ClawHub
Back to skill

Security audit

Agent Trace Audit（智能体行为留痕审计）

Security checks for vulnerabilities and agentic risk

Overview

This local audit tool can report no unauthorized writes even when its input contains them.

Review before relying on this skill for compliance or permission checks: a clean result does not establish that actions were authorized. Use explicitly selected, redacted log files and avoid symlinks. The working command requires scripts/trace_audit.py --log; several documented options are unavailable. The scanner's missing-path and image exclusions were investigated, with no additional executable payload found.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

The auditor flags only ungated actions containing the Chinese character “写”, rather than all operations that bypassed the gate.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The auditor detects a violation only when the action contains the Chinese character “写” and the gate matches one of three specific values. Ungated actions such as “write”, “delete”, or “execute”, as well as failed gates represented by values such as false or “denied”, can escape detection and produce a misleading clean report. This is particularly consequential for an audit skill whose stated purpose is to identify gate bypasses, although the code does not itself authorize or execute those operations.

Content

No source excerpt is available for this finding.