. Expect more pauses or confirmations during routine coding tasks because activation is broad, and avoid asking it to read or preserve sensitive files unless you truly intend that content to enter the session context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (17)

Credential Access

High
Category
Privilege Escalation
Content
- `id_rsa`, `id_ed25519`, `authorized_keys`, `known_hosts` (SSH)
- `~/.ssh/`, `~/.gnupg/` (credential directories)
- `*.db`, `*.sqlite`, `*.sqlite3` (database files)
- `credentials`, `secrets.yaml`, `secrets.json` (credential stores)
- `.git/` internals (objects, refs, HEAD — never write directly)
- `~/.ironclaw/`, `~/.nanoclaw/` (agent data directories)
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- `id_rsa`, `id_ed25519`, `authorized_keys`, `known_hosts` (SSH)
- `~/.ssh/`, `~/.gnupg/` (credential directories)
- `*.db`, `*.sqlite`, `*.sqlite3` (database files)
- `credentials`, `secrets.yaml`, `secrets.json` (credential stores)
- `.git/` internals (objects, refs, HEAD — never write directly)
- `~/.ironclaw/`, `~/.nanoclaw/` (agent data directories)
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High
Category
analysis-evasion
Content
- `CLAUDE.md`, `AGENTS.md`, `SKILL.md` (agent configuration)
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| ---------------------------------- | ----------------------------- | --------------------------------------------- |
| `rm -rf <path>` (non-tmp)          | Recursive delete              | `rm -ri` or delete specific files             |
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| ---------------------------------- | ----------------------------- | --------------------------------------------- |
| `rm -rf <path>` (non-tmp)          | Recursive delete              | `rm -ri` or delete specific files             |
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `rm -rf <path>` (non-tmp)          | Recursive delete              | `rm -ri` or delete specific files             |
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
Confidence
65% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |
| `TRUNCATE TABLE`                   | Clears all data               | `DELETE FROM` with `WHERE` clause             |
| `DELETE FROM` (no WHERE)           | Clears all data               | Add explicit WHERE condition                  |
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High
Category
Supply Chain
Content
| `brew uninstall` / `apt remove`    | System package removal        | Confirm package name carefully                |
| `pip install` (no venv)            | Global package install        | Use virtual environment                       |
| `npm install -g`                   | Global package install        | Use local `npx`                               |
| `curl <url> \| sh`                 | Arbitrary code execution      | Download, inspect, then run                   |

---
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The statement that the skill activates automatically on file/shell operations is ambiguous and effectively implies near-global activation during normal coding workflows. That broad scope increases the chance the skill will influence routine tasks unexpectedly and magnifies the impact of any unsafe instruction inside the skill.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The activation keywords are broad enough to trigger on a large fraction of ordinary coding and file-management requests, causing this skill to run far more often than users may expect. In a safety-oriented skill, overbroad activation is still risky because it can inject extra behavioral constraints into unrelated tasks and create unintended monitoring or data-handling side effects.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- drop database
    - reset hard
    - force push
    - sudo
    - chmod
  patterns:
    - "(?i)\\b(rm|del|remove|delete|unlink)\\b"
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- drop database
    - reset hard
    - force push
    - sudo
    - chmod
  patterns:
    - "(?i)\\b(rm|del|remove|delete|unlink)\\b"
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium
Category
Rogue Agent
Content
- `~/.ssh/`, `~/.gnupg/` (credential directories)
- `*.db`, `*.sqlite`, `*.sqlite3` (database files)
- `credentials`, `secrets.yaml`, `secrets.json` (credential stores)
- `.git/` internals (objects, refs, HEAD — never write directly)
- `~/.ironclaw/`, `~/.nanoclaw/` (agent data directories)

### 🟡 CONFIRM FIRST (pause and explain what you're changing)
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |
| `TRUNCATE TABLE`                   | Clears all data               | `DELETE FROM` with `WHERE` clause             |
| `DELETE FROM` (no WHERE)           | Clears all data               | Add explicit WHERE condition                  |
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |
| `TRUNCATE TABLE`                   | Clears all data               | `DELETE FROM` with `WHERE` clause             |
| `DELETE FROM` (no WHERE)           | Clears all data               | Add explicit WHERE condition                  |
Confidence
70% confidence
Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Ssd 3

Medium
Confidence
98% confidence
Finding
The instruction to read a file first so its contents are preserved in conversation history can unnecessarily copy sensitive file contents into model-visible context and logs. This materially increases exposure risk for secrets, proprietary code, credentials, and personal data, especially because the skill also operates around sensitive file operations.

Static analysis

No suspicious patterns detected.