Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-03
This package is documentation only: a single skill.md file that tells an AI agent how to operate a separate program called "ClawSec Monitor" — a local man-in-the-middle proxy that decrypts and inspects all of an agent's HTTP/HTTPS traffic looking for leaked credentials and injected shell commands. No executable code ships with the skill; the Python script, Dockerfile and test suite it describes (clawsec-monitor.py and friends) are listed as files but are not in the package, and the only external link is a GitHub repo, so an agent following these instructions would have to fetch the real code from somewhere else. The instructions ask the user to install a locally generated root certificate authority into the system trust store using sudo, and to point all agent traffic at 127.0.0.1:8888 — legitimate for a traffic inspector, but it is a permanent, machine-wide trust change and it makes all encrypted agent traffic readable in cleartext. The tool is also documented as writing snippets of detected secrets (for example a partial Anthropic API key in an Authorization header) into plaintext log files under /tmp. Nothing in the text sends data to a remote server, and the shell commands that appear in the file (curl | bash, nc, rm -rf /) are only listed as detection patterns, not executed. Overall the described behavior matches the stated security-monitoring purpose, but the capabilities involved are unusually invasive and the actual program is not included for review.
| Declared purpose | Guide an AI agent in managing and interpreting "ClawSec Monitor v3.0", a transparent HTTP/HTTPS MITM proxy that inspects agent traffic for credential exfiltration and prompt/command injection and logs detections. |
| Observed behavior | The file contains only prose, tables, config reference and example shell/docker commands. It instructs the agent to start/stop a local Python proxy, read /tmp/clawsec/threats.jsonl, install a generated root CA into the OS trust store via sudo, and set HTTP_PROXY/HTTPS_PROXY to the local proxy. Dangerous-looking binaries (curl|bash, nc, rm -rf /) appear solely as descriptions of detection rules. No network exfiltration, no obfuscated code, no download-and-execute, no wallet or payment logic, no environment-variable harvesting is present in the shipped text. |
| Verdict, rules only | CAUTION · downloads and pipes to a shell (curl|sh); uses sudo, rm -rf or dd |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | Instructs the agent to run python3 clawsec-monitor.py start/stop/status/threats, docker compose commands, and sudo certificate-trust commands (skill.md lines 45-64, 74-79, 150-161). |
| network | needed | Sets up a local proxy on 127.0.0.1:8888 and redirects all agent HTTP/HTTPS traffic through it (lines 91-92). Only other remote reference is the project GitHub URL on line 197. |
| credentials | needed | By design the proxy decrypts TLS and scans for API keys, AWS keys, private keys and .env content; detection snippets containing partial secrets are written to a plaintext log (lines 22-27, 127, 139). |
| filesystem_write | needed | Writes CA key/cert, threats.jsonl and rotating logs under /tmp/clawsec (lines 70, 119, 143). |
| persistence | exceeds purpose | Installing a root CA into the macOS System keychain or /usr/local/share/ca-certificates permanently changes machine-wide TLS trust and survives removal of the skill (lines 74-79). |
| other | exceeds purpose | The main program (clawsec-monitor.py, Dockerfile, requirements) is referenced but not included in the package, so the code that actually handles decrypted traffic cannot be audited from this package (lines 172-176). |
| severity | finding |
|---|---|
| medium | Tool decrypts all agent TLS traffic The described program breaks end-to-end encryption for every request the agent makes, meaning all tokens, cookies and payloads pass through it in cleartext. This is inherent to its stated purpose but gives the tool total visibility over the agent's secrets. skill.md:11 **HTTPS interception** is done via full MITM: a local CA signs per-host certificates, and `asyncio.start_tls()` upgrades the client connection server-side so pl |
| medium | Instructs installing a root CA into the system trust store with sudo Adding the generated CA to the macOS System keychain (line 74-75) or to /usr/local/share/ca-certificates (lines 78-79) is a machine-wide, persistent change to TLS trust. Anyone holding the corresponding private key in /tmp/clawsec can impersonate any HTTPS site to this machine. skill.md:74 sudo security add-trusted-cert -d -r trustRoot \ |
| medium | CA private key stored in /tmp Storing a trusted certificate authority key in a world-traversable temporary directory means any local process or user able to read it can forge certificates for the now-trusted CA. skill.md:70 After first `start`, a CA key and cert are generated at `/tmp/clawsec/ca.crt`. |
| medium | Detected secrets are written into a plaintext log The threat log records up to 200 characters of surrounding context (line 139) for each detection, which by the tool's own example includes Authorization headers and API-key fragments. This concentrates credential material into /tmp/clawsec/threats.jsonl. skill.md:127 "snippet": "Authorization: Bearer sk-ant-api01-...", |
| low | Credential-bearing log kept in a shared temp directory /tmp is typically readable by other local users and processes, so the log of detected secrets is not protected. skill.md:119 Threats are appended to `/tmp/clawsec/threats.jsonl` (one JSON object per line): |
| medium | Core executable code is referenced but not shipped The skill documents commands for clawsec-monitor.py, run_tests.py, Dockerfile.clawsec, docker-compose.clawsec.yml and requirements.clawsec.txt (lines 172-176), none of which are in the package. The behavior of the component that actually handles decrypted traffic and secrets cannot be verified from this package; it would have to be obtained separately, e.g. from the GitHub link on line 197. skill.md:172 | `clawsec-monitor.py` | Main script (876 lines) | |
| info | Single external code source is a personal GitHub repository The only off-machine destination in the package is this repository, which is the implied source of the missing proxy code. It is an unverified third-party account rather than an established vendor. skill.md:197 *GitHub: https://github.com/chrisochrisochriso-cmyk/clawsec-monitor* |
| low | Redirects all agent traffic through a local proxy Setting HTTP_PROXY/HTTPS_PROXY funnels every outbound request through the tool. Destination is localhost only in this documentation, but a misconfigured or malicious proxy binary at that port would see and could alter all agent traffic. skill.md:91 export HTTP_PROXY=http://127.0.0.1:8888 |
| info | Shell-pipe and destructive commands appear only as detection patterns curl|bash, nc reverse shells and rm -rf / (lines 33-36) are listed in a table of strings the proxy searches for, not commands the skill executes. Automated scanners will flag these; they are descriptive, not operational. skill.md:33 | `pipe_to_shell` | `curl <url> \| bash`, `wget <url> \| sh` | |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| 127.0.0.1 | not in the service index | skill.md:91 |
| github.com | not in the service index | skill.md:197 |
| Binaries invoked | bash, curl, docker, nc, ncat, python3, rm -rf, sh, sudo, wget |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 1 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
_meta.json | 6 | 1bc92c24a21bc64e… |
skill.md | 197 | e62dd18b1f9949b5… |
For agents
JSON: https://agenteconomy.report/k/clawsec.audit.json · badge: https://agenteconomy.report/k/clawsec.audited.svg ·
skill rating: /k/clawsec · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: amostra.