# Security Audit Report

## Lifepath

**Security Score**: 3/100  
**Risk Level**: High  
**Audited by**: Sehil Systems Studio - The Trench  
**Date**: 4/30/2026  
**Files**: 21

Continuously monitored by ClawSecure Watchtower

### Findings Overview
- **Total Findings**: 15  
- **Critical**: 0  
- **High**: 8  
- **Medium**: 6  
- **Low**: 1  
- **Info**: 0

**Source**: [Lifepath](https://clawhub.ai/ezbreadsniper/lifepath)

**SHA-256**: 188fa134e891...

lifepath is a skill for the OpenClaw ecosystem, created by Sehil Systems Studio - The Trench. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 3/100, indicating significant security concerns that require attention. The audit identified 15 findings, with issues detected across multiple security layers.

## 3-Layer Audit Protocol  
### ClawSecure Proprietary Engine  
- **Issue**: Missing config.json - agent may not be properly configured  
- **Findings**: 1 (WARNING)

### Advanced Static & Behavioral Analysis
- **Issues**: 
  - Only 40% of skill content could be analyzed. 12 of 21 files are opaque to the scanner. The safety assessment has low confidence.  
  - **Pattern detected**: fs.readFileSync(  
  - **Pattern detected**: fetch( (plus 2 more)  
- **Findings**: 5 (CRITICAL)

### Supply Chain Security  
- **Issues**: 
  - Vulnerability in axios@1.7.9: Normalization Bypass leading to SSRF.  
  - Vulnerability in axios@1.7.9: Denial of Service vulnerability.  
  - Additional vulnerabilities found in axios and fastify (multiple findings).  
- **Findings**: 9 (CRITICAL)

## Findings by Level  
### HIGH  
- **F-001**: Only 40% of skill content could be analyzed.
- **F-002**: Pattern detected: fs.readFileSync( in scripts/init-db.js:20.
- **F-003**: Pattern detected: fs.writeFileSync( in src/services/imageService.js:175.
- **F-004**: Vulnerability in axios@1.7.9 related to denial of service (package.json).
- **F-005**: Additional vulnerabilities for axios in package.json.
- **F-006**: Requests vulnerable to SSRF and credential leakage (package.json).
- **F-007**: Fastify's Content-Type header tab character allows body validation bypass (package.json).
- **F-008**: Fastify vulnerability to invalid content-type parsing (package.json).

### MEDIUM  
- **F-001**: Pattern detected: fetch( in src/routes/moltbook.js:32.
- **F-002**: Pattern detected: axios.post( in src/services/imageService.js:143.
- **F-003**: Missing config.json (Identity & Privilege Abuse).
- **F-004**: Vulnerability in axios related to normalization bypass (package.json).
- **F-005**: Axios has unrestricted cloud metadata exfiltration via header injection (package.json).
- **F-006**: Fastify request.protocol and request.host spoofable (package.json).

### LOW
- **F-001**: Fastify vulnerable to DoS via unbounded memory allocation (package.json).

## OWASP ASI Framework Coverage
ClawSecure provides comprehensive coverage across all 10 OWASP ASI categories.

## Security Recommendations for Lifepath
- Pin npm dependencies to exact versions to prevent unauthorized code from entering.
- Add a config.json permissions manifest to declare necessary permissions for clarity before installation.
- Audit external network connections to ensure all outbound connections are trusted to prevent data exfiltration.

## Additional Information
Scanned on April 30, 2026. Lifepath is one of 2,890+ agents audited by ClawSecure.

**Learn more at [OWASP](https://owasp.org/www-project-top-10-for-large-language-model-applications/)**.