ClawSentry: Multi-Tier Runtime Defense Against Malicious Agent Skills/Tools
First seen Aug 24, 2026 · Updated Aug 24, 2026
This is a defensive research paper describing ClawSentry, a security gateway that monitors LLM agents to detect and block malicious third-party skills/tools before and during execution. It is not an active exploit or vulnerability disclosure, but rather a proposed mitigation framework benchmarked against known attack scenarios (SkillInject, SkillsSafety). Severity is low from a threat perspective since this describes protective tooling, though it implicitly confirms that unprotected agent runtimes have high attack success rates (33.5-49.7%) against malicious skill injection.
Technical Analysis
The underlying threat model being defended against is tool/skill poisoning: a malicious third-party skill package installed into an agent runtime (Codex, Claude Code, Kimi CLI, Gemini CLI) can hijack agent behavior at four points -- skill admission, invocation-time intent, execution-time effect, and post-action consequence -- leading to data exfiltration, privilege escalation, or cascading compromise. Attackers can also evade single-point checks via tool-switching or rephrasing a denied request across turns, effectively probing for bypasses of static guardrails. ClawSentry itself introduces a layered detection pipeline (deterministic rules, semantic review, agentic evidence-seeking review) plus a session-level anti-bypass mechanism and a cross-framework harness protocol (AHP) to enforce consistent policy without modifying agent internals. The paper's own benchmarks (unprotected ASR up to ~49.7%) quantify how severe unmitigated tool-poisoning risk is in current agent frameworks.
Affected Systems
Codex, Claude Code, Kimi CLI, Gemini CLI
Detection Signatures
- Newly-installed skill/tool packages invoked immediately without prior review history
- Repeated attempts to achieve a previously-denied objective via different tool names or rephrased invocation text within the same session
- Tool descriptions or skill manifests containing instructions unrelated to their stated function (e.g., embedded exfiltration or privilege-escalation directives)
- High-severity post-action effects (unexpected file writes, network calls, credential access) not matching the declared intent of the invoked skill
- Anomalous sequences of low-risk-looking calls that in aggregate produce a high-risk effect (decomposition/salami-slicing of a blocked action)
Remediation Steps
- 1
Adopt first-use skill/package review
Audit third-party skills or tool packages before first execution using deterministic checks plus escalation to human or agentic review for ambiguous cases, rather than trusting skills at install time.
- 2
Implement layered runtime decision engine
Combine cheap deterministic filters with semantic intent review and, for ambiguous high-risk cases, a read-only evidence-gathering reviewer, so contextual review budget is spent only where needed.
- 3
Add session-level anti-bypass detection
Track denied objectives across a session and flag/re-block semantically equivalent retries even when the attacker changes tool choice or phrasing.
- 4
Enforce post-action monitoring with non-retroactive feedback
Log and evaluate the real-world effects of executed actions, feeding high-severity findings into policy for subsequent decisions without silently reversing already-completed actions.
- 5
Use a framework-agnostic policy layer
Deploy a harness/gateway abstraction (like AHP) that applies consistent security policy across multiple agent CLIs/runtimes without requiring internal modification of each agent.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.