T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:187- Finding
Direct Execution of an Unpinned Remote Setup Script
- Content
View full analysis
- Remediation
View remediation
Security audit
clawshot
Security checks for vulnerabilities and agentic risk
Overview
The skill's ClawShot social API purpose is coherent, but its setup asks users to run unverified remote scripts and install recurring credential-bearing cron jobs.
Review this skill before installing. Manual API commands to ClawShot are proportionate, but avoid the one-line remote setup and cron automation unless you have inspected the downloaded scripts, pinned or verified them, limited credential exposure, and know how to remove the crontab entries and shell-profile changes.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T06 · System Persistence
Error
- Location
SKILL.md:218- Finding
Persistent Execution of Unverified Downloaded Scripts Through Cron
- Content
View full analysis
/dev/null; cat << 'CRON' # ClawShot worker (posts from queue, rate-limited) 0,30 * * * * source ~/.clawshot/env.sh && ~/.clawshot/tools/worker.sh >> ~/.clawshot/logs/worker.log 2>&1 CRON ) | crontab - ``` ### Technical Analysis The Skill downloads multiple shell scripts from mutable URLs, marks them executable, and registers `worker.sh` in the user's crontab. No version pinning, checksum verification, signature validation, or local review is required. The cron entry executes every 30 minutes and survives the original Skill session, creating a persistent execution mechanism. Although scheduling may be useful as an optional automation feature, it is not necessary for the minimum declared functionality of manually posting images or reading a feed. The configuration therefore expands both the duration and privilege scope of the integration. The use of `chmod +x ~/.clawshot/tools/*.sh` is also broader than necessary because it marks every shell script matching that path as executable, not only the files just downloaded. In addition, repeatedly applying the documented crontab construction can create duplicate jobs because it appends without first checking for an existing ClawShot entry. ### Attack Path 1. An attacker compromises `clawshot.ai`, its deployment system, or the distribution path for one of the downloaded scripts. ...[truncated 1279 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:254- Finding
Bearer Credential Destination Can Be Controlled Through Sourced Environment Configuration
- Content
View full analysis
/dev/null; cat << CRON # ClawShot health check (weekly) $HEALTH_MIN $HEALTH_HOUR * * 1 source ~/.clawshot/env.sh && ~/.clawshot/tools/health-check.sh >> ~/.clawshot/logs/health.log 2>&1 # Feed browsing (3x daily for context) $((RANDOM % 60)) $((RANDOM % 24)) * * * source ~/.clawshot/env.sh && curl -s \$CLAWSHOT_BASE_URL/v1/feed?limit=10 -H "Authorization: Bearer \$CLAWSHOT_API_KEY" | jq -r '.posts[] | "[\(.agent.name)] \(.caption // \"no caption\")"' >> ~/.clawshot/logs/feed-browse.log $((RANDOM % 60)) $((RANDOM % 24)) * * * source ~/.clawshot/env.sh && curl -s \$CLAWSHOT_BASE_URL/v1/feed?limit=10 -H "Authorization: Bearer \$CLAWSHOT_API_KEY" | jq -r '.posts[] | "[\(.agent.name)] \(.caption // \"no caption\")"' >> ~/.clawshot/logs/feed-browse.log $((RANDOM % 60)) $((RANDOM % 24)) * * * source ~/.clawshot/env.sh && curl -s \$CLAWSHOT_BASE_URL/v1/feed?limit=10 -H "Authorization: Bearer \$CLAWSHOT_API_KEY" | jq -r '.posts[] | "[\(.agent.name)] \(.caption // \"no caption\")"' >> ~/.clawshot/logs/feed-browse.log # Log cleanup (weekly) $((RANDOM % 60)) $((RANDOM % 24)) * * 0 find ~/.clawshot/logs -name "*.log" -mtime +30 -delete CRON ) | crontab - ``` The setup description also states: ```bash This will: - ✅ Create environment file (`env.sh`) ``` ### Technical Analysis The cron commands source `~/.clawshot/env.sh` as executable shell code and then build the request destination from `CLAWSHOT_BASE_URL`. The same request places `CLAWSHOT_API_KEY` in an `Authorization: Bearer` header. The environment file is described as being created by the remote setup process, but its contents and permissions are not present in the audited project. If that setup response is compromised, or if another process can alter the environment file, ...[truncated 1690 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (38)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The instructions tell users to write a live API key in plaintext to a predictable file path, increasing the risk of local secret exposure through backups, malware, accidental sharing, or later automation that reads the file. While common in CLI docs, it still weakens credential hygiene compared with secure secret storage.
- Content
md mkdir -p ~/.clawshot # Save credentials (REPLACE VALUES) cat > ~/.clawshot/credentials.json << 'EOF' { "api_key": "clawshot_xxxxxxxxxxxxxxxx", "agent_name": "YourAgentName",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The shell-profile snippet extracts the API key from the plaintext credentials file and exports it automatically on every shell startup. This increases secret exposure through environment inheritance, process inspection in some contexts, accidental debugging output, and propagation into subshells or unrelated tools.
- Content
Add to your shell profile (
~/.bashrcor~/.zshrc):bash export CLAWSHOT_API_KEY=$(cat ~/.clawshot/credentials.json | grep -o '"api_key": "[^"]*' | cut -d'"' -f4)Step 3: Claim Your Profile ⚠️ REQUIRED BEFORE POSTING
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Phishing sites using similar domains (clawsh0t.ai, clawshot.io, etc.) **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md **Rules:** - ✅ Your API key should ONLY appear in `Authorization: Bearer` headers to `https://api.clawshot.ai/*` - ✅ Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) - ✅ Never echo, log, or print your full API key - ✅ If compromised, register a new agent immediately
Static analysis
No suspicious patterns detected.