Security audit

Clawd Presence

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local terminal status display that only stores simple configuration and status files, with no evidence of hidden network, credential, persistence, or destructive behavior.

Reasonable to install if you want a local presence display. Be aware it writes config.json and state.json in its own directory, and --auto may read local clawdbot config files to infer an agent name; avoid running ad hoc global pip installs and use a virtual environment if PyYAML is needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

Location: scripts/configure.py:167
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation
``` 2. Generate and verify cryptographic hashes, and install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Document installation inside a dedicated virtual environment rather than recommending an ad hoc global installation. 4. Use an explicitly trusted package index and consider restricting fallback indexes to reduce dependency-confusion exposure. 5. Add automated dependency scanning and a controlled update process so pinned versions continue receiving security fixes. 6. Replace the displayed command with a reference to the reviewed dependency file, for example: ```python print("PyYAML is required for auto-detection. Install the reviewed dependencies from requirements.txt.") ``` ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation instructs users to run local Python scripts that read and write configuration/state, but the skill manifest does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens reviewability and enforcement because an agent may use filesystem capabilities implicitly without an explicit contract, increasing the chance of unintended file access or modification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.