Claw Audit

{
  "meta": {
    "document_id": "ssds:auto:claw-audit:1.1.0",
    "ssds_version": "0.2.0",
    "scanner_version": "0.4.0+fe6fd9123d50",
    "created_at": "2026-03-05T14:18:53.902Z",
    "created_by": {
      "agent": "safeagentskills-cli/generate-ssds"
    },
    "language": "en",
    "notes": "Auto-generated SSDS. Manual review recommended."
  },
  "skill": {
    "name": "Claw Audit",
    "version": "1.1.0",
    "format": "agent_skill",
    "description": "Security scanner and hardening tool for OpenClaw. Use when the user asks about security, wants to scan installed skills for malware or vulnerabilities, audit their OpenClaw configuration, check their security score, or harden their setup. Also triggers on keywords like \"scan\", \"audit\", \"secure\", \"vulnerability\", \"malware\", \"safe\", \"hardening\", \"security score\".",
    "publisher": "unknown",
    "source": {
      "channel": "local"
    },
    "artifact": {
      "sha256": "84ef37d0a018c94aa8ae8143d305bda9fc0573c3acf1af89adeca7502477332e",
      "hash_method": "files_sorted"
    }
  },
  "capabilities": {
    "execution": {
      "can_exec_shell": true,
      "can_exec_code": true,
      "privilege_level": "admin",
      "can_install_deps": false,
      "can_persist": true
    },
    "filesystem": {
      "reads_workspace": true,
      "reads_user_home": true,
      "reads_system": false,
      "writes_workspace": true,
      "writes_user_home": true,
      "writes_system": true,
      "can_delete": true
    },
    "network": {
      "egress": "any",
      "ingress": false
    },
    "credentials": {
      "reads_env_vars": true,
      "reads_credential_files": true,
      "reads_browser_data": true,
      "reads_keychain": false
    },
    "services": [],
    "actions": {
      "can_send_messages": false,
      "can_post_public": false,
      "can_purchase": false,
      "can_transfer_money": false,
      "can_deploy": false,
      "can_delete_external": false
    },
    "prompt_injection_surfaces": [
      "web",
      "documents"
    ],
    "content_types": [
      "general"
    ]
  },
  "hazards": {
    "hdac": {
      "H": 4,
      "D": 4,
      "A": 1,
      "C": 1
    },
    "flags": [
      "EXEC",
      "CODE_EXEC",
      "PRIVILEGED",
      "PERSISTENCE",
      "FS_READ_WORKSPACE",
      "FS_READ_USER",
      "FS_WRITE_WORKSPACE",
      "FS_WRITE_USER",
      "FS_WRITE_SYSTEM",
      "FS_DELETE",
      "NET_EGRESS_ANY",
      "CREDS_ENV",
      "CREDS_FILES",
      "CREDS_BROWSER",
      "PI_WEB",
      "PI_DOCUMENTS"
    ],
    "custom_flags": [
      {
        "code": "PIPE_TO_SHELL",
        "name": "Pipe to Shell",
        "description": "Downloads and executes remote code (curl|bash pattern) in: README.md, tests/audit-config.test.mjs, tests/scan.test.mjs"
      },
      {
        "code": "BASE64_EXEC",
        "name": "Base64 Execute",
        "description": "Decodes and executes obfuscated code in: tests/audit-config.test.mjs, tests/scan.test.mjs"
      },
      {
        "code": "CRED_SSH",
        "name": "SSH Key Access",
        "description": "Accesses SSH keys in: README.md, scripts/audit-system-full-async.mjs, scripts/audit-system.mjs, scripts/calculate-score.mjs, tests/audit-system.test.mjs, tests/scan.test.mjs"
      },
      {
        "code": "PROMPT_INJECTION",
        "name": "Prompt Injection Risk",
        "description": "Contains prompt injection patterns in: package.json, README.md, SKILL.md, tests/audit-system.test.mjs, tests/performance-test.sh, tests/scan.test.mjs"
      },
      {
        "code": "PERSISTENCE",
        "name": "Persistence Mechanism",
        "description": "Creates scheduled tasks or startup entries in: scripts/audit-system-full-async.mjs, scripts/audit-system.mjs, scripts/calculate-score.mjs, tests/audit-system.test.mjs, scripts/audit-system-async.mjs"
      },
      {
        "code": "PRIVILEGE_ESCALATION",
        "name": "Privilege Escalation",
        "description": "Uses elevated privileges (sudo/root) in: scripts/audit-config-optimized.mjs, scripts/audit-config.mjs, scripts/audit-system-async.mjs, scripts/audit-system-full-async.mjs, scripts/audit-system.mjs, scripts/auto-fix.mjs, scripts/scan-skills.sh, tests/audit-system-cis.test.mjs, tests/audit-system.test.mjs"
      },
      {
        "code": "FILE_DELETE",
        "name": "File Deletion",
        "description": "Can delete files in: README.md, scripts/audit-config-optimized.mjs, scripts/audit-config.mjs, tests/audit-config.test.mjs, tests/scan.test.mjs"
      },
      {
        "code": "TOOL_ABUSE",
        "name": "Unauthorized Tool Use",
        "description": "INSTRUCTED_BINARY_INSTALL, MCP_SYS_FILE_DESTRUCTION, TOOL_ABUSE_SYSTEM_MODIFICATION, MCP_SYS_PERMISSION_MANIPULATION, MCP_SYS_CRITICAL_ACCESS: Instructs agent to install external binary or package"
      },
      {
        "code": "SOCIAL_ENGINEERING",
        "name": "Social Engineering Risk",
        "description": "SOCIAL_ENG_VAGUE_DESCRIPTION: Skill description is too vague or missing"
      },
      {
        "code": "COMMAND_INJECTION",
        "name": "Command Injection Risk",
        "description": "MCP_CMD_NETWORK_TOOLS, COMMAND_INJECTION_EVAL, COMMAND_INJECTION_USER_INPUT, MCP_CMD_REVERSE_SHELL: Network reconnaissance or terminal manipulation tools"
      },
      {
        "code": "TOOL_POISONING",
        "name": "Tool Poisoning",
        "description": "Hidden secondary behavior detected: MCP_TOOL_POISONING_SENSITIVE_DATA"
      }
    ],
    "confidence": {
      "level": "medium",
      "basis": [
        "static_analysis"
      ],
      "notes": "Detected 11 security patterns (34 vendored rule hits). Review recommended."
    },
    "rationale": {
      "H": "H4: Critical: Privilege escalation or malware detected",
      "D": "D4: Critical: Credential theft or data exfiltration",
      "A": "A1: Local side effects only",
      "C": "C1: General content"
    }
  },
  "containment": {
    "level": "maximum",
    "required": [
      {
        "control": "SANDBOX_CONTAINER",
        "reason": "Code execution capability"
      }
    ],
    "recommended": [
      {
        "control": "LOG_ACTIONS",
        "reason": "Audit trail for all actions"
      }
    ],
    "uncontained_risk": "Risk level depends on manual review of actual capabilities."
  },
  "risks": {
    "risks": [
      {
        "risk": "Pipe-to-shell pattern detected (curl|bash) in: README.md, tests/audit-config.test.mjs, tests/scan.test.mjs",
        "severity": "critical",
        "mitigation": "Do not execute. Review source for malicious intent."
      },
      {
        "risk": "Base64 decode + execute pattern in: tests/audit-config.test.mjs, tests/scan.test.mjs",
        "severity": "critical",
        "mitigation": "Decode and review obfuscated content before use."
      },
      {
        "risk": "SSH key access patterns in: README.md, scripts/audit-system-full-async.mjs, scripts/audit-system.mjs, scripts/calculate-score.mjs, tests/audit-system.test.mjs, tests/scan.test.mjs",
        "severity": "high",
        "mitigation": "Verify legitimate need for SSH access. Consider sandboxing."
      },
      {
        "risk": "Prompt injection patterns detected in: package.json, README.md, SKILL.md, tests/audit-system.test.mjs, tests/performance-test.sh, tests/scan.test.mjs",
        "severity": "high",
        "mitigation": "Review SKILL.md for hidden instructions. Do not use with untrusted input."
      },
      {
        "risk": "Unauthorized tool use: INSTRUCTED_BINARY_INSTALL, MCP_SYS_FILE_DESTRUCTION, TOOL_ABUSE_SYSTEM_MODIFICATION, MCP_SYS_PERMISSION_MANIPULATION, MCP_SYS_CRITICAL_ACCESS",
        "severity": "critical",
        "mitigation": "Avoid instructing agents to install arbitrary binaries; bundle dependencies or use sandboxed environments"
      },
      {
        "risk": "Command injection risk: MCP_CMD_NETWORK_TOOLS, COMMAND_INJECTION_EVAL, COMMAND_INJECTION_USER_INPUT, MCP_CMD_REVERSE_SHELL",
        "severity": "critical",
        "mitigation": "Remove network scanning tools and terminal manipulation sequences."
      },
      {
        "risk": "Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION",
        "severity": "low",
        "mitigation": "Provide clear, detailed description of skill functionality"
      },
      {
        "risk": "Tool poisoning: hidden behaviors detected (MCP_TOOL_POISONING_SENSITIVE_DATA)",
        "severity": "high",
        "mitigation": "Remove references to sensitive data collection."
      }
    ],
    "limitations": [
      "Static analysis only - runtime behavior not verified"
    ]
  },
  "incident_response": {
    "kill_switch": [
      "Stop the agent process"
    ],
    "containment": [
      "Review logs for unexpected actions"
    ],
    "recovery": [
      "Depends on skill capabilities"
    ]
  },
  "evidence": [
    {
      "evidence_id": "EV:file-1",
      "type": "file_excerpt",
      "title": "package.json",
      "file_path": "package.json"
    },
    {
      "evidence_id": "EV:file-2",
      "type": "file_excerpt",
      "title": "README.md",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:file-3",
      "type": "file_excerpt",
      "title": "scripts/audit-config-optimized.mjs",
      "file_path": "scripts/audit-config-optimized.mjs"
    },
    {
      "evidence_id": "EV:file-4",
      "type": "file_excerpt",
      "title": "scripts/audit-config.mjs",
      "file_path": "scripts/audit-config.mjs"
    },
    {
      "evidence_id": "EV:file-5",
      "type": "file_excerpt",
      "title": "scripts/audit-system-async.mjs",
      "file_path": "scripts/audit-system-async.mjs"
    },
    {
      "evidence_id": "EV:file-6",
      "type": "file_excerpt",
      "title": "scripts/audit-system-full-async.mjs",
      "file_path": "scripts/audit-system-full-async.mjs"
    },
    {
      "evidence_id": "EV:file-7",
      "type": "file_excerpt",
      "title": "scripts/audit-system.mjs",
      "file_path": "scripts/audit-system.mjs"
    },
    {
      "evidence_id": "EV:file-8",
      "type": "file_excerpt",
      "title": "scripts/auto-fix.mjs",
      "file_path": "scripts/auto-fix.mjs"
    },
    {
      "evidence_id": "EV:file-9",
      "type": "file_excerpt",
      "title": "scripts/calculate-score.mjs",
      "file_path": "scripts/calculate-score.mjs"
    },
    {
      "evidence_id": "EV:file-10",
      "type": "file_excerpt",
      "title": "scripts/check-integrity.mjs",
      "file_path": "scripts/check-integrity.mjs"
    },
    {
      "evidence_id": "EV:cisco-1",
      "type": "file_excerpt",
      "title": "PROMPT_INJECTION_IGNORE_INSTRUCTIONS [HIGH] README.md:57: | CRIT-004 | Prompt injection | \"ignore previous instructions\" |",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-2",
      "type": "file_excerpt",
      "title": "INSTRUCTED_BINARY_INSTALL [HIGH] README.md:54: | CRIT-001 | Shell execution | `curl ... \\| bash`, `eval()` |",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-3",
      "type": "file_excerpt",
      "title": "MCP_CMD_NETWORK_TOOLS [HIGH] README.md:56: | CRIT-003 | Reverse shell | `nc -l`, `/dev/tcp/` |",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-4",
      "type": "file_excerpt",
      "title": "MCP_SYS_FILE_DESTRUCTION [CRITICAL] README.md:77: | WARN-020 | Dangerous pattern in cron job (curl\\|bash, eval, rm -rf) |",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-5",
      "type": "file_excerpt",
      "title": "COMMAND_INJECTION_EVAL [CRITICAL] scripts/audit-config-optimized.mjs:303: { pattern: /eval\\s*\\(/i,                label: \"eval() call\" },",
      "file_path": "scripts/audit-config-optimized.mjs"
    },
    {
      "evidence_id": "EV:cisco-6",
      "type": "file_excerpt",
      "title": "TOOL_ABUSE_SYSTEM_MODIFICATION [CRITICAL] scripts/audit-config-optimized.mjs:226: `chmod 600 ${f}`",
      "file_path": "scripts/audit-config-optimized.mjs"
    },
    {
      "evidence_id": "EV:cisco-7",
      "type": "file_excerpt",
      "title": "MCP_SYS_FILE_DESTRUCTION [CRITICAL] scripts/audit-config-optimized.mjs:305: { pattern: /rm\\s+-rf\\s+\\//,             label: \"destructive rm -rf /\" },",
      "file_path": "scripts/audit-config-optimized.mjs"
    },
    {
      "evidence_id": "EV:cisco-8",
      "type": "file_excerpt",
      "title": "COMMAND_INJECTION_EVAL [CRITICAL] scripts/audit-config.mjs:287: { pattern: /eval\\s*\\(/i,                label: \"eval() call\" },",
      "file_path": "scripts/audit-config.mjs"
    },
    {
      "evidence_id": "EV:cisco-9",
      "type": "file_excerpt",
      "title": "TOOL_ABUSE_SYSTEM_MODIFICATION [CRITICAL] scripts/audit-config.mjs:211: `chmod 600 ${f}`",
      "file_path": "scripts/audit-config.mjs"
    },
    {
      "evidence_id": "EV:cisco-10",
      "type": "file_excerpt",
      "title": "MCP_SYS_FILE_DESTRUCTION [CRITICAL] scripts/audit-config.mjs:289: { pattern: /rm\\s+-rf\\s+\\//,             label: \"destructive rm -rf /\" },",
      "file_path": "scripts/audit-config.mjs"
    }
  ]
}