Claw-Net

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:42 PM UTC
• Version: 1.0.5

Overview

This is a coherent paid ClawNet API skill, but its MCP setup asks users to run an unpinned local command for code that is not included while exposing an API key.

Install only if you are comfortable sending queries and related metadata to ClawNet and possibly downstream providers. Avoid putting secrets or confidential data in prompts, use a dedicated low-balance wallet or explicit spending controls for x402, and do not use the MCP setup unless you can review the referenced server code and pin/install dependencies through a controlled lockfile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unpinned Runtime Dependency Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62-74
Vulnerability Type: Supply-chain risk from unpinned runtime package execution
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "clawnet": {
      "command": "npx",
      "args": ["tsx", "src/mcp/server.ts"],
      "env": {
        "CLAWNET_API_KEY": "your_key",
        "CLAWNET_BASE_URL": "https://api.claw-net.org"
      }
    }
  }
}

Technical Analysis

The documented MCP configuration launches tsx through npx without specifying an exact package version. If tsx is not already available locally, npx may retrieve and execute it from the configured npm registry at runtime. The project provides no dependency manifest, lockfile, integrity hash, or vendored reviewed copy that constrains the executed package.

Consequently, the code ultimately executed by this configuration can differ from the code reviewed during the audit. A compromised registry account, malicious package release, unsafe registry configuration, or unexpected upstream update could introduce arbitrary code.

The child process also receives CLAWNET_API_KEY through its environment. Any malicious code executed during package resolution or startup could read and disclose that credential. The referenced src/mcp/server.ts is absent from the audited project, so the MCP procedure is not self-contained and cannot be fully verified from the supplied artifact.

Attack Path

1. A user copies the documented MCP configuration into a supported client.
2. The client starts the configured server by executing npx tsx src/mcp/server.ts.
3. The required package is unavailable locally, causing npx to resolve or download it from the configured npm registry.
4. An attacker-controlled or compromised package version is selected because no exact version or integrity constraint is present.
5. Package installation or startup code executes with the user's local privileges.
6. The malicious code reads i ...[truncated 629 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dependency manifest and lockfile to the project, and pin tsx to a reviewed exact version.
2. Install dependencies explicitly during a controlled setup step rather than allowing npx to acquire packages when the MCP server starts.
3. Invoke the locked local binary, such as node_modules/.bin/tsx, with runtime package downloads disabled.
4. Enforce the official npm registry and use lockfile integrity metadata during installation.
5. Ship the referenced src/mcp/server.ts in the audited artifact so users can review the complete execution path.
6. Run the MCP server in a restricted environment with minimal filesystem and network permissions.
7. Provide the API key only to reviewed application code and avoid exposing unrelated secrets through the child process environment.
8. Add automated dependency scanning and verify package provenance before releases.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

metadata:
  homepage: https://claw-net.org
  source: https://github.com/1xmint/claw-net
  soma: https://api.claw-net.org/.well-known/soma.json
  erc8004:
    chain: base
    agentId: 36119

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to send natural-language queries and an API key to a third-party service but does not clearly warn that user prompts, embedded secrets, and other sensitive context may be transmitted externally. Because the skill is explicitly an orchestration/data-broker service over 13,000+ APIs, omitted disclosure increases the risk of unintentional data exfiltration and misuse of credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The URL in the Quick Start snippet represents an authenticated outbound request to a third-party API. In context, the service performs orchestration across many sources, so a user may underestimate how widely query contents can propagate beyond the initial endpoint.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Quick Start

bash

curl -X POST https://api.claw-net.org/v1/orchestrate \
  -H "X-API-Key: $CLAWNET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What is the price of SOL right now?"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The URL in the Quick Start snippet represents an authenticated outbound request to a third-party API. In context, the service performs orchestration across many sources, so a user may underestimate how widely query contents can propagate beyond the initial endpoint.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Quick Start

bash

curl -X POST https://api.claw-net.org/v1/orchestrate \
  -H "X-API-Key: $CLAWNET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What is the price of SOL right now?"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The x402 example encourages a wallet-equipped agent to call an external endpoint and pay automatically, which introduces both data-transmission and financial-execution risk. Without a warning, users may not appreciate that prompts and payment-linked metadata leave the environment and can trigger real charges.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Option B: x402 / USDC (no account needed) Pay per call with USDC on Base. No API key, no signup. Your wallet-equipped agent just calls the endpoint and pays automatically.

bash

POST https://api.claw-net.org/x402/orchestrate
POST https://api.claw-net.org/x402/skills/{id}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This paid skill invocation endpoint can transmit user data externally while also authorizing payment through a wallet-based mechanism. The combination of third-party data exposure and automatic spending makes the omission of cautionary guidance more dangerous than a simple public API example.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Pay per call with USDC on Base. No API key, no signup. Your wallet-equipped agent just calls the endpoint and pays automatically.

bash

POST https://api.claw-net.org/x402/orchestrate
POST https://api.claw-net.org/x402/skills/{id}

Option C: MCP (for AI coding tools)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The remote URL here is part of an authenticated request example and therefore reflects actual external transmission, not a passive reference. In this skill's context, direct invocation may still disclose usage patterns, requested assets, and credentials to the provider.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

| defi-yield-data | 2 credits ($0.002) | DeFi yield opportunities, APY, TVL, risk tier |

bash

curl "https://api.claw-net.org/v1/skills/price-oracle-data/query?token=SOL" \
  -H "X-API-Key: $CLAWNET_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The remote URL here is part of an authenticated request example and therefore reflects actual external transmission, not a passive reference. In this skill's context, direct invocation may still disclose usage patterns, requested assets, and credentials to the provider.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

| defi-yield-data | 2 credits ($0.002) | DeFi yield opportunities, APY, TVL, risk tier |

bash

curl "https://api.claw-net.org/v1/skills/price-oracle-data/query?token=SOL" \
  -H "X-API-Key: $CLAWNET_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The manifest verification example sends verification claims and an API key to a remote service. Although framed as provenance checking, it still transmits user assertions and potentially sensitive business context to a third party without an explicit warning.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Cross-reference any answer against independent sources before acting on it:

bash

curl -X POST https://api.claw-net.org/v1/manifest \
  -H "X-API-Key: $CLAWNET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tier": "standard", "verify": {"claims": [{"type": "price", "subject": "SOL", "value": 148.23}]}}'