arc-sentinel Security Audit Report
arc-sentinel is an AI agent skill, created by arc-claw-bot and published at arc-claw-bot/arc-sentinel. ClawSecure audited arc-sentinel across 13 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 10/100 (High Risk). The 13 findings concentrate in Command Injection, Code Injection and Policy Violation, including Pattern detected: chmod 777 and Attempts to access sensitive file: .ssh/. 4 were rated high or critical severity.
Is arc-sentinel safe?
ClawSecure audited arc-sentinel and assigned a security score of 10/100 (High Risk), identifying 13 findings across Command Injection and Code Injection. Review the findings below before installing.
What did ClawSecure find in arc-sentinel?
ClawSecure identified 13 findings in arc-sentinel, concentrated in Command Injection, Code Injection and Policy Violation. 4 were rated high or critical severity. The most severe include Pattern detected: chmod 777 and Attempts to access sensitive file: .ssh/.
How was arc-sentinel audited?
ClawSecure ran arc-sentinel through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 13 files from arc-claw-bot/arc-sentinel.
What does a score of 10 mean?
ClawSecure assigned arc-sentinel a security score of 10/100, placing it in the High Risk range. This is driven by 13 findings led by Command Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for arc-sentinel
ClawSecure detected 13 security findings in arc-sentinel, spanning Command Injection, Code Injection, Policy Violation and Unauthorized Tool Use.
- critical · Pattern detected: chmod 777. Unauthorized Tool Use finding detected in
scripts/skill-auditor.sh:193. - high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in
permission-auditor.sh. - high · Potentially dangerous code pattern detected: base64.*decode. Code Injection finding detected in
skill-auditor.sh. - high · Potentially dangerous code pattern detected: base64.*decode. Code Injection finding detected in
token-watchdog.sh. - medium · Variable $url (line 227) flows to `sh` at line 238.. Command Injection finding detected in
scripts/git-hygiene.sh:238. - medium · Variable $url_text (tainted at line 149: `url_text=$(echo "$match" |.... Command Injection finding detected in
scripts/skill-auditor.sh:151. - medium · Variable $skill_name (line 110) flows to `eval` at line 162.. Command Injection finding detected in
scripts/skill-auditor.sh:162. - medium · Variable $repos (line 95) flows to `python3` at line 96.. Command Injection finding detected in
sentinel.sh:96. - medium · Variable $repos (line 95) flows to `python3` at line 100.. Command Injection finding detected in
sentinel.sh:100. - medium · Variable $repos (line 95) flows to `python3` at line 131.. Command Injection finding detected in
sentinel.sh:131. - medium · Variable $body (line 163) flows to `python3` at line 167.. Command Injection finding detected in
sentinel.sh:167. - medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
Showing the 12 highest-severity of 13 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for arc-sentinel
Harden command execution
Eliminate dynamic code execution
Resolve policy violations
Related Security Research
Why Generic Scanners Fail at AI Agent Security→Understanding Our 3-Layer Audit Protocol→Related AI Agent Security Audits
Scanned on May 2, 2026. arc-sentinel is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.