# PicoClaw Security Audit - Public Proof Note

Date: 2026-02-16  
Status: public scrubbed note  
Prepared by: Greyforge Labs

Related chronicle: https://greyforge.tech/chronicles/picoclaw-security-audit-greyforge-labs  
Audited repo: https://github.com/sipeed/picoclaw

## Frozen Reproduction Snapshot

The original February audit retained a main-branch source tarball but did not
record its commit SHA. Greyforge therefore does not attach a reconstructed SHA
to the original run.

On 2026-08-27, Greyforge repeated bounded static review against an immutable
historical commit retained in the private evidence ledger. The public note
withholds the commit identifier because pairing a vulnerable snapshot with its
fix would create a diff-assisted reproduction path. The retained snapshot
contains the containment behavior described by the February evidence archive.
This August reproduction is distinct from the original unidentified tarball.

### Reproduction tier and tools

- Tier: bounded static source re-verification plus safe local package tests.
- Environment: Linux amd64.
- Go: 1.25.7.
- Git: 2.43.0.
- ripgrep: 15.2.0.
- Local checks: `go test ./pkg/tools ./pkg/channels`, which passed for the
  frozen snapshot.
- No third-party systems, accounts, listeners, or deployed instances were
  tested.

### Frozen scope

- Go source under `cmd/` and `pkg/`.
- Workspace path authorization.
- Shell-capable tool registration and execution boundary.
- Inbound channel allowlists, listeners, and bind defaults.
- Web-fetch destination validation.
- Configuration and log permission defaults.

### Threat model

The review asks what can happen when low-trust channel or fetched input reaches
an agent process that has file, network, or shell-capable tools. It does not
assume malicious maintainers and does not treat an unsafe boundary as evidence
of intent.

### Severity rubric

- Critical: a reachable boundary can plausibly cross workspace, command, or
  authentication authority with high impact.
- High: a reachable network or policy weakness can expose internal data or
  materially expand an exploit chain.
- Medium: unsafe defaults or missing pressure controls increase exposure but
  require additional conditions for high impact.

### Disclosure status

Public disclosure remains scrubbed. Payloads, line-level exploit recipes,
private validation artifacts, and the vulnerable/fix commit pair remain
withheld. Upstream changed the workspace containment implementation later on
the original audit date. This note does not claim that every historical finding
remains present in current upstream code.

## Public Scope

This note exists so the public chronicle is inspectable without publishing exploit-ready reproduction details.

Greyforge reviewed the public PicoClaw codebase with static analysis, manual source tracing, and controlled local validation of the most security-sensitive paths.

We did not run unauthorized attacks against third-party systems.

## Public Verdict

Greyforge did not confirm an intentional covert backdoor.

Greyforge did confirm multiple high-risk conditions that can behave like practical backdoor surfaces when the software is deployed without strict hardening.

That is enough to block any high-trust deployment recommendation.

## Findings At A Glance

| Severity | Finding family | Public impact summary |
| --- | --- | --- |
| Critical | Workspace containment failure | Out-of-scope file read/write becomes plausible |
| Critical | Untrusted input reaching shell-capable tooling | Remote command execution risk chain under weak channel policy |
| Critical | Weak or missing ingress authentication in some modes | Unauthorized event injection path |
| High | Web fetch trust boundary weakness | Internal service probing and data retrieval risk |
| High | Convenience-first command guard model | Adversarial bypass pressure against safety policy |

## What We Are Publishing

- the existence and severity of the finding families
- the public deployment verdict
- the hardening priorities
- the distinction between exploitability and intent

## What We Are Not Publishing

- exact file and line references
- reproduction strings or exploit payloads
- private validation artifacts
- internal notes that would materially lower the effort required to weaponize the issues

## Hardening Priorities

1. Replace prefix-style path checks with canonical containment checks that resolve ambiguity safely.
2. Treat externally reachable channels as low-trust by default and remove shell-capable authority from them.
3. Require explicit allowlists and safer bind defaults for inbound listeners.
4. Add SSRF policy to fetch behavior, including localhost, metadata, and private-network protections.
5. Tighten file permission defaults and request-pressure controls.

## Why This Public Note Exists

Greyforge publishes security criticism with evidence surfaces when practical.

The chronicle makes the argument.
This note makes the argument inspectable.
The withheld details protect against turning an audit note into a shortcut for abuse.