Security Audit Report

Summary

  • Security Score: 19/100
  • Risk Level: High
  • Findings: 13
    • 0 Critical
    • 6 High
    • 3 Medium
    • 3 Low
    • 1 Info

Source: https://clawhub.ai/pskoett/self-improving-agent
SHA-256: 64fd309c004f...

3-Layer Audit Protocol

  • ClawSecure Proprietary Engine
    • Findings (Critical): 8
      • Missing config.json - agent may not be properly configured
      • Attempts to access sensitive file: SOUL.md
      • Attempts to access sensitive file: MEMORY.md +1 more
  • Advanced Static & Behavioral Analysis
    • Findings (Warning): 5
      • Only 88% of skill content could be analyzed.
      • 2 of 19 files are opaque to the scanner.
      • Hidden files found: .learnings/ERRORS.md, .learnings/FEATURE_REQUESTS.md +2 more
  • Supply Chain Security
    • Findings (Pass): 0

Findings Breakdown

HIGH (6 findings)

  1. F-001 Attempts to access sensitive file: SOUL.md - ASI06 OWASP ASI: Memory & Context Poisoning
    • File: SKILL.md
  2. F-002 Attempts to access sensitive file: MEMORY.md - ASI06 OWASP ASI: Memory & Context Poisoning
    • File: SKILL.md
  3. F-003 Attempts to access sensitive file: SOUL.md - ASI06 OWASP ASI: Memory & Context Poisoning
    • File: handler.js
  4. F-004 Attempts to access sensitive file: SOUL.md - ASI06 OWASP ASI: Memory & Context Poisoning
    • File: handler.ts
  5. F-005 Attempts to access sensitive file: SOUL.md - ASI06 OWASP ASI: Memory & Context Poisoning
    • File: openclaw-integration.md
  6. F-006 Attempts to access sensitive file: MEMORY.md - ASI06 OWASP ASI: Memory & Context Poisoning
    • File: openclaw-integration.md

MEDIUM (3 findings)

  1. F-001 Only 88% of skill content could be analyzed.
    • Warning: 2 of 19 files are opaque to the scanner.
  2. F-002 Missing config.json - agent may not be properly configured - ASI03 OWASP ASI: Identity & Privilege Abuse
    • Detected by: Proprietary
    • Category: config.
  3. F-003 ReDoS vulnerability: Nested quantifiers (potential catastrophic backtracking) - ASI05 OWASP ASI: Unexpected Code Execution
    • File: extract-skill.sh:101

LOW (3 findings)

  1. F-001 Hidden file found: .learnings/ERRORS.md.
    • Warning: Hidden files may contain concealed configuration or data that should be reviewed.
  2. F-002 Hidden file found: .learnings/FEATURE_REQUESTS.md.
    • Warning: Hidden files may contain concealed configuration or data that should be reviewed.
  3. F-003 Hidden file found: .learnings/LEARNINGS.md.
    • Warning: Hidden files may contain concealed configuration or data that should be reviewed.

INFO (1 finding)

  1. F-001 Skill manifest does not include a 'license' field.
    • File: SKILL.md
    • Note: Specifying a license helps users understand usage terms.

OWASP ASI Framework Coverage

ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories:

  • ASI01 Agent Goal Hijack
  • ASI02 Tool Misuse
  • ASI03 Identity & Privilege
  • ASI04 Agentic Supply Chain
  • ASI05 Unexpected Code Execution
  • ASI06 Memory & Context
  • ASI07 Insecure Inter-Agent Communication
  • ASI08 Cascading Failures
  • ASI09 Human-Agent Trust Exploitation
  • ASI10 Rogue Agents

Security Recommendations for self-improvement

  1. Pin npm dependencies to exact versions
    • This prevents unauthorized code from entering your dependency tree by using exact version numbers in package.json (e.g., 1.2.3 instead of ^1.2.3).
  2. Add a config.json permissions manifest
    • This file declares what permissions your OpenClaw skill needs, providing visibility to users regarding what your skill can do before installing.