Security audit

Clawsec.Bak

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-traffic monitoring proxy, but it asks users to trust a local HTTPS interception CA and can log plaintext snippets that may contain secrets without enough scoping or cleanup guidance.

Install only if you intentionally want a local tool to decrypt and inspect AI agent HTTPS traffic. Prefer per-process trust over system-wide CA installation, avoid routing unrelated apps through it, protect or delete /tmp/clawsec logs because snippets may contain secrets, and make sure you have the missing implementation files available for review before running the documented commands.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: skill.md:70
Finding: Overprivileged HTTPS interception and plaintext logging of sensitive traffic
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
md
| `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
md
| `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
md
| `ai_api_key` | `sk-ant-*`, `sk-live-*`, `sk-gpt-*`, `sk-pro-*` | | `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 26)May include surrounding context.
md
| `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 26)May include surrounding context.
md
| `aws_access_key` | `AKIA*`, `ASIA*` (AWS access key IDs) | | `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) |

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 27)May include surrounding context.
md
| `private_key_pem` | `-----BEGIN RSA/OPENSSH/EC/DSA PRIVATE KEY-----` | | `ssh_key_file` | `.ssh/id_rsa`, `.ssh/id_ed25519`, `.ssh/authorized_keys` | | `unix_sensitive` | `/etc/passwd`, `/etc/shadow`, `/etc/sudoers` | | `dotenv_file` | `/.env`, `/.aws/credentials` | | `ssh_pubkey` | `ssh-rsa <key>` (40+ chars) | ### INJECTION patterns

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · skill.md (reported line 33)May include surrounding context.
md
### INJECTION patterns | Pattern name | What it matches | |---|---| | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` |

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · skill.md (reported line 33)May include surrounding context.
md
### INJECTION patterns | Pattern name | What it matches | |---|---| | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 36)May include surrounding context.
md
| `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` | | `ssh_key_inject` | `echo ssh-rsa` (SSH key injection attempt) | ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · skill.md (reported line 36)May include surrounding context.
md
| `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | | `shell_exec` | `bash -c "..."`, `sh -i "..."` | | `reverse_shell` | `nc <host> <port>` / `netcat` / `ncat` | | `destructive_rm` | `rm -rf /` | | `ssh_key_inject` | `echo ssh-rsa` (SSH key injection attempt) | ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 75)May include surrounding context.
bash
# macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skill.md (reported line 75)May include surrounding context.
bash
# macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill provides detailed instructions for enabling HTTPS man-in-the-middle interception and installing a locally generated root CA into the system trust store, but it does not present an explicit warning about the privacy, legal, and system-wide security consequences. Trusting a new root CA enables interception of all TLS traffic from configured processes or the whole machine, which can expose sensitive credentials and weaken transport security if misused or left installed.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill instructs use of sudo to add a generated certificate authority to the macOS system keychain. This is privileged system modification that expands trust to a new root CA and can enable interception of HTTPS traffic across the system if followed blindly.
Content: Scanner excerpt · skill.md (reported line 74)May include surrounding context.
bash
# macOS sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Copying the generated CA certificate into the system certificate store with sudo modifies global trust settings. That broadens the attack surface because any compromise or misuse of the CA key would permit transparent TLS interception for trusted applications.
Content: Scanner excerpt · skill.md (reported line 78)May include surrounding context.
md
-k /Library/Keychains/System.keychain /tmp/clawsec/ca.crt # Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt sudo update-ca-certificates # Per-process (no system trust required)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 94% confidence
Finding: Running update-ca-certificates under sudo finalizes a system-wide trust change for the generated CA. In the context of a MITM proxy, this facilitates decryption of HTTPS sessions and is risky without explicit user understanding and constrained scope.
Content: Scanner excerpt · skill.md (reported line 79)May include surrounding context.
md
# Ubuntu / Debian sudo cp /tmp/clawsec/ca.crt /usr/local/share/ca-certificates/clawsec.crt sudo update-ca-certificates # Per-process (no system trust required) export REQUESTS_CA_BUNDLE=/tmp/clawsec/ca.crt # Python requests

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 85)May include surrounding context.
export REQUESTS_CA_BUNDLE=/tmp/clawsec/ca.crt # Python requests export SSL_CERT_FILE=/tmp/clawsec/ca.crt # httpx export NODE_EXTRA_CA_CERTS=/tmp/clawsec/ca.crt # Node.js export CURL_CA_BUNDLE=/tmp/clawsec/ca.crt # curl

text
Then route agent traffic through the proxy:

Static analysis

No suspicious patterns detected.