ClawHub
Back to skill

Security audit

Netmap

Security checks for vulnerabilities and agentic risk

Overview

This local network mapping skill is mostly coherent, but it automatically sends device MAC addresses to a third-party service and allows broad scan targets without enforcing its stated local-network boundary.

Install only if you are comfortable with active network scanning and local retention of device inventory. Before using it on a work or shared network, review policy and consider disabling or removing the online MAC vendor lookup, limiting scans to your own local subnet, and avoiding watch or deep mode unless you explicitly need them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
scripts/netmap.py:58
Finding

Undisclosed Third-Party Disclosure of Device MAC Addresses

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/netmap.py:121
Finding

Unrestricted Scan Target Allows Probing of Remote or Excessively Broad Networks

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (17)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell commands, performs network scanning, and maintains a persistent local database, but it does not declare any explicit tool scope or permissions boundaries. That creates an authorization and transparency gap: an agent may execute network probing and local file writes without the skill clearly constraining or disclosing those capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states that it maintains a persistent device database containing network inventory details, but it does not present this as a clear user warning or consent-sensitive behavior. Persistently storing IPs, MACs, hostnames, vendors, labels, and timestamps can expose household or enterprise network topology and device presence over time if the machine or account is later accessed by another party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The deep scan and watch mode repeatedly probe local devices and, in the case of deep scan, perform port scanning for fingerprinting, but the skill does not clearly warn users about the visibility and privacy implications of that activity. Repeated active scanning can trigger network monitoring alerts, violate local policy expectations, or unintentionally profile devices more aggressively than a user realizes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

The code discovers nmap with 'which nmap' and falls back to invoking 'nmap' by name later, relying on the current PATH. If the tool runs in a context with a manipulated PATH, a malicious executable named nmap could be executed instead, resulting in arbitrary code execution under the user's privileges.

Content

Scanner excerpt · scripts/netmap.py (reported line 33)May include surrounding context.

python
VENDOR_CACHE_FILE = Path.home() / '.config' / 'netmap' / 'vendor_cache.json'
DB_FILE.parent.mkdir(parents=True, exist_ok=True)

NMAP_PATH = subprocess.run(['which', 'nmap'], capture_output=True, text=True).stdout.strip() or 'nmap'


def load_vendor_cache():

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill sends discovered device MAC addresses to api.macvendors.com for vendor enrichment, but the skill description presents the tool as local-network mapping and does not disclose this external data transmission. MAC addresses are persistent device identifiers, so leaking them to a third party exposes network inventory metadata and may violate user expectations or privacy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code transmits MAC addresses to an external API without any explicit warning at runtime or in the module description. Because MAC addresses identify devices on the user's network, undisclosed transmission weakens privacy and informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This line sends a discovered MAC address to a third-party service over the internet. In a network-mapping tool, that exposes sensitive inventory information outside the local environment and may breach privacy expectations or policy constraints.

Content

Scanner excerpt · scripts/netmap.py (reported line 59)May include surrounding context.

python
return cache[prefix]
    try:
        resp = urllib.request.urlopen(
            f'https://api.macvendors.com/{mac}', timeout=3
        )
        vendor = resp.read().decode('utf-8').strip()
        if vendor and 'Not Found' not in vendor:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/netmap.py (reported line 90)May include surrounding context.

python
"""Auto-detect the local network subnet (e.g. 192.168.0.0/24)."""
    try:
        # Get default gateway interface IP
        result = subprocess.run(
            ['python3', '-c',
             'import socket; s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM); '
             's.connect(("8.8.8.8",80)); print(s.getsockname()[0]); s.close()'],

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/netmap.py (reported line 106)May include surrounding context.

python
def get_arp_table():
    """Get MAC addresses from ARP cache without sudo (macOS/Linux)."""
    macs = {}
    try:
        result = subprocess.run(['/usr/sbin/arp', '-a'], capture_output=True, text=True, timeout=5)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/netmap.py (reported line 286)May include surrounding context.

python
def get_arp_table():
    """Get MAC addresses from ARP cache without sudo (macOS/Linux)."""
    macs = {}
    try:
        result = subprocess.run(['/usr/sbin/arp', '-a'], capture_output=True, text=True, timeout=5)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/netmap.py (reported line 109)May include surrounding context.

python
"""Get MAC addresses from ARP cache without sudo (macOS/Linux)."""
    macs = {}
    try:
        result = subprocess.run(['/usr/sbin/arp', '-a'], capture_output=True, text=True, timeout=5)
        out = result.stdout
    except Exception:
        try:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/netmap.py (reported line 113)May include surrounding context.

python
out = result.stdout
    except Exception:
        try:
            result = subprocess.run(['arp', '-a'], capture_output=True, text=True, timeout=5)
            out = result.stdout
        except Exception:
            return macs

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/netmap.py (reported line 137)May include surrounding context.

python
'--host-timeout', '15s',
        subnet
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Deep mode performs active port scans against each discovered host, which goes beyond simple device listing and may trigger IDS alerts, violate policy, or probe services users did not intend to touch. In the context of a home/office inventory skill, this additional behavior increases operational risk unless it is prominently disclosed and explicitly requested.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/netmap.py (reported line 144)May include surrounding context.

python
def run_nmap_ports(ip):
    """Quick port scan to fingerprint device type."""
    try:
        result = subprocess.run(
            [NMAP_PATH, '-F', '--open', '-oX', '-', '--host-timeout', '10s', ip],
            capture_output=True, text=True, timeout=20
        )

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The tool persistently stores a device inventory including IPs, MACs, hostnames, labels, and timestamps in the user's home directory, but this retention is not clearly disclosed in the command description. Persistent network inventory can be sensitive on shared systems or if local files are later exposed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Subnet autodetection opens a socket to 8.8.8.8 to infer the local source IP, which creates outbound internet traffic despite the tool being described as local-network scanning. Even if no payload is sent beyond connection setup, this can surprise users in restricted environments and leak metadata about tool use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.