T05 · Unauthorized Access and Privilege Escalation
Error
- Location
wyoming_clawdbot.py:66- Finding
Unauthenticated Network Exposure of the Clawdbot Agent
- Content
View full analysis
- Remediation
View remediation
Security audit
Wyoming Clawdbot
Security checks for vulnerabilities and agentic risk
Overview
This bridge is purpose-aligned, but its default deployment exposes a Clawdbot-powered voice service too broadly and handles sensitive voice data with weak containment.
Review this before installing on a real Home Assistant network. Prefer binding the service to `127.0.0.1` or a trusted interface, restrict the port with a firewall, use a dedicated least-privileged Clawdbot account/config, make any config mount read-only and narrow, avoid host networking where possible, remove transcript and response body logging, and pin dependencies. Do not expose this service to untrusted LANs or the internet without authentication.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
docker-compose.yml:7- Finding
Excessive Container Access Through Host Networking and Sensitive Read-Write Mount
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
wyoming_clawdbot.py:69- Finding
Voice Transcripts and AI Responses Written to Plaintext Logs
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded and Unhashed Third-Party Dependency
- Content
View full analysis
=1.5.0 ``` The documented installation command at `README.md:57` consumes this requirement directly: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement specifies only a minimum version. Consequently, any future `wyoming` release satisfying `>=1.5.0` may be selected at installation time. No lock file or package hash is provided to verify that the installed artifact is the exact version reviewed and tested by the project. This does not demonstrate that the current `wyoming` package is malicious. The security weakness is that future builds are non-reproducible and may silently consume a compromised, malicious, or incompatible future release. Python package installation and imported package execution occur with the privileges of the user or container running the installation and service. In the documented container configuration, a compromised dependency may also gain access to the mounted Clawdbot configuration and host network. ### Attack Path 1. A future, compromised, or otherwise unsafe release of `wyoming` is published and satisfies the `>=1.5.0` constraint. 2. An operator follows the documented installation command or rebuilds the container. 3. `pip` resolves and downloads the newer release because no exact version is pinned. 4. No expected hash is available to detect that the artifact differs from the reviewed dependency. 5. Package installation or later import/runtime behavior executes the changed dependency code. 6. The dependency receives the same filesystem and network access as the bridge process. ### Impact Assessment A compromised dependency could execute arbitrary Python code with the privileges and access of the bridge service. Potential scope includes: - Reading or modifying files acc ...[truncated 378 chars]- Remediation
View remediation
``` 2. Generate and commit a lock file containing all transitive dependencies. 3. Record cryptographic hashes and install with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 4. Review dependency updates before changing the lock file. 5. Use automated vulnerability and supply-chain scanning for direct and transitive packages. 6. Build artifacts in a controlled environment and retain a software bill of materials. 7. Avoid running dependency installation with unnecessary root or host privileges. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (11)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly states that spoken user input is sent from Home Assistant through this bridge to Clawdbot, but it does not warn users that voice transcripts and potentially sensitive household commands may leave the local Home Assistant environment and be processed by a third-party AI service. In a voice-assistant context, this omission is security-relevant because users may reasonably assume local handling unless data-sharing and retention are clearly disclosed.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Then:
bash sudo systemctl daemon-reload sudo systemctl enable wyoming-clawdbot sudo systemctl start wyoming-clawdbot
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Then:
bash sudo systemctl daemon-reload sudo systemctl enable wyoming-clawdbot sudo systemctl start wyoming-clawdbot
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Then:
bash sudo systemctl daemon-reload sudo systemctl enable wyoming-clawdbot sudo systemctl start wyoming-clawdbot
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash sudo systemctl daemon-reload sudo systemctl enable wyoming-clawdbot sudo systemctl start wyoming-clawdbot
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises shell-based setup and operation behavior but does not declare any explicit tool scope or permissions boundary in the skill metadata. This creates ambiguity about what code-execution capabilities are required and increases the risk of over-privileged execution or unexpected command use when the skill is consumed by an agent framework.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly states that voice commands are forwarded from Home Assistant to Clawdbot, but it does not warn users that spoken content may be transmitted to another service or process. Voice input can contain sensitive household, personal, or authentication-related information, so undisclosed forwarding creates a meaningful privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The service logs full transcript contents at INFO level, which can capture sensitive voice data such as passwords, names, addresses, or private conversations in plaintext logs. In a Home Assistant voice-assistant context, this is more dangerous because transcripts may routinely contain highly personal household data and logs are often retained, aggregated, or exposed to administrators and support tooling.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a Wyoming Protocol bridge for Home Assistant voice assistant integration, which implies protocol translation and request forwarding behavior. This code additionally spawns the local
clawdbotexecutable viaasyncio.create_subprocess_exec, introducing process-execution capability that is not explicitly justified by the bridge description itself.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with only a lower bound (wyoming>=1.5.0), which allows installation of any newer version, including breaking or compromised releases. This weakens supply-chain integrity and reproducibility because builds may resolve to different versions over time, increasing the chance of unexpected vulnerable or malicious code being pulled in.
- Content
text wyoming>=1.5.0
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The hardcoded error prefix "Ошибка" makes at least one user-visible response Russian regardless of the user's preferred language. This is a natural-language locale policy issue because the skill otherwise presents itself as multilingual and does not document or request a Russian-only error mode.
- Content
Static analysis
No suspicious patterns detected.