ClawHub
Back to skill

Security audit

Perryts

Security checks for vulnerabilities and agentic risk

Overview

The skill is documentation-only and mostly coherent, but it documents a UI testing HTTP interface that can inspect and control apps without stating access controls or production safeguards.

Install only if you are comfortable using documentation that includes powerful native-app APIs. Treat the Geisterhand UI testing server as test-only unless the Perry project separately proves it is authenticated, loopback-only, and excluded from production builds; also review generated code that uses microphone, clipboard, keychain, child_process, plugins, FFI, or automatic updates for explicit user consent and safe scoping.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
references/ui.md:238
Finding

Unauthenticated HTTP UI Testing and Control Interface

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 212)May include surrounding context.

min_sdk = 24 target_sdk = 34 keystore = "path/to/keystore" keystore_password = "@keychain/android-keystore" # Keychain reference key_alias = "release"

text

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 239)May include surrounding context.

min_sdk = 24 target_sdk = 34 keystore = "path/to/keystore" keystore_password = "@keychain/android-keystore" # Keychain reference key_alias = "release"

text

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

typescript
import { openURL, isDarkMode, getDeviceIdiom, getDeviceModel } from 'perry/system'
import { preferencesSet, preferencesGet } from 'perry/system'
import { keychainSave, keychainGet, keychainDelete } from 'perry/system'
import { notificationSend, notificationOnTap } from 'perry/system'
import { audioStart, audioStop, audioGetLevel } from 'perry/system'

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 212)May include surrounding context.

typescript
import { openURL, isDarkMode, getDeviceIdiom, getDeviceModel } from 'perry/system'
import { preferencesSet, preferencesGet } from 'perry/system'
import { keychainSave, keychainGet, keychainDelete } from 'perry/system'
import { notificationSend, notificationOnTap } from 'perry/system'
import { audioStart, audioStop, audioGetLevel } from 'perry/system'

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/plugins.md (reported line 120)May include surrounding context.

typescript
import { openURL, isDarkMode, getDeviceIdiom, getDeviceModel } from 'perry/system'
import { preferencesSet, preferencesGet } from 'perry/system'
import { keychainSave, keychainGet, keychainDelete } from 'perry/system'
import { notificationSend, notificationOnTap } from 'perry/system'
import { audioStart, audioStop, audioGetLevel } from 'perry/system'

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/system.md (reported line 8)May include surrounding context.

typescript
import { openURL, isDarkMode, getDeviceIdiom, getDeviceModel } from 'perry/system'
import { preferencesSet, preferencesGet } from 'perry/system'
import { keychainSave, keychainGet, keychainDelete } from 'perry/system'
import { notificationSend, notificationOnTap } from 'perry/system'
import { audioStart, audioStop, audioGetLevel } from 'perry/system'

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/system.md (reported line 57)May include surrounding context.

typescript
import { openURL, isDarkMode, getDeviceIdiom, getDeviceModel } from 'perry/system'
import { preferencesSet, preferencesGet } from 'perry/system'
import { keychainSave, keychainGet, keychainDelete } from 'perry/system'
import { notificationSend, notificationOnTap } from 'perry/system'
import { audioStart, audioStop, audioGetLevel } from 'perry/system'

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/system.md (reported line 58)May include surrounding context.

typescript
import { openURL, isDarkMode, getDeviceIdiom, getDeviceModel } from 'perry/system'
import { preferencesSet, preferencesGet } from 'perry/system'
import { keychainSave, keychainGet, keychainDelete } from 'perry/system'
import { notificationSend, notificationOnTap } from 'perry/system'
import { audioStart, audioStop, audioGetLevel } from 'perry/system'

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/system.md (reported line 59)May include surrounding context.

typescript
import { openURL, isDarkMode, getDeviceIdiom, getDeviceModel } from 'perry/system'
import { preferencesSet, preferencesGet } from 'perry/system'
import { keychainSave, keychainGet, keychainDelete } from 'perry/system'
import { notificationSend, notificationOnTap } from 'perry/system'
import { audioStart, audioStop, audioGetLevel } from 'perry/system'

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-reference.md (reported line 183)May include surrounding context.

category = "public.app-category.utilities" minimum_version = "13.0" # macOS deployment target signing_identity = "Developer ID Application: ..." entitlements = "path/to/entitlements.plist"

text

### [ios]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The example shows an available update being installed immediately after detection, without any user-facing confirmation, staged rollout, or safety prompt. In an auto-update context this can lead to unexpected code changes being applied at runtime and increases the blast radius of any updater compromise or operational mistake, even though the manifest signing and hashing controls reduce tampering risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/stdlib.md (reported line 22)May include surrounding context.

fetch (Built-in)

typescript
const res = await fetch('https://api.example.com/data')
const data = await res.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The Utilities table includes child_process examples such as execSync('ls') and spawn('cmd', args), which execute system commands and can affect system integrity. The document presents this capability without any cautionary note about command execution, platform effects, or safe handling of untrusted input.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes a skill focused on the Perry compiler, Perry project configuration, native UI, system APIs, threading, and related platform features. This file additionally advertises child_process support with execSync and spawn, which enables arbitrary command execution and is not clearly justified by the stated compiler/documentation purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation presents microphone/audio capture APIs without any privacy warning, permission guidance, or notice that user consent is required. In a code-assistant skill, this can normalize silent or careless collection of ambient audio and make downstream generated code more likely to omit disclosure and consent handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file includes a file system example showing writeFile('out.txt', data), which can modify user files, but the surrounding documentation does not mention that examples may write to disk or affect local data. Under the markdown-specific warning criterion, behaviors that can affect user data should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The clipboard API is documented as a simple read/write primitive without warning that writes modify the user's global system clipboard. This can lead generated applications to overwrite user clipboard contents unexpectedly, causing privacy and integrity issues even if the API itself is legitimate.

Content

No source excerpt is available for this finding.