Claw Drive

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:29 PM UTC
• Version: 0.4.4

Overview

This is a coherent personal file organizer, but it needs review because implementation flaws can exceed its intended file boundaries and may sync sensitive identity files despite privacy claims.

Install only if you are comfortable with an AI-assisted tool managing personal files, creating persistent local indexes, and optionally configuring Google Drive sync. Before enabling sync, verify the exclude list and keep identity documents out of synced paths; avoid applying migration or reindex plans unless you created and reviewed them, and confirm exact targets before deleting files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/reindex.sh:145

Finding

Crafted reindex plans can index files outside the configured drive

Content

View full analysis

Remediation

View remediation

&2 return 1 } case "$candidate" in "$drive_root"/*) ;; *) echo "Reindex path escapes drive root: $path" >&2 return 1 ;; esac ``` 3. Require the normalized relative path stored in the index to equal the path relative to the canonical drive root. 4. Reject symlink targets outside the drive. If symlinks are unnecessary, reject symlinks entirely. 5. Apply equivalent containment validation during retrieval rather than trusting paths already present in `INDEX.jsonl`. 6. Validate existing index entries before copying or sending files. 7. Add tests for absolute paths, `../` traversal, nested traversal, symlinks, and malformed reindex plans. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/migrate.sh:127

Finding

Migration source containment check can be bypassed with a final-component symlink

Content

View full analysis

&1; then echo " ❌ Unsafe source path in plan: $src_path" ((errors++)) || true continue fi local full_source="$source_dir/$src_path" local resolved_source source_root resolved_source=$(cd "$(dirname "$full_source")" 2>/dev/null && pwd -P)/$(basename "$full_source") source_root=$(cd "$source_dir" 2>/dev/null && pwd -P) if [[ "$resolved_source" != "$source_root"/* ]]; then echo " ❌ Source path escapes migration source root: $src_path" ((errors++)) || true continue fi if [[ ! -f "$resolved_source" ]]; then echo " ❌ Source missing: $src_path" ((errors++)) || true continue fi # Dedup check local existing if existing=$(dedup_check "$resolved_source"); then echo " 🔁 Duplicate (exists at $existing): $src_path" ((dupes++)) || true continue fi local dest="$CLAW_DRIVE_DIR/$category/$new_name" if [[ "$dry_run" == "true" ]]; then echo " 📄 $src_path → $category/$new_name [$tags]" else mkdir -p "$CLAW_DRIVE_DIR/$category" if ! validate_in_drive_dir "$dest"; then ((errors++)) || true continue fi cp "$resolved_source" "$dest" dedup_register "$dest" "$category/$new_name" # Update index local date_str date_str=$(date +%Y-%m-%d) index_add "$date_str" "$category/$new_name" "$description" "$tags" "migration" fi ``` ### Technical Analysis The containment check canonicalizes only the directory containing the source: ```bash cd "$(dirname "$full_source")" && pwd -P ``` It then appends the unresolved basename. If that final component is a symbolic link, the string still appears to be inside `source_root`, even when the symlink target is outside it. The subsequent `[[ -f ... ]]` test, `dedup_che ...[truncated 1553 chars]

Remediation

View remediation

&2 continue } case "$resolved_source" in "$source_root"/*) ;; *) echo "Source path escapes migration root: $src_path" >&2 continue ;; esac ``` 2. If migration does not require symlinks, explicitly reject them with `[[ -L "$source_dir/$src_path" ]]`. 3. If symlinks are supported, require their fully resolved targets to remain below the canonical migration root. 4. Open or copy files in a manner resistant to time-of-check/time-of-use replacement. At minimum, repeat containment and file-type checks immediately before copying. 5. Consider scanning with explicit symlink policy and recording canonical source identities in the generated plan. 6. Add tests covering: - A final-component symlink to an external file. - A symlinked intermediate directory. - Broken and cyclic symlinks. - Replacement of a validated file with a symlink before copying. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/config.sh:47

Finding

The documented identity-directory cloud exclusion is not enforced by code

Content

View full analysis

&1 ``` The daemon uses the same fail-open exclusion builder: ```bash local exclude_args=() mapfile -t exclude_args < <(sync_build_exclude_args_lines) fswatch -o -l "$SYNC_DEBOUNCE_SEC" \ --exclude '\.sync-state$' \ --exclude '\.sync-config$' \ --exclude '\.DS_Store$' \ "$CLAW_DRIVE_DIR" | while read -r _count; do echo "[$(date '+%H:%M:%S')] Change detected, syncing..." if rclone sync "$CLAW_DRIVE_DIR" "$remote" "${exclude_args[@]}" 2>&1; then date -u +"%Y-%m-%dT%H:%M:%SZ" > "$CLAW_DRIVE_SYNC_STATE" echo "[$(date '+%H:%M:%S')] ✅ Sync complete." else echo "[$(date '+%H:%M:%S')] ❌ Sync failed." >&2 fi done ``` ### Technical Analysis The project documentation states that files in `identity/` are “never synced.” However, `identity/` is not an uncon ...[truncated 1698 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

This variant highlights operational behaviors not prominently declared to users: background launchd daemon management, filesystem watching, and direct auth/setup flows. Undeclared long-running processes and auth configuration change the trust model and can surprise users, especially in a personal-file skill handling sensitive data.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The workflow instructs shelling out to cp and rm using path and filename placeholders derived from retrieved entries. If these values are not strictly validated and shell-escaped, an attacker-controlled index path or crafted filename could trigger unintended file overwrite/deletion or shell metacharacter abuse, and even without injection it encourages direct file operations outside the CLI's safety guarantees.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

bash

   cp ~/claw-drive/<path> ~/.openclaw/workspace/
   # send via message tool
   rm ~/.openclaw/workspace/<filename>

5. Never show raw sub-agent JSON to the user. The announce message is internal — immediately process it and deliver the file. The user should only see the file and a brief description, not search internals.
6. For multiple matches, send the most relevant one and list the rest — let the user pick

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/test.sh (reported line 282)May include surrounding context.

sh

assert_output "reject absolute category" "must not be an absolute path" bash "$CLI" store "$SRC_DIR/traversal.txt" \
  --category "/etc" --desc "test" --tags "test"
assert_output "reject .. in name" "must not contain" bash "$CLI" store "$SRC_DIR/traversal.txt" \
  --category documents --name "../../etc/passwd" --desc "test" --tags "test"
assert_output "reject / in name" "must not contain" bash "$CLI" store "$SRC_DIR/traversal.txt" \
  --category documents --name "sub/file.txt" --desc "test" --tags "test"
assert_output "reject .. in delete path" "must not contain" bash "$CLI" delete "../outside/file.txt" --force

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · test/test.sh (reported line 298)May include surrounding context.

sh

assert_output "verify catches orphan" "Orphan file" bash "$CLI" verify

# Clean up orphan
rm "$TEST_DIR/documents/orphan.txt"

# verify --fix: stale index entry (file deleted from disk manually)
echo "stale content" > "$SRC_DIR/stale.txt"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · test/test.sh (reported line 306)May include surrounding context.

sh

--category misc --desc "Stale file test" --tags "stale" --source manual
assert "stale file exists before manual delete" test -f "$TEST_DIR/misc/stale.txt"
# Manually remove from disk (bypassing claw-drive delete)
rm "$TEST_DIR/misc/stale.txt"
assert_output "verify reports missing on disk" "Missing on disk" bash "$CLI" verify
assert_output "verify --fix removes stale entry" "Fixed" bash "$CLI" verify --fix
# Confirm index entry is gone

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

md

Claw Drive is an AI-managed personal drive. It auto-categorizes your files, tags them for cross-cutting search, deduplicates by content, and retrieves them in natural language — all backed by Google Drive for cloud sync and security.

**Privacy is not a feature — it's the foundation.** Your agent never reads file contents without asking. If you don't respond, it defaults to private. Sensitive categories like `identity/` are never read, never synced. Your data stays yours.

## Features

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

md

> Policy ****3441 · 2024 Honda Civic · Effective 1/21/2026–7/21/2026
> Tags: insurance, auto, acme, honda-civic, california

If you don't reply or say it's sensitive, the agent classifies by filename only and asks for a brief description if needed. Your data is never read without consent.

### Retrieving files

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill clearly instructs reading and writing user files and index data, but it does not declare explicit tool scope or allowed tools. In an agent framework, missing scope boundaries can let the skill activate with broader filesystem access than users or orchestrators expect, increasing the blast radius of mistakes or prompt-injection-driven actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The invocation description is broad enough to trigger on ordinary file-related requests, which can cause the skill to activate in situations the user did not intend. In a skill that handles storage, copying, retrieval, and optional sync of personal documents, over-broad activation raises the chance of unauthorized file operations or accidental data disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill warns against reading file contents without consent, but then advises reading INDEX.jsonl to reuse tags. Index entries can themselves contain sensitive descriptions derived from prior files, so this creates a side channel for exposing personal data without a fresh consent check.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

**File contents are personal data. Treat them accordingly.**

- **NEVER read file contents without explicit user consent.** Always ask first. Always.
- **If the user doesn't reply → default to SENSITIVE.** Silence = no consent.
- **`identity/` files are ALWAYS sensitive** — never read, never extract, never log contents.
- **Extracted content enters the conversation transcript** which is logged permanently to `.jsonl` files. Once you read a file, its contents are in the logs forever.
- **Descriptions in INDEX.jsonl are also persistent.** Don't put sensitive details (SSNs, account numbers, passwords) in descriptions even for non-sensitive files — use redacted/partial forms (e.g. "account ending ****4321").

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The privacy section says data stays local unless sync is enabled, but the retrieval workflow explicitly copies files into another workspace path for transmission. That can mislead users about where sensitive files may be duplicated and increases exposure in logs, backups, or other tools watching the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The delete workflow documents a forceful destructive command without requiring explicit confirmation from the user at execution time. In an agent context, that creates a real risk of accidental irreversible deletion of personal records, especially when combined with broad invocation and autonomous file management.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/config.sh (reported line 19)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/config.sh (reported line 20)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/sync.sh (reported line 213)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/sync.sh (reported line 225)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/sync.sh (reported line 229)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/sync.sh (reported line 262)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/sync.sh (reported line 263)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/sync.sh (reported line 264)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/sync.sh (reported line 276)May include surrounding context.

sh

CLAW_DRIVE_SYNC_CONFIG="$CLAW_DRIVE_DIR/.sync-config"
CLAW_DRIVE_SYNC_STATE="$CLAW_DRIVE_DIR/.sync-state"
CLAW_DRIVE_LOG_DIR="$HOME/Library/Logs/claw-drive"
CLAW_DRIVE_PLIST_NAME="com.claw-drive.sync"
CLAW_DRIVE_PLIST_PATH="$HOME/Library/LaunchAgents/$CLAW_DRIVE_PLIST_NAME.plist"

CLAW_DRIVE_CATEGORIES=(

Static analysis

No suspicious patterns detected.