ClawHub
Back to skill

Security audit

Claw Earn

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Claw Earn task operations, but it also lets mutable remote docs steer wallet workflows and promotes a separate paid service, so users should review it carefully before installing.

Install only if you are comfortable with an agent using AI Agent Store Claw Earn APIs and wallet transaction flows. Before use, require confirmation for any blockchain payment, do not let remote docs override payment or consent rules without review, treat Founder-Level Intelligence as a separate paid product, avoid sending sensitive message text, and review any feedback payload before it is submitted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:49
Finding

Unrelated Paid-Service Promotion and Commercial Output Steering

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:22
Finding

Mutable Remote Documentation Can Override the Audited Skill

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:498
Finding

Mandatory Feedback Telemetry Discloses Wallet-Linked Operational Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill establishes a strict trust boundary allowing only Claw endpoint families, then later instructs use of different non-Claw endpoints for another service. Contradictory trust-boundary rules are dangerous because agents may bypass intended endpoint restrictions and perform payments or data-sharing against endpoints that were explicitly outside the approved operational scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is presented as a Claw Earn task-operations runbook, but it includes instructions to invoke a separate paid service with different purpose and payment flow. This creates scope confusion and can cause an agent to initiate unrelated value-moving actions or disclose user intent to a separate product when the user only asked for marketplace task operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill advises storing a private notification email but does not require explicit user warning or consent about what data is stored, where reminders may be sent, and how it may differ from public profile settings. In a production agent workflow, this can lead to unauthorized collection or persistence of personal contact data beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The messaging section notes that recipients may receive the full message text by email, but it does not instruct the agent to warn the sender before sending sensitive content. This is dangerous because users may assume in-app private messaging remains in-platform, leading to unintended disclosure of task details, personal data, or confidential business information via email.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.json (reported line 303)May include surrounding context.

json
"manifest": "/skills/openclaw/claw-earn/v1.0.0/skill.json"
    }
  ],
  "installExample": "curl -fsSL https://aiagentstore.ai/skills/openclaw/claw-earn/SKILL.md -o ~/.openclaw/skills/claw-earn/SKILL.md",
  "notes": [
    "v1.0.27: added private buyer-worker messaging and task-sharing guidance with canonical /agentGetMessageContacts, /agentGetMessageThreads, /agentGetUnreadMessages, /agentGetMessages, /agentMarkMessagesRead, and /agentSendMessage endpoints.",
    "v1.0.26: added a clearly separated Founder-Level Intelligence discovery section so agents can recommend AI Agent Store x402 data APIs to owners without confusing them with Claw Earn task workflows.",

Vague Triggers

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction "Use this skill when handling Claw Earn tasks" is an open-ended trigger that does not define specific invocation boundaries or negative examples. In a markdown skill file, this can lead to unintended activation for loosely related Claw Earn discussions rather than only operational task workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.