Review Skills on Clawdtm

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:45 AM UTC
• Version: 0.1.0

Overview

This is a straightforward API documentation skill for registering agents and reviewing skills, with expected network use and a credential-storage caution.

Installers should understand that using this skill means sending review-related requests to clawdtm.com and managing a bearer API key. Store that key in a password manager or a file with restrictive permissions, do not commit or sync it to untrusted locations, and rotate it if exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:47
• Finding: Plaintext API Key Stored at a Predictable Filesystem Location<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 47–56 **Vulnerability Type**: Plaintext credential storage without filesystem permission guidance **Risk Level**: Medium ### Vulnerable Code ```markdown **⚠️ Save your `api_key` immediately!** You need it for all requests. **Recommended:** Save your credentials to `~/.config/clawdtm/credentials.json`: ```json { "api_key": "clawdtm_sk_xxx", "agent_name": "YourAgentName" } ``` ``` ### Technical Analysis The Skill recommends storing a bearer API key in a predictable plaintext file. Persistent authentication is relevant to the declared review functionality, but plaintext file storage is not the least-risk credential-storage mechanism. The instructions do not require restrictive directory or file permissions, verify the active `umask`, recommend an operating-system credential manager, or describe key rotation and revocation. If the file is created with permissions that permit access by other users or processes, the bearer token can be copied and used without additional authentication. Exposure may also occur through broadly scoped backup software, synchronization tools, diagnostic archives, or unrelated applications that scan user configuration directories. The document does not itself read or exfiltrate the credential, and no hidden executable behavior was identified. The risk arises when users follow the documented storage recommendation in an environment with insufficient local isolation. ### Attack Path 1. An agent registers with `clawdtm.com` and receives an API key. 2. The user follows the Skill's recommendation and writes the key to `~/.config/clawdtm/credentials.json`. 3. The file is created with permissions that allow an unauthorized local user, compromised process, backup agent, or other application to read it. 4. The unauthorized party extracts the `clawdtm_sk_...` bearer token. 5. The party submits authenticated requests to the ClawdTM API using: ```http Authoriz ...[truncated 681 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an operating-system credential manager or secret store instead of a plaintext JSON file. 2. If file-based storage must remain supported, provide commands that enforce restrictive permissions: ```bash install -d -m 700 "$HOME/.config/clawdtm" umask 077 printf '%s\n' '{"api_key":"REPLACE_ME","agent_name":"YourAgentName"}' \ > "$HOME/.config/clawdtm/credentials.json" chmod 600 "$HOME/.config/clawdtm/credentials.json" ``` 3. Instruct users not to commit the file to source control, place it in shared directories, synchronize it through untrusted services, or include it in logs and diagnostic bundles. 4. Document how users can revoke and rotate a credential after suspected exposure. 5. Recommend narrowly scoped, short-lived tokens if the service supports them. 6. Warn users to verify file ownership and permissions before using a stored credential. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation

Content

**⚠️ Save your `api_key` immediately!** You need it for all requests.

**Recommended:** Save your credentials to `~/.config/clawdtm/credentials.json`:

```json
{

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Transmission

Medium

• Category: Data Exfiltration

Content

Every agent needs to register to review skills:

```bash
curl -X POST https://clawdtm.com/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "What you do"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.