clawseccheck@4.4.3

CAUTION

Publisher claims: "Free, local, read-only security self-audit for your own OpenClaw agent. Reads your OpenClaw config, bootstrap files, logs, agent session logs, and installed skills, plus a bounded host-security scan. It changes no OpenClaw config, skill or bootstrap file; its own history and state stay under ~/.clawseccheck (--no-history skips it, --purge removes it). Grades your setup A-F when all five check layers ran, naming what's missing otherwise. --monitor records a local baseline so every later run alerts on what changed - a new MCP server, an edited skill, config drift, a finding that appeared or cleared. No API key, no network calls; the only external command it runs is your own read-only openclaw security audit (skip with --no-native). --save and --html write only to the path you give. Use it when you want to check or audit your OpenClaw agent's security, find prompt-injection or misconfiguration risks, see your A-F security score, watch your OpenClaw setup for changes, or ask what changed since the last check." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher gl0di · joined 1 days agoInstalls 5,567Last detonated 13 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsSECURITY_MODEL.md:320 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternCHANGELOG.md:761 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsSECURITY_MODEL.md:330 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternCHANGELOG.md:524 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Reads credential paths from the home directoryCHANGELOG.md:1304 · Reads credential paths from the home directory

AST03

CRITICAL

Access to sensitive file pathsCHANGELOG.md:783 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternclawseccheck/adjudication/_builder.py:303 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_egress.py:3854 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_shared.py:1204 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_host.py:1391 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/catalog.py:1812 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_egress.py:2338 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_shared.py:198 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Destructive file system command detectedclawseccheck/attest.py:161 · Destructive file system command detected

AST05

CRITICAL

Credential pass-through configurationclawseccheck/checks/_egress.py:1479 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Reads credential paths from the home directoryclawseccheck/checks/_capability.py:1605 · Reads credential paths from the home directory

AST03

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_host.py:1294 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_egress.py:2408 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/catalog.py:2870 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Credential pass-through configurationclawseccheck/checks/_egress.py:2172 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Credential pass-through configurationclawseccheck/checks/_egress.py:5987 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Credential pass-through configurationclawseccheck/checks/_egress.py:2116 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Reads credential paths from the home directoryclawseccheck/checks/_egress.py:4755 · Reads credential paths from the home directory

AST03

CRITICAL

Access to sensitive file pathsclawseccheck/catalog.py:2099 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsSKILL.md:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_capability.py:1605 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_egress.py:2337 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_capability.py:1674 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_host.py:1296 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Credential pass-through configurationclawseccheck/catalog.py:667 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Credential pass-through configurationclawseccheck/checks/_egress.py:145 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Pipe-to-shell patternclawseccheck/checks/__init__.py:1113 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsclawseccheck/harnessruntime.py:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/monitordims/_memory.py:445 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/report.py:2139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_shared.py:3879 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/redteam.py:165 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/harnessruntime.py:656 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Destructive file system command detectedclawseccheck/redteam.py:348 · Destructive file system command detected

AST05

CRITICAL

HTML comment carrying imperative instructions to the agentclawseccheck/redteam.py:75 · HTML comment carrying imperative instructions to the agent

AST01

CRITICAL

Access to sensitive file pathsclawseccheck/risk.py:2558 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Credential pass-through configurationclawseccheck/redteam.py:399 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Access to sensitive file pathsclawseccheck/redteam.py:160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/report.py:2126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/report.py:6345 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/report.py:2124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/harnessruntime.py:658 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Destructive file system command detectedclawseccheck/report.py:6492 · Destructive file system command detected

AST05

CRITICAL

Reads credential paths from the home directoryclawseccheck/monitordims/_memory.py:445 · Reads credential paths from the home directory

AST03

CRITICAL

Agent configured for autonomous execution without human approvalclawseccheck/risk.py:1812 · Agent configured for autonomous execution without human approval

AST02

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_shared.py:3877 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/risk.py:2509 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternclawseccheck/safeio.py:363 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsclawseccheck/checks/_shared.py:3878 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Destructive file system command detectedclawseccheck/cli.py:2640 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedclawseccheck/cli.py:4202 · Destructive file system command detected

AST05

CRITICAL

Access to sensitive file pathsclawseccheck/pdf.py:608 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Destructive file system command detectedclawseccheck/trajaudit.py:1269 · Destructive file system command detected

AST05

CRITICAL

Pipe-to-shell patterndocs/USAGE.md:436 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsclawseccheck/safeio.py:302 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Prompt injectiondocs/OUTPUT_SCHEMA.md:709 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Access to sensitive file pathsdocs/THREAT_COVERAGE.md:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Reads credential paths from the home directorydocs/THREAT_COVERAGE.md:117 · Reads credential paths from the home directory

AST03

CRITICAL

OS command execution function call detecteddocs/THREAT_COVERAGE.md:462 · OS command execution function call detected

AST05

CRITICAL

Prompt injectiondocs/CHECKS.md:1272 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Rule modification attemptdocs/THREAT_COVERAGE.md:222 · Rule modification attempt — overwriting existing instructions

AST01

CRITICAL

OS command execution function call detecteddocs/THREAT_COVERAGE.md:77 · OS command execution function call detected

AST05

CRITICAL

Reads credential paths from the home directorydocs/THREAT_COVERAGE.md:160 · Reads credential paths from the home directory

AST03

CRITICAL

Prompt injectiondocs/CHECKS.md:3040 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Prompt injectiondocs/CHECKS.md:1076 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Access to sensitive file pathsclawseccheck/trajaudit.py:250 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Agent configured for autonomous execution without human approvaldocs/CHECKS.md:3164 · Agent configured for autonomous execution without human approval

AST02

CRITICAL

Privileged sudo commanddocs/THREAT_COVERAGE.md:444 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Access to sensitive file pathsdocs/USAGE.md:299 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Agent configured for autonomous execution without human approvaldocs/CHECKS.md:3225 · Agent configured for autonomous execution without human approval

AST02

CRITICAL

Prompt injectiondocs/OUTPUT_SCHEMA.md:955 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Access to sensitive file pathsdocs/OUTPUT_SCHEMA.md:365 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdocs/THREAT_COVERAGE.md:141 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternclawseccheck/skilldiscovery.py:212 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsdocs/USAGE.md:366 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdocs/THREAT_COVERAGE.md:160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdocs/USAGE.md:392 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Prompt injectiondocs/CHECKS.md:1264 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Access to sensitive file pathsdocs/THREAT_COVERAGE.md:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Prompt injectiondocs/THREAT_COVERAGE.md:153 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

OS command execution function call detecteddocs/THREAT_COVERAGE.md:464 · OS command execution function call detected

AST05

CRITICAL

Access to sensitive file pathsdocs/THREAT_COVERAGE.md:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Prompt injectiondocs/CHECKS.md:1084 · Prompt injection — known jailbreak technique reference

AST01

HIGH

File permission modification commandclawseccheck/catalog.py:4099 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

npx invocation of non-well-known packageclawseccheck/catalog.py:1276 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Auto-update or dynamic fetch configurationclawseccheck/checks/__init__.py:1524 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

CRITICAL

Access to sensitive file pathsdocs/playbook/SCOPE.md:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

File permission modification commandclawseccheck/checks/_capability.py:3360 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/catalog.py:4088 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/catalog.py:4098 · File permission modification command — agent changes file ownership/permissions

AST05

CRITICAL

Prompt injection attemptdocs/USAGE.md:2403 · Prompt injection attempt — 'ignore previous instructions'

AST01

HIGH

Instructs the agent to modify its persistent memory or instruction filesclawseccheck/checks/_agents.py:2346 · Instructs the agent to modify its persistent memory or instruction files

AST01

CRITICAL

Prompt injectiondocs/USAGE.md:1815 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Access to sensitive file pathsdocs/playbook/SCOPE.md:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

References a credential file in the home directoryclawseccheck/checks/_egress.py:4755 · References a credential file in the home directory

AST03

HIGH

File permission modification commandclawseccheck/checks/_capability.py:3373 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Auto-update or dynamic fetch configurationCHANGELOG.md:817 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

File permission modification commandclawseccheck/catalog.py:4153 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

References a credential file in the home directoryCHANGELOG.md:1304 · References a credential file in the home directory

AST03

CRITICAL

Access to sensitive file pathsdocs/playbook/SCOPE.md:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Refusal suppressionCHANGELOG.md:61 · Refusal suppression — attempting to prevent safety responses

AST01

HIGH

File permission modification commandclawseccheck/catalog.py:4090 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Persistence: instructs the agent to auto-load this skill in future sessionsclawseccheck/checks/__init__.py:1432 · Persistence: instructs the agent to auto-load this skill in future sessions

AST01

HIGH

Auto-update or dynamic fetch configurationclawseccheck/catalog.py:2544 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

CRITICAL

Prompt injectiondocs/USAGE.md:1782 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Access to sensitive file pathsdocs/playbook/SCOPE.md:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Instructs the agent to modify its persistent memory or instruction filesclawseccheck/checks/_agents.py:2401 · Instructs the agent to modify its persistent memory or instruction files

AST01

HIGH

File permission modification commandclawseccheck/checks/_host.py:720 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/checks/_host.py:719 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/checks/_egress.py:5440 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Process kill commandclawseccheck/checks/_host.py:1642 · Process kill command — agent can terminate processes

AST05

HIGH

Unicode escape sequence detectedclawseccheck/checks/_egress.py:5213 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

Process kill commandclawseccheck/checks/_host.py:254 · Process kill command — agent can terminate processes

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/checks/_egress.py:792 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Instructs the agent to modify its persistent memory or instruction filesclawseccheck/cli.py:3723 · Instructs the agent to modify its persistent memory or instruction files

AST01

HIGH

URL with embedded credentialsclawseccheck/checks/_egress.py:5225 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsclawseccheck/checks/_egress.py:5729 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

Unicode escape sequence detectedclawseccheck/checks/_shared.py:726 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

File permission modification commandclawseccheck/checks/_host.py:705 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/checks/_host.py:862 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

URL with embedded credentialsclawseccheck/checks/_shared.py:3923 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

File permission modification commandclawseccheck/checks/_egress.py:3189 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

URL with embedded credentialsclawseccheck/checks/_egress.py:1295 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packageclawseccheck/checks/_egress.py:5488 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsclawseccheck/checks/_egress.py:3830 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

File permission modification commandclawseccheck/checks/_egress.py:3179 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/checks/_egress.py:5394 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandclawseccheck/cli.py:5508 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/checks/_egress.py:5225 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressclawseccheck/checks/_egress.py:5669 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandclawseccheck/checks/_host.py:706 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

References a credential file in the home directoryclawseccheck/checks/_egress.py:4759 · References a credential file in the home directory

AST03

HIGH

File permission modification commandclawseccheck/cli.py:6672 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Process kill commandclawseccheck/checks/_host.py:1770 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packageclawseccheck/checks/_egress.py:4965 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

File permission modification commandclawseccheck/checks/_egress.py:3164 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/cli.py:2414 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/checks/_egress.py:3165 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Unicode escape sequence detectedclawseccheck/checks/_shared.py:725 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

File permission modification commandclawseccheck/logdiscovery.py:271 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/incidentstore.py:3 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

References a credential file in the home directoryclawseccheck/monitordims/_memory.py:445 · References a credential file in the home directory

AST03

HIGH

Outbound HTTP to raw IP addressclawseccheck/dryrun.py:128 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

References a credential file in the home directoryclawseccheck/logscan.py:820 · References a credential file in the home directory

AST03

HIGH

File permission modification commandclawseccheck/monitor.py:351 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/dryrun.py:70 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packageclawseccheck/monitordims/_mcp.py:189 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

File permission modification commandclawseccheck/history.py:1 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/monitordims/_bootstrap.py:30 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

npx invocation of non-well-known packageclawseccheck/monitordims/_mcp.py:236 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Instructs the agent to modify its persistent memory or instruction filesclawseccheck/dossier.py:736 · Instructs the agent to modify its persistent memory or instruction files

AST01

HIGH

Unicode escape sequence detectedclawseccheck/harnessruntime.py:211 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

Unicode escape sequence detectedclawseccheck/configloader.py:175 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

Outbound HTTP to raw IP addressclawseccheck/dryrun.py:101 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packageclawseccheck/logsafe.py:187 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Outbound HTTP to raw IP addressclawseccheck/dryrun.py:115 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandclawseccheck/logdiscovery.py:333 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Unicode escape sequence detectedclawseccheck/harnessruntime.py:212 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

Unicode escape sequence detectedclawseccheck/configloader.py:174 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

File permission modification commandclawseccheck/integrity.py:232 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

References a credential file in the home directoryclawseccheck/logscan.py:821 · References a credential file in the home directory

AST03

HIGH

File permission modification commandclawseccheck/monitordims/_memory.py:238 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

URL with embedded credentialsclawseccheck/monitordims/_mcp.py:236 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

File permission modification commandclawseccheck/monitorstore.py:543 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Process kill commandclawseccheck/cli.py:6470 · Process kill command — agent can terminate processes

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/dryrun.py:59 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

URL with embedded credentialsclawseccheck/logsafe.py:164 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packageclawseccheck/monitordims/_channels.py:163 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Unicode escape sequence detectedclawseccheck/retiredformats.py:117 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

npx invocation of non-well-known packagedocs/OUTPUT_SCHEMA.md:1696 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Unicode escape sequence detectedclawseccheck/retiredformats.py:118 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

Auto-update or dynamic fetch configurationdocs/CHECKS.md:2172 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Outbound HTTP to raw IP addressclawseccheck/redteam.py:209 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Unicode escape sequence detectedclawseccheck/skillprovenance.py:356 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

Python subprocess execution detectedclawseccheck/native.py:165 · Python subprocess execution detected

AST05

HIGH

File permission modification commandclawseccheck/safeio.py:363 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Auto-update or dynamic fetch configurationdocs/CHECKS.md:2164 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Unicode escape sequence detectedclawseccheck/multiturn.py:323 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

File permission modification commanddocs/CHECKS.md:288 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/redteam.py:330 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commanddocs/FAQ.md:345 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/multiturn.py:121 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandclawseccheck/report.py:5218 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commanddocs/CHECKS.md:289 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commanddocs/CHECKS.md:44 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

References a credential file in the home directorydocs/THREAT_COVERAGE.md:160 · References a credential file in the home directory

AST03

HIGH

Outbound HTTP to raw IP addressclawseccheck/redteam.py:245 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressclawseccheck/redteam.py:382 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandclawseccheck/sbom_runs.py:2 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/report.py:199 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Python subprocess execution detectedclawseccheck/watch.py:896 · Python subprocess execution detected

AST05

HIGH

Outbound HTTP to raw IP addressclawseccheck/redteam.py:280 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commanddocs/CHECKS.md:43 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/monitorstore.py:874 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/risk.py:1271 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Unicode escape sequence detectedclawseccheck/skillprovenance.py:357 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

File permission modification commanddocs/CHECKS.md:276 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/skilldiscovery.py:190 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandclawseccheck/runstore.py:2 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

npx invocation of non-well-known packageclawseccheck/sbom.py:118 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Python subprocess execution detecteddocs/THREAT_COVERAGE.md:463 · Python subprocess execution detected

AST05

MEDIUM

Remote installer piped to shellCHANGELOG.md:761 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressclawseccheck/checks/_egress.py:5440 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/dryrun.py:101 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actionclawseccheck/monitorstore.py:604 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP addressclawseccheck/redteam.py:209 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/multiturn.py:121 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actionclawseccheck/cli.py:4593 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shellclawseccheck/adjudication/_builder.py:303 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressclawseccheck/redteam.py:330 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/dryrun.py:115 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/checks/_egress.py:5225 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/checks/_egress.py:792 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/redteam.py:382 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actionSECURITY_MODEL.md:450 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP addressclawseccheck/dryrun.py:59 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/redteam.py:245 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

References a credential file in the home directorydocs/USAGE.md:299 · References a credential file in the home directory

AST03

MEDIUM

URL using raw IP addressclawseccheck/dryrun.py:128 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Process kill commanddocs/design/watch-mechanism.md:139 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagedocs/USAGE.md:2063 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionclawseccheck/monitorstore.py:665 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shellclawseccheck/checks/__init__.py:1113 · Remote installer piped to shell

AST07

MEDIUM

Remote installer piped to shellclawseccheck/catalog.py:1276 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressclawseccheck/checks/_egress.py:5394 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/redteam.py:280 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressclawseccheck/checks/_egress.py:5669 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

Remote installer piped to shellclawseccheck/cli.py:3167 · Remote installer piped to shell

AST07

MEDIUM

Remote installer piped to shellCHANGELOG.md:524 · Remote installer piped to shell

AST07

HIGH

Auto-update or dynamic fetch configurationdocs/THREAT_COVERAGE.md:132 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Process kill commanddocs/USAGE.md:807 · Process kill command — agent can terminate processes

AST05

MEDIUM

URL using raw IP addressclawseccheck/dryrun.py:70 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actiondocs/THREAT_COVERAGE.md:114 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shelldocs/USAGE.md:436 · Remote installer piped to shell

AST07

MEDIUM

Excessive HTML entities detecteddocs/USAGE.md:1983 · Excessive HTML entities detected — may be obfuscating content

AST07

MEDIUM

File type combined with upload actiondocs/THREAT_COVERAGE.md:77 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shelldocs/USAGE.md:2063 · Remote installer piped to shell

AST07

MEDIUM

Remote installer piped to shelldocs/THREAT_COVERAGE.md:77 · Remote installer piped to shell

AST07

MEDIUM

Excessive HTML entities detecteddocs/USAGE.md:1985 · Excessive HTML entities detected — may be obfuscating content

AST07

MEDIUM

File type combined with upload actiondocs/RELEASING.md:84 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shellclawseccheck/skilldiscovery.py:212 · Remote installer piped to shell

AST07

MEDIUM

Remote installer piped to shellclawseccheck/safeio.py:363 · Remote installer piped to shell

AST07

MEDIUM

File type combined with upload actiondocs/THREAT_COVERAGE.md:63 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondocs/THREAT_COVERAGE.md:99 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondocs/THREAT_COVERAGE.md:502 · File type combined with upload action — agent may exfiltrate local data files

AST07