ClawHub
Back to skill

Security audit

clawflows

Security checks for vulnerabilities and agentic risk

Overview

The skill’s automation purpose is disclosed, but it can download mutable workflows that exercise sensitive local capabilities and external AI APIs without clearly documented permission controls.

Review each automation YAML before running it, use check and dry-run first, avoid workflows that request email, calendar, database, or external AI access unless you intend those actions, and treat the global npm install and SkillBoss API key as sensitive trust decisions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned npm Package Is Installed Globally

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-14 and 23-27
Vulnerability Type: Unpinned global third-party dependency
Risk Level: Medium

Vulnerable Code

yaml
metadata:
  clawdbot:
    requires:
      bins: ["clawflows"]
    install:
      - id: node
        kind: node
        package: clawflows
        bins: ["clawflows"]
        label: "Install ClawFlows CLI (npm)"
bash
npm i -g clawflows

Technical Analysis

The Skill declares and recommends installation of the clawflows npm package without specifying an exact version or package integrity value. Consequently, installation resolves to whatever package release is current in the npm registry at execution time. The reviewed Skill therefore does not define an immutable dependency corresponding to the version that was originally assessed.

The use of -g increases the affected scope because the package is installed into the user's global Node.js environment. npm packages may also contain lifecycle scripts that run during installation. If the package, maintainer account, release process, or npm distribution channel is compromised, a malicious release could execute code with the permissions of the user performing the installation.

No evidence establishes that the current package is malicious. The vulnerability is the mutable and unverified supply-chain trust boundary.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, or its release pipeline.
  2. The attacker publishes a malicious version under the existing clawflows package name.
  3. A user follows the Skill instructions and runs npm i -g clawflows, or the Skill framework processes the unpinned installation metadata.
  4. npm retrieves the attacker-controlled current release.
  5. Malicious package code or lifecycle scripts execute with the installing user's privileges.
  6. The globally installed executable remains available ...[truncated 632 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specifically audited version in both installation metadata and documentation, such as clawflows@1.0.0.
  • Use a lockfile or equivalent mechanism containing verified package integrity hashes.
  • Prefer a project-local installation over npm i -g to limit the package's reach and prevent global command replacement.
  • Verify package provenance through signed releases, npm provenance attestations, and a controlled publication process.
  • Audit all transitive dependencies and npm lifecycle scripts before approving a release.
  • Where operationally possible, install with lifecycle scripts disabled and explicitly execute only reviewed setup steps.
  • Avoid elevated installation privileges and document that the package must not be installed with sudo or an administrator account.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:49
Finding

Mutable Remote Automations Can Invoke Privileged Local Capabilities

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-70
Vulnerability Type: Retrieval and execution of remote workflow definitions
Risk Level: High

Vulnerable Code

markdown
### Install an automation

```bash
clawflows install youtube-competitor-tracker

Downloads to ./automations/youtube-competitor-tracker.yaml

List installed automations

bash
clawflows list

Run an automation

bash
clawflows run youtube-competitor-tracker
clawflows run youtube-competitor-tracker --dry-run

The --dry-run flag shows what would happen without executing.

text

The downloaded workflows can resolve abstract capabilities to concrete local skills, as demonstrated elsewhere in the same file:

```yaml
steps:
  - capability: youtube-data
    method: getRecentVideos
    args:
      channels: ["@MrBeast"]
    capture: videos

  - capability: database
    method: upsert
    args:
      table: videos
      data: "${videos}"

Technical Analysis

The documented installation command downloads a YAML automation from an external registry, and the run command subsequently interprets that automation. The effective behavior can therefore change independently of the reviewed SKILL.md.

These automations resolve abstract capability and method names to locally installed skills. The documented capability set includes database access, calendar operations, email, social search, and external AI services. A workflow supplied by an untrusted or compromised registry may therefore direct existing local skills to process sensitive data or perform externally visible actions.

The reviewed documentation does not specify cryptographic signature verification, immutable version or content-hash pinning, a mandatory capability permission manifest, argument-level authorization, sandboxing, or required user approval before sensitive operations. The optional --dry-run command ...[truncated 2030 chars]

Remediation
View remediation

Remediation Suggestions

  • Require registry automations to be cryptographically signed by trusted publishers and reject unsigned or invalid artifacts.
  • Pin every installation to an immutable version and content digest rather than resolving an automation solely by mutable name.
  • Display a complete permission manifest before installation and execution, including capabilities, methods, data sources, destinations, network hosts, and anticipated side effects.
  • Require explicit user approval for sensitive capabilities such as email, calendar writes, database mutations, credential use, and external data transmission.
  • Enforce least privilege with per-workflow capability allowlists and argument-level policy checks.
  • Run workflows in a sandbox with restricted filesystem, process, environment-variable, and network access.
  • Prevent workflow definitions from directly accessing secrets. Credentials should remain in brokered providers and be released only to explicitly authorized destinations.
  • Make dry-run inspection mandatory for newly installed or changed workflows, and ensure the preview accurately includes resolved providers, arguments, data flow, and network destinations.
  • Detect registry changes after installation and require renewed approval whenever a workflow's digest or permission manifest changes.
  • Maintain auditable execution logs and provide a mechanism to revoke automation and provider permissions immediately.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly supports installing and running multi-step automations that can download files, write into the local workspace, and invoke other skills or external services, but it does not warn users about those effects. In this context, omission of a safety warning is security-relevant because users may execute third-party automations without understanding that they can modify local data or trigger actions across connected capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation instructs users to set SKILLBOSS_API_KEY and route AI-step inputs to SkillBoss API Hub, but it does not disclose that prompts, inputs, and possibly sensitive workflow data will be sent to an external service. This is dangerous because automations can include user or local data in AI steps, leading to unintended third-party disclosure under a single API credential.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.skillboss.com/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.skillboss.com/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md
def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.skillboss.com/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
        timeout=60,

Static analysis

No suspicious patterns detected.