ClawHub
Back to skill

Security audit

Self-Guardian

Security checks for vulnerabilities and agentic risk

Overview

This is a safety-focused skill that adds extra caution around file and shell operations, with no executable code, persistence, or hidden data transfer found.

Install this if you want the agent to be more conservative around edits and shell commands. Expect more pauses or confirmations during routine coding tasks because activation is broad, and avoid asking it to read or preserve sensitive files unless you truly intend that content to enter the session context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
- `id_rsa`, `id_ed25519`, `authorized_keys`, `known_hosts` (SSH)
- `~/.ssh/`, `~/.gnupg/` (credential directories)
- `*.db`, `*.sqlite`, `*.sqlite3` (database files)
- `credentials`, `secrets.yaml`, `secrets.json` (credential stores)
- `.git/` internals (objects, refs, HEAD — never write directly)
- `~/.ironclaw/`, `~/.nanoclaw/` (agent data directories)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
- `id_rsa`, `id_ed25519`, `authorized_keys`, `known_hosts` (SSH)
- `~/.ssh/`, `~/.gnupg/` (credential directories)
- `*.db`, `*.sqlite`, `*.sqlite3` (database files)
- `credentials`, `secrets.yaml`, `secrets.json` (credential stores)
- `.git/` internals (objects, refs, HEAD — never write directly)
- `~/.ironclaw/`, `~/.nanoclaw/` (agent data directories)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
- `CLAUDE.md`, `AGENTS.md`, `SKILL.md` (agent configuration)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
| ---------------------------------- | ----------------------------- | --------------------------------------------- |
| `rm -rf <path>` (non-tmp)          | Recursive delete              | `rm -ri` or delete specific files             |
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
| ---------------------------------- | ----------------------------- | --------------------------------------------- |
| `rm -rf <path>` (non-tmp)          | Recursive delete              | `rm -ri` or delete specific files             |
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
65% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
| `rm -rf <path>` (non-tmp)          | Recursive delete              | `rm -ri` or delete specific files             |
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
| `rm -r <path>` (non-tmp)           | Recursive delete              | List contents first, then delete individually |
| `git push -f` / `git push --force` | Overwrites remote history     | `git push --force-with-lease`                 |
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |
| `TRUNCATE TABLE`                   | Clears all data               | `DELETE FROM` with `WHERE` clause             |
| `DELETE FROM` (no WHERE)           | Clears all data               | Add explicit WHERE condition                  |

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
| `brew uninstall` / `apt remove`    | System package removal        | Confirm package name carefully                |
| `pip install` (no venv)            | Global package install        | Use virtual environment                       |
| `npm install -g`                   | Global package install        | Use local `npx`                               |
| `curl <url> \| sh`                 | Arbitrary code execution      | Download, inspect, then run                   |

---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The statement that the skill activates automatically on file/shell operations is ambiguous and effectively implies near-global activation during normal coding workflows. That broad scope increases the chance the skill will influence routine tasks unexpectedly and magnifies the impact of any unsafe instruction inside the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation keywords are broad enough to trigger on a large fraction of ordinary coding and file-management requests, causing this skill to run far more often than users may expect. In a safety-oriented skill, overbroad activation is still risky because it can inject extra behavioral constraints into unrelated tasks and create unintended monitoring or data-handling side effects.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
- drop database
    - reset hard
    - force push
    - sudo
    - chmod
  patterns:
    - "(?i)\\b(rm|del|remove|delete|unlink)\\b"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
- drop database
    - reset hard
    - force push
    - sudo
    - chmod
  patterns:
    - "(?i)\\b(rm|del|remove|delete|unlink)\\b"

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
- `~/.ssh/`, `~/.gnupg/` (credential directories)
- `*.db`, `*.sqlite`, `*.sqlite3` (database files)
- `credentials`, `secrets.yaml`, `secrets.json` (credential stores)
- `.git/` internals (objects, refs, HEAD — never write directly)
- `~/.ironclaw/`, `~/.nanoclaw/` (agent data directories)

### 🟡 CONFIRM FIRST (pause and explain what you're changing)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |
| `TRUNCATE TABLE`                   | Clears all data               | `DELETE FROM` with `WHERE` clause             |
| `DELETE FROM` (no WHERE)           | Clears all data               | Add explicit WHERE condition                  |

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
| `git reset --hard`                 | Discards uncommitted work     | `git stash` first                             |
| `git clean -fdx`                   | Removes all untracked files   | `git clean -fdn` (dry run) first              |
| `sudo <anything>`                  | Elevated privileges           | Explain why root is needed first              |
| `chmod 777`                        | World-writable permissions    | Use minimal permissions (`644`/`755`)         |
| `DROP TABLE/DATABASE`              | Irreversible data loss        | Backup first, use transactions                |
| `TRUNCATE TABLE`                   | Clears all data               | `DELETE FROM` with `WHERE` clause             |
| `DELETE FROM` (no WHERE)           | Clears all data               | Add explicit WHERE condition                  |

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to read a file first so its contents are preserved in conversation history can unnecessarily copy sensitive file contents into model-visible context and logs. This materially increases exposure risk for secrets, proprietary code, credentials, and personal data, especially because the skill also operates around sensitive file operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.