Claw Drive

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:29 PM UTC
• Version: 0.4.4

Overview

This is a coherent personal file organizer, but it needs review because implementation flaws can exceed its intended file boundaries and may sync sensitive identity files despite privacy claims.

Install only if you are comfortable with an AI-assisted tool managing personal files, creating persistent local indexes, and optionally configuring Google Drive sync. Before enabling sync, verify the exclude list and keep identity documents out of synced paths; avoid applying migration or reindex plans unless you created and reviewed them, and confirm exact targets before deleting files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/reindex.sh:145
• Finding: Crafted reindex plans can index files outside the configured drive<![CDATA[ ## Vulnerability Details **File Location**: `lib/reindex.sh:145-193` **Vulnerability Type**: Unvalidated path traversal in reindex plan processing **Risk Level**: High ### Vulnerable Code ```bash local skip desc tags source path skip=$(jq -r ".orphans[$i].skip // false" "$plan") path=$(jq -r ".orphans[$i].path" "$plan") if [[ "$skip" == "true" ]]; then echo " ⏭️ Skip: $path" ((skipped++)) || true ((i++)) || true continue fi desc=$(jq -r ".orphans[$i].desc // \"\"" "$plan") tags=$(jq -r ".orphans[$i].tags // [] | join(\",\")" "$plan") source=$(jq -r ".orphans[$i].source // \"reindex\"" "$plan") local metadata_json correspondent_val metadata_json=$(jq -c ".orphans[$i].metadata // null" "$plan") correspondent_val=$(jq -r ".orphans[$i].correspondent // \"\"" "$plan") if [[ -z "$desc" ]]; then echo " ⚠️ No description for orphan: $path (skipping)" ((skipped++)) || true ((i++)) || true continue fi local date_str date_str=$(jq -r ".orphans[$i].modified // \"$(date +%Y-%m-%d)\"" "$plan") local meta_arg="" [[ "$metadata_json" != "null" ]] && meta_arg="$metadata_json" if [[ "$dry_run" == "true" ]]; then echo " ➕ Would add: $path" echo " desc: $desc" echo " tags: $tags" [[ -n "$meta_arg" ]] && echo " metadata: $meta_arg" [[ -n "$correspondent_val" ]] && echo " correspondent: $correspondent_val" else # Add to index index_add "$date_str" "$path" "$desc" "$tags" "$source" "$meta_arg" "" "$correspondent_val" # Register hash local full="$CLAW_DRIVE_DIR/$path" if [[ -f "$full" ]]; then dedup_register "$full" "$path" fi echo " ✅ Added: $path" fi ``` ### Technical Analysis `reindex_apply` treats `orphans[].path` from the supplied JSON plan as trusted. It does not reject absolute paths or traversal components such as `..`, canonicalize the resulting path, or verify that the final file remains beneath `CLAW_DRIVE_DIR`. For example, the plan value `../../.ssh/id_rsa` causes: ```bash local full= ...[truncated 1932 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject absolute paths, empty components, `.` and `..` components, control characters, and paths beginning with `~`. 2. Canonicalize the complete candidate path before any index or hash operation: ```bash drive_root=$(realpath "$CLAW_DRIVE_DIR") || return 1 candidate=$(realpath "$CLAW_DRIVE_DIR/$path") || { echo "Unsafe or missing reindex path: $path" >&2 return 1 } case "$candidate" in "$drive_root"/*) ;; *) echo "Reindex path escapes drive root: $path" >&2 return 1 ;; esac ``` 3. Require the normalized relative path stored in the index to equal the path relative to the canonical drive root. 4. Reject symlink targets outside the drive. If symlinks are unnecessary, reject symlinks entirely. 5. Apply equivalent containment validation during retrieval rather than trusting paths already present in `INDEX.jsonl`. 6. Validate existing index entries before copying or sending files. 7. Add tests for absolute paths, `../` traversal, nested traversal, symlinks, and malformed reindex plans. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/migrate.sh:127
• Finding: Migration source containment check can be bypassed with a final-component symlink<![CDATA[ ## Vulnerability Details **File Location**: `lib/migrate.sh:127-170` **Vulnerability Type**: Incomplete canonicalization and symlink-based path escape **Risk Level**: High ### Vulnerable Code ```bash # Validate source path from plan: must stay within source_dir if ! validate_path_component "source_path" "$src_path" 2>&1; then echo " ❌ Unsafe source path in plan: $src_path" ((errors++)) || true continue fi local full_source="$source_dir/$src_path" local resolved_source source_root resolved_source=$(cd "$(dirname "$full_source")" 2>/dev/null && pwd -P)/$(basename "$full_source") source_root=$(cd "$source_dir" 2>/dev/null && pwd -P) if [[ "$resolved_source" != "$source_root"/* ]]; then echo " ❌ Source path escapes migration source root: $src_path" ((errors++)) || true continue fi if [[ ! -f "$resolved_source" ]]; then echo " ❌ Source missing: $src_path" ((errors++)) || true continue fi # Dedup check local existing if existing=$(dedup_check "$resolved_source"); then echo " 🔁 Duplicate (exists at $existing): $src_path" ((dupes++)) || true continue fi local dest="$CLAW_DRIVE_DIR/$category/$new_name" if [[ "$dry_run" == "true" ]]; then echo " 📄 $src_path → $category/$new_name [$tags]" else mkdir -p "$CLAW_DRIVE_DIR/$category" if ! validate_in_drive_dir "$dest"; then ((errors++)) || true continue fi cp "$resolved_source" "$dest" dedup_register "$dest" "$category/$new_name" # Update index local date_str date_str=$(date +%Y-%m-%d) index_add "$date_str" "$category/$new_name" "$description" "$tags" "migration" fi ``` ### Technical Analysis The containment check canonicalizes only the directory containing the source: ```bash cd "$(dirname "$full_source")" && pwd -P ``` It then appends the unresolved basename. If that final component is a symbolic link, the string still appears to be inside `source_root`, even when the symlink target is outside it. The subsequent `[[ -f ... ]]` test, `dedup_che ...[truncated 1553 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the complete source path, including the final component: ```bash source_root=$(realpath "$source_dir") || return 1 resolved_source=$(realpath "$source_dir/$src_path") || { echo "Unable to resolve migration source: $src_path" >&2 continue } case "$resolved_source" in "$source_root"/*) ;; *) echo "Source path escapes migration root: $src_path" >&2 continue ;; esac ``` 2. If migration does not require symlinks, explicitly reject them with `[[ -L "$source_dir/$src_path" ]]`. 3. If symlinks are supported, require their fully resolved targets to remain below the canonical migration root. 4. Open or copy files in a manner resistant to time-of-check/time-of-use replacement. At minimum, repeat containment and file-type checks immediately before copying. 5. Consider scanning with explicit symlink policy and recording canonical source identities in the generated plan. 6. Add tests covering: - A final-component symlink to an external file. - A symlinked intermediate directory. - Broken and cyclic symlinks. - Replacement of a validated file with a symlink before copying. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/config.sh:47
• Finding: The documented identity-directory cloud exclusion is not enforced by code<![CDATA[ ## Vulnerability Details **File Location**: `lib/config.sh:47-63`; synchronization sinks at `lib/sync.sh:163-175` and `lib/sync.sh:182-202` **Vulnerability Type**: Fail-open privacy configuration **Risk Level**: Medium ### Vulnerable Code ```bash # Parse sync config: get exclude list sync_config_excludes() { if [[ -f "$CLAW_DRIVE_SYNC_CONFIG" ]]; then sed -n '/^exclude:/,/^[^ -]/p' "$CLAW_DRIVE_SYNC_CONFIG" | grep -E '^\s*-' | sed 's/^[[:space:]]*-[[:space:]]*//' fi } # Build rclone exclude arguments from sync config as a safe array. # Output format: one arg per line ("--exclude" then pattern), for mapfile consumption. sync_build_exclude_args_lines() { while IFS= read -r pattern; do [[ -n "$pattern" ]] || continue printf '%s\n' "--exclude" "$pattern" done < <(sync_config_excludes) # Always exclude internal state files printf '%s\n' "--exclude" ".sync-config" "--exclude" ".sync-state" } ``` The resulting arguments are passed directly to rclone: ```bash local exclude_args=() mapfile -t exclude_args < <(sync_build_exclude_args_lines) echo "📤 Syncing $CLAW_DRIVE_DIR → $remote ..." rclone sync "$CLAW_DRIVE_DIR" "$remote" "${exclude_args[@]}" --verbose 2>&1 ``` The daemon uses the same fail-open exclusion builder: ```bash local exclude_args=() mapfile -t exclude_args < <(sync_build_exclude_args_lines) fswatch -o -l "$SYNC_DEBOUNCE_SEC" \ --exclude '\.sync-state$' \ --exclude '\.sync-config$' \ --exclude '\.DS_Store$' \ "$CLAW_DRIVE_DIR" | while read -r _count; do echo "[$(date '+%H:%M:%S')] Change detected, syncing..." if rclone sync "$CLAW_DRIVE_DIR" "$remote" "${exclude_args[@]}" 2>&1; then date -u +"%Y-%m-%dT%H:%M:%SZ" > "$CLAW_DRIVE_SYNC_STATE" echo "[$(date '+%H:%M:%S')] ✅ Sync complete." else echo "[$(date '+%H:%M:%S')] ❌ Sync failed." >&2 fi done ``` ### Technical Analysis The project documentation states that files in `identity/` are “never synced.” However, `identity/` is not an uncon ...[truncated 1698 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add an unconditional identity exclusion independently of user configuration: ```bash sync_build_exclude_args_lines() { printf '%s\n' "--exclude" "/identity/**" while IFS= read -r pattern; do [[ -n "$pattern" ]] || continue printf '%s\n' "--exclude" "$pattern" done < <(sync_config_excludes) printf '%s\n' \ "--exclude" ".sync-config" \ "--exclude" ".sync-state" } ``` 2. Use an rclone pattern confirmed to exclude the directory itself and all descendants across supported backends. 3. Make synchronization fail closed when `.sync-config` is malformed or cannot be parsed. 4. Before every push or daemon launch, verify that mandatory exclusions are active and display them to the user. 5. If overriding identity exclusion is a supported feature, require a separate explicit option with a prominent warning and confirmation rather than allowing ordinary configuration edits to disable it. 6. Update documentation if `identity/` is only excluded by default rather than guaranteed never to synchronize. 7. Add tests for missing configuration, an empty exclusion list, malformed YAML-like content, an omitted identity rule, and adversarial patterns. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
   cp ~/claw-drive/<path> ~/.openclaw/workspace/
   # send via message tool
   rm ~/.openclaw/workspace/<filename>
   ```
5. **Never show raw sub-agent JSON to the user.** The announce message is internal — immediately process it and deliver the file. The user should only see the file and a brief description, not search internals.
6. For multiple matches, send the most relevant one and list the rest — let the user pick

• Confidence: 93% confidence
• Finding: The workflow instructs shelling out to `cp` and `rm` using path and filename placeholders derived from retrieved entries. If these values are not strictly validated and shell-escaped, an attacker-controlled index path or crafted filename could trigger unintended file overwrite/deletion or shell metacharacter abuse, and even without injection it encourages direct file operations outside the CLI's safety guarantees.

Credential Access

High

• Category: Privilege Escalation

Content

assert_output "reject absolute category" "must not be an absolute path" bash "$CLI" store "$SRC_DIR/traversal.txt" \
  --category "/etc" --desc "test" --tags "test"
assert_output "reject .. in name" "must not contain" bash "$CLI" store "$SRC_DIR/traversal.txt" \
  --category documents --name "../../etc/passwd" --desc "test" --tags "test"
assert_output "reject / in name" "must not contain" bash "$CLI" store "$SRC_DIR/traversal.txt" \
  --category documents --name "sub/file.txt" --desc "test" --tags "test"
assert_output "reject .. in delete path" "must not contain" bash "$CLI" delete "../outside/file.txt" --force

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

assert_output "verify catches orphan" "Orphan file" bash "$CLI" verify

# Clean up orphan
rm "$TEST_DIR/documents/orphan.txt"

# verify --fix: stale index entry (file deleted from disk manually)
echo "stale content" > "$SRC_DIR/stale.txt"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

--category misc --desc "Stale file test" --tags "stale" --source manual
assert "stale file exists before manual delete" test -f "$TEST_DIR/misc/stale.txt"
# Manually remove from disk (bypassing claw-drive delete)
rm "$TEST_DIR/misc/stale.txt"
assert_output "verify reports missing on disk" "Missing on disk" bash "$CLI" verify
assert_output "verify --fix removes stale entry" "Fixed" bash "$CLI" verify --fix
# Confirm index entry is gone

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Claw Drive is an AI-managed personal drive. It auto-categorizes your files, tags them for cross-cutting search, deduplicates by content, and retrieves them in natural language — all backed by Google Drive for cloud sync and security.

**Privacy is not a feature — it's the foundation.** Your agent never reads file contents without asking. If you don't respond, it defaults to private. Sensitive categories like `identity/` are never read, never synced. Your data stays yours.

## Features

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

> Policy ****3441 · 2024 Honda Civic · Effective 1/21/2026–7/21/2026
> Tags: insurance, auto, acme, honda-civic, california

If you don't reply or say it's sensitive, the agent classifies by filename only and asks for a brief description if needed. Your data is never read without consent.

### Retrieving files

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill clearly instructs reading and writing user files and index data, but it does not declare explicit tool scope or allowed tools. In an agent framework, missing scope boundaries can let the skill activate with broader filesystem access than users or orchestrators expect, increasing the blast radius of mistakes or prompt-injection-driven actions.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The invocation description is broad enough to trigger on ordinary file-related requests, which can cause the skill to activate in situations the user did not intend. In a skill that handles storage, copying, retrieval, and optional sync of personal documents, over-broad activation raises the chance of unauthorized file operations or accidental data disclosure.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The skill warns against reading file contents without consent, but then advises reading INDEX.jsonl to reuse tags. Index entries can themselves contain sensitive descriptions derived from prior files, so this creates a side channel for exposing personal data without a fresh consent check.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**File contents are personal data. Treat them accordingly.**

- **NEVER read file contents without explicit user consent.** Always ask first. Always.
- **If the user doesn't reply → default to SENSITIVE.** Silence = no consent.
- **`identity/` files are ALWAYS sensitive** — never read, never extract, never log contents.
- **Extracted content enters the conversation transcript** which is logged permanently to `.jsonl` files. Once you read a file, its contents are in the logs forever.
- **Descriptions in INDEX.jsonl are also persistent.** Don't put sensitive details (SSNs, account numbers, passwords) in descriptions even for non-sensitive files — use redacted/partial forms (e.g. "account ending ****4321").

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The privacy section says data stays local unless sync is enabled, but the retrieval workflow explicitly copies files into another workspace path for transmission. That can mislead users about where sensitive files may be duplicated and increases exposure in logs, backups, or other tools watching the workspace.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The delete workflow documents a forceful destructive command without requiring explicit confirmation from the user at execution time. In an agent context, that creates a real risk of accidental irreversible deletion of personal records, especially when combined with broad invocation and autonomous file management.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.