ClawGuard by jugaad-lab

· v1.3.1

High Risk

Security blacklist protecting AI agents from malicious skills, scams, and prompt injection. Use before executing external commands, visiting unknown URLs, or installing new skills. Triggers on "security check", "is this safe", "check this URL", or suspicious command patterns.

H:4 D:4 A:2 C:1

⚠️ Hazard Flags

EXEC CODE_EXEC PRIVILEGED FS_READ_WORKSPACE FS_READ_USER FS_WRITE_WORKSPACE FS_WRITE_USER FS_DELETE NET_EGRESS_ANY CREDS_ENV CREDS_FILES PI_WEB PI_DOCUMENTS

📋 Capabilities

Execution

✅ Shell execution
✅ Code execution
✅ Install dependencies
❌ Persistence
Privilege: admin

Filesystem

✅ Read workspace
✅ Write workspace
✅ Read home
✅ Write home
❌ Read system
✅ Delete

Network

Egress: any
❌ Ingress

Credentials

✅ Environment vars
✅ Credential files
❌ Browser data
❌ Keychain

Actions

❌ send messages❌ post public❌ purchase❌ transfer money❌ deploy❌ delete external

🔒 Containment

Level: maximum

Required:

SANDBOX_CONTAINER: Code execution capability

Recommended:

LOG_ACTIONS: Audit trail for all actions

⚡ Risks

Pipe-to-shell pattern detected (curl|bash) in: examples/library-usage.js, examples/plugin-usage.js, SKILL.md, tests/benchmark.js, tests/detector.test.js, tests/new-features.test.js critical

Mitigation: Do not execute. Review source for malicious intent.

Prompt injection patterns detected in: examples/library-usage.js, lib/detector.js, README.md, scripts/transform-research.js, SKILL.md, tests/benchmark.js, tests/detector.test.js high

Mitigation: Review SKILL.md for hidden instructions. Do not use with untrusted input.

Unauthorized tool use: MCP_SYS_FILE_DESTRUCTION, MCP_SYS_CRITICAL_ACCESS, INSTRUCTED_BINARY_INSTALL, INSTRUCTED_GIT_CLONE_AND_BUILD critical

Mitigation: Remove destructive file operations.

Command injection risk: COMMAND_INJECTION_EVAL, MCP_CMD_DANGEROUS_SYSTEM, MCP_SQL_BLIND critical

Mitigation: Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval()

Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION low

Mitigation: Provide clear, detailed description of skill functionality

Data exfiltration patterns: MCP_EXFIL_CONVERSATION high

Mitigation: Remove references to exfiltrating conversation data or monitoring input.

Want a deeper analysis?

This report was generated by static analysis. Get an LLM-powered deep review with behavioral reasoning and attack surface mapping.

🧠 Deep Analysis — $5.00

🚨 Incident Response

Kill switch: Stop the agent process

Containment: Review logs for unexpected actions

Recovery: Depends on skill capabilities

📄 Raw SSDS JSON click to expand

{
  "meta": {
    "document_id": "ssds:auto:clawguard:1.3.1",
    "ssds_version": "0.2.0",
    "scanner_version": "0.4.0+fe6fd9123d50",
    "created_at": "2026-03-05T03:15:24.106Z",
    "created_by": {
      "agent": "safeagentskills-cli/generate-ssds"
    },
    "language": "en",
    "notes": "Auto-generated SSDS. Manual review recommended."
  },
  "skill": {
    "name": "ClawGuard by jugaad-lab",
    "version": "1.3.1",
    "format": "agent_skill",
    "description": "Security blacklist protecting AI agents from malicious skills, scams, and prompt injection. Use before executing external commands, visiting unknown URLs, or installing new skills. Triggers on \"security check\", \"is this safe\", \"check this URL\", or suspicious command patterns.",
    "publisher": "unknown",
    "source": {
      "channel": "local"
    },
    "artifact": {
      "sha256": "fadb74e1d5440d19a4d9f6c16f39f759f262c3119b0cd5b54e26a0815270c600",
      "hash_method": "files_sorted"
    }
  },
  "capabilities": {
    "execution": {
      "can_exec_shell": true,
      "can_exec_code": true,
      "privilege_level": "admin",
      "can_install_deps": true,
      "can_persist": false
    },
    "filesystem": {
      "reads_workspace": true,
      "reads_user_home": true,
      "reads_system": false,
      "writes_workspace": true,
      "writes_user_home": true,
      "writes_system": false,
      "can_delete": true
    },
    "network": {
      "egress": "any",
      "ingress": false
    },
    "credentials": {
      "reads_env_vars": true,
      "reads_credential_files": true,
      "reads_browser_data": false,
      "reads_keychain": false
    },
    "services": [
      {
        "service": "email",
        "operations": [
          "read",
          "write"
        ]
      }
    ],
    "actions": {
      "can_send_messages": false,
      "can_post_public": false,
      "can_purchase": false,
      "can_transfer_money": false,
      "can_deploy": false,
      "can_delete_external": false
    },
    "prompt_injection_surfaces": [
      "web",
      "documents"
    ],
    "content_types": [
      "general"
    ]
  },
  "hazards": {
    "hdac": {
      "H": 4,
      "D": 4,
      "A": 2,
      "C": 1
    },
    "flags": [
      "EXEC",
      "CODE_EXEC",
      "PRIVILEGED",
      "FS_READ_WORKSPACE",
      "FS_READ_USER",
      "FS_WRITE_WORKSPACE",
      "FS_WRITE_USER",
      "FS_DELETE",
      "NET_EGRESS_ANY",
      "CREDS_ENV",
      "CREDS_FILES",
      "PI_WEB",
      "PI_DOCUMENTS"
    ],
    "custom_flags": [
      {
        "code": "PIPE_TO_SHELL",
        "name": "Pipe to Shell",
        "description": "Downloads and executes remote code (curl|bash pattern) in: examples/library-usage.js, examples/plugin-usage.js, SKILL.md, tests/benchmark.js, tests/detector.test.js, tests/new-features.test.js"
      },
      {
        "code": "PROMPT_INJECTION",
        "name": "Prompt Injection Risk",
        "description": "Contains prompt injection patterns in: examples/library-usage.js, lib/detector.js, README.md, scripts/transform-research.js, SKILL.md, tests/benchmark.js, tests/detector.test.js"
      },
      {
        "code": "PRIVILEGE_ESCALATION",
        "name": "Privilege Escalation",
        "description": "Uses elevated privileges (sudo/root) in: lib/mcp-scanner.js, README.md"
      },
      {
        "code": "FILE_DELETE",
        "name": "File Deletion",
        "description": "Can delete files in: examples/plugin-usage.js, README.md, tests/new-features.test.js"
      },
      {
        "code": "TOOL_ABUSE",
        "name": "Unauthorized Tool Use",
        "description": "MCP_SYS_FILE_DESTRUCTION, MCP_SYS_CRITICAL_ACCESS, INSTRUCTED_BINARY_INSTALL, INSTRUCTED_GIT_CLONE_AND_BUILD: File destruction or wiping commands"
      },
      {
        "code": "SOCIAL_ENGINEERING",
        "name": "Social Engineering Risk",
        "description": "SOCIAL_ENG_VAGUE_DESCRIPTION: Skill description is too vague or missing"
      },
      {
        "code": "COMMAND_INJECTION",
        "name": "Command Injection Risk",
        "description": "COMMAND_INJECTION_EVAL, MCP_CMD_DANGEROUS_SYSTEM, MCP_SQL_BLIND: Dangerous code execution functions that can execute arbitrary code"
      },
      {
        "code": "DATA_EXFILTRATION",
        "name": "Data Exfiltration Risk",
        "description": "MCP_EXFIL_CONVERSATION: Conversation, clipboard, or keystroke exfiltration patterns"
      }
    ],
    "confidence": {
      "level": "medium",
      "basis": [
        "static_analysis"
      ],
      "notes": "Detected 8 security patterns (16 vendored rule hits). Review recommended."
    },
    "rationale": {
      "H": "H4: Critical: Privilege escalation or malware detected",
      "D": "D4: Critical: Credential theft or data exfiltration",
      "A": "A2: Service integrations detected",
      "C": "C1: General content"
    }
  },
  "containment": {
    "level": "maximum",
    "required": [
      {
        "control": "SANDBOX_CONTAINER",
        "reason": "Code execution capability"
      }
    ],
    "recommended": [
      {
        "control": "LOG_ACTIONS",
        "reason": "Audit trail for all actions"
      }
    ],
    "uncontained_risk": "Risk level depends on manual review of actual capabilities."
  },
  "risks": {
    "risks": [
      {
        "risk": "Pipe-to-shell pattern detected (curl|bash) in: examples/library-usage.js, examples/plugin-usage.js, SKILL.md, tests/benchmark.js, tests/detector.test.js, tests/new-features.test.js",
        "severity": "critical",
        "mitigation": "Do not execute. Review source for malicious intent."
      },
      {
        "risk": "Prompt injection patterns detected in: examples/library-usage.js, lib/detector.js, README.md, scripts/transform-research.js, SKILL.md, tests/benchmark.js, tests/detector.test.js",
        "severity": "high",
        "mitigation": "Review SKILL.md for hidden instructions. Do not use with untrusted input."
      },
      {
        "risk": "Unauthorized tool use: MCP_SYS_FILE_DESTRUCTION, MCP_SYS_CRITICAL_ACCESS, INSTRUCTED_BINARY_INSTALL, INSTRUCTED_GIT_CLONE_AND_BUILD",
        "severity": "critical",
        "mitigation": "Remove destructive file operations."
      },
      {
        "risk": "Command injection risk: COMMAND_INJECTION_EVAL, MCP_CMD_DANGEROUS_SYSTEM, MCP_SQL_BLIND",
        "severity": "critical",
        "mitigation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval()"
      },
      {
        "risk": "Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION",
        "severity": "low",
        "mitigation": "Provide clear, detailed description of skill functionality"
      },
      {
        "risk": "Data exfiltration patterns: MCP_EXFIL_CONVERSATION",
        "severity": "high",
        "mitigation": "Remove references to exfiltrating conversation data or monitoring input."
      }
    ],
    "limitations": [
      "Static analysis only - runtime behavior not verified"
    ]
  },
  "incident_response": {
    "kill_switch": [
      "Stop the agent process"
    ],
    "containment": [
      "Review logs for unexpected actions"
    ],
    "recovery": [
      "Depends on skill capabilities"
    ]
  },
  "evidence": [
    {
      "evidence_id": "EV:file-1",
      "type": "file_excerpt",
      "title": "examples/library-usage.js",
      "file_path": "examples/library-usage.js"
    },
    {
      "evidence_id": "EV:file-2",
      "type": "file_excerpt",
      "title": "examples/plugin-usage.js",
      "file_path": "examples/plugin-usage.js"
    },
    {
      "evidence_id": "EV:file-3",
      "type": "file_excerpt",
      "title": "examples/pre-exec-hook.sh",
      "file_path": "examples/pre-exec-hook.sh"
    },
    {
      "evidence_id": "EV:file-4",
      "type": "file_excerpt",
      "title": "examples/pre-skill-install.sh",
      "file_path": "examples/pre-skill-install.sh"
    },
    {
      "evidence_id": "EV:file-5",
      "type": "file_excerpt",
      "title": "lib/audit.js",
      "file_path": "lib/audit.js"
    },
    {
      "evidence_id": "EV:file-6",
      "type": "file_excerpt",
      "title": "lib/config.js",
      "file_path": "lib/config.js"
    },
    {
      "evidence_id": "EV:file-7",
      "type": "file_excerpt",
      "title": "lib/database.js",
      "file_path": "lib/database.js"
    },
    {
      "evidence_id": "EV:file-8",
      "type": "file_excerpt",
      "title": "lib/detector.js",
      "file_path": "lib/detector.js"
    },
    {
      "evidence_id": "EV:file-9",
      "type": "file_excerpt",
      "title": "lib/discord-approval.js",
      "file_path": "lib/discord-approval.js"
    },
    {
      "evidence_id": "EV:file-10",
      "type": "file_excerpt",
      "title": "lib/index.js",
      "file_path": "lib/index.js"
    },
    {
      "evidence_id": "EV:cisco-1",
      "type": "file_excerpt",
      "title": "MCP_SYS_FILE_DESTRUCTION [CRITICAL] examples/plugin-usage.js:67: const dangerousCommand = await check('rm -rf /', 'command');",
      "file_path": "examples/plugin-usage.js"
    },
    {
      "evidence_id": "EV:cisco-2",
      "type": "file_excerpt",
      "title": "MCP_SYS_CRITICAL_ACCESS [HIGH] examples/pre-exec-hook.sh:1: #!/bin/bash",
      "file_path": "examples/pre-exec-hook.sh"
    },
    {
      "evidence_id": "EV:cisco-3",
      "type": "file_excerpt",
      "title": "MCP_SYS_CRITICAL_ACCESS [HIGH] examples/pre-skill-install.sh:1: #!/bin/bash",
      "file_path": "examples/pre-skill-install.sh"
    },
    {
      "evidence_id": "EV:cisco-4",
      "type": "file_excerpt",
      "title": "COMMAND_INJECTION_EVAL [CRITICAL] lib/database.js:43: this.db.exec(schema);",
      "file_path": "lib/database.js"
    },
    {
      "evidence_id": "EV:cisco-5",
      "type": "file_excerpt",
      "title": "COMMAND_INJECTION_EVAL [CRITICAL] lib/mcp-scanner.js:578: const match = pattern.exec(combined);",
      "file_path": "lib/mcp-scanner.js"
    },
    {
      "evidence_id": "EV:cisco-6",
      "type": "file_excerpt",
      "title": "MCP_CMD_DANGEROUS_SYSTEM [CRITICAL] lib/mcp-scanner.js:83: ['powershell', 'Unrestricted PowerShell access'],",
      "file_path": "lib/mcp-scanner.js"
    },
    {
      "evidence_id": "EV:cisco-7",
      "type": "file_excerpt",
      "title": "TIRITH_ANSI_ESCAPE_IN_STRING [HIGH] lib/mcp-scanner.js:14: CRITICAL: { value: 'CRITICAL', rank: 4, emoji: '🔴', color: '\\x1b[91m' },",
      "file_path": "lib/mcp-scanner.js"
    },
    {
      "evidence_id": "EV:cisco-8",
      "type": "file_excerpt",
      "title": "PROMPT_INJECTION_IGNORE_INSTRUCTIONS [HIGH] README.md:69: clawguard check --type message --input \"Ignore all previous instructions...\"",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-9",
      "type": "file_excerpt",
      "title": "INSTRUCTED_BINARY_INSTALL [HIGH] README.md:48: npm install -g clawguard",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-10",
      "type": "file_excerpt",
      "title": "MCP_SYS_FILE_DESTRUCTION [CRITICAL] README.md:119: - **Command injection** via unrestricted shell commands and dangerous patterns (",
      "file_path": "README.md"
    }
  ]
}