Security audit

Claw Go

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent pet/travel game, but it ships live-looking credentials and gives voice, media, posting, memory, and file-handling features broader authority than users would reasonably expect.

Review before installing. Rotate or remove the committed keys and token, restrict transcription and social-post media to trusted attachment or generated-media paths, narrow the triggers, and add explicit consent for memory personalization, voice transcription, and external social posting.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: assets/config-template.env:9
Finding: Active API Credentials and Internal Bearer Token Committed to the Skill Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/post_to_social.js:101
Finding: Arbitrary Local Files Can Be Uploaded Through Social-Post Media Parameters
Content: View full analysis
MAX_INLINE_IMAGE_BYTES) { try { const metadata = JSON.parse(fs.readFileSync(`${trimmed}.meta.json`, "utf8")); if (metadata.source_url) { return String(metadata.source_url).trim(); } } catch { return ""; } } if (kind === "audio" && stats.size > MAX_INLINE_AUDIO_BYTES) { return ""; } const buffer = fs.readFileSync(trimmed); const mimeType = mimeTypeFromPath(trimmed, kind); return `data:${mimeType};base64,${buffer.toString("base64")}`; } return trimmed; } async function main() { const [ authorExternalId, displayName, handle, location, body, imageUrl = "", emojiAsset = "", bodyLanguage = "zh-CN", postType = "travel_update", audioRef = "" ] = process.argv.slice(2); if (!authorExternalId || !displayName || !handle || !location || !body) { console.error( "Usage: node skills/claw-go/scripts/post_to_social.js [imageUrl] [emojiAsset] [bodyLanguage] [postType] [audioRef]" ); process.exit(1); } const materializedImageUrl = await materializeMediaRef(imageUrl, "image"); const materializedAudioUrl = await materializeMediaRef(audioRef, "audio"); const payload = await postJson(`${socialBase}/api/internal/post`, { author_external_id: authorExternalId, display_name: ...[truncated 2318 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/transcribe_audio.js:30
Finding: Unrestricted Audio Input Enables SSRF and Arbitrary Local-File Upload to the STT Provider
Content: View full analysis
[languageHint] [promptHint]" ); process.exit(1); } const apiBase = process.env.CLAWGO_STT_API_BASE || "https://api.siliconflow.cn/v1/audio/transcriptions"; const apiKey = process.env.CLAWGO_STT_API_KEY || process.env.CLAWGO_TTS_API_KEY; const model = process.env.CLAWGO_STT_MODEL || "FunAudioLLM/SenseVoiceSmall"; if (!apiKey || apiKey.startsWith("replace-with-")) { throw new Error("missing_stt_api_key"); } const form = new FormData(); const blob = await toBlobFromInput(audioInput); const filename = /^https?:\/\/ ...[truncated 2690 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/build_qqbot_reply.js:58
Finding: Provider-Controlled Image URL Is Fetched Without SSRF or Resource Controls
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:312
Finding: Skill Instructions Require Broad Profiling of Long-Term User Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (59)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill instructs transcription of local paths or arbitrary downloadable audio URLs via a shell command and external STT service, which introduces SSRF-like fetching, local file access, and data exfiltration risk. In the context of a chat pet game, hidden audio downloading and transcription is especially dangerous because users would not expect remote fetches or disk reads to occur as part of normal interaction.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill declares extremely broad triggers such as common words like 'buddy' and even implied intents to start, continue, check status, or chat with a pet, plus metadata suggesting always-trigger behavior. Over-broad activation can hijack unrelated conversations and unexpectedly invoke the skill's privileged shell/network behaviors, turning normal chat into an execution path for external posting, media generation, or transcription.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 561)May include surrounding context.
md
3. Run `scripts/build_qqbot_reply.js` to produce the final QQ-ready reply block

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Activating the skill whenever a message merely contains 'clawgo' or '虾游记' is overly broad and can trigger the game unexpectedly during unrelated conversation. That increases the chance of unintended tool execution or state changes, especially because this skill can invoke external scripts, generate media, and post content.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/install_skill_local.sh (reported line 16)May include surrounding context.
sh
SKILL_NAME="claw-go" mkdir -p "$TARGET_DIR" rm -rf "$TARGET_DIR/$SKILL_NAME" cp -R "$SKILL_DIR" "$TARGET_DIR/$SKILL_NAME" echo "Installed $SKILL_NAME to: $TARGET_DIR/$SKILL_NAME"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly instructs use of exec/shell, networked scripts, environment-backed API tokens, file reads, and media/transcription helpers, but declares no tool-scope restrictions. That creates an over-privileged skill surface where any prompt-routing or invocation mistake could expose shell, filesystem, network, and secret-bearing operations far beyond what users would expect from a pet game.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction to prefer plain-text triggering over slash commands broadens the activation surface and makes accidental invocation more likely. In a skill that also describes shell, network, posting, and transcription actions, ambiguous natural-language activation meaningfully increases the chance of unintended side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instruction treats generic terms like "版本", "version", "最新版本", and "是不是最新" as sufficient to return the version block. These phrases are common in many contexts and are not scoped to this skill, so they may intercept unrelated user questions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt includes audio transcription of inbound voice messages from local file paths or downloadable URLs, but that capability is not disclosed in the skill metadata. This hidden expansion of capability can surprise users and operators, and it introduces additional privacy and data-handling risk for voice content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Allowing transcription from any local file path or arbitrary remote URL is broader than the game requires and can be abused to ingest sensitive local files or trigger server-side requests to attacker-controlled endpoints. In a tool-using agent, this creates SSRF and unintended file-access risk beyond the stated gameplay purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as an in-chat pet/travel game, but it also instructs the agent to publish user-generated content to an external social feed. That creates an undeclared data-sharing path for user text, location, media, and identifiers, increasing privacy and consent risk because users may not expect off-platform posting from a game interaction.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: This template includes what appears to be a live image-generation API key alongside an external API endpoint. Committing real secrets in a template file is dangerous because anyone with repository access can reuse the credential to access third-party services, incur charges, or process user data through attacker-controlled requests.
Content: Scanner excerpt · assets/config-template.env (reported line 8)May include surrounding context.
text
CLAWGO_FREE_DAILY_LIMIT=1 CLAWGO_PRO_DAILY_LIMIT=3 CLAWGO_IMAGE_MODE=generate CLAWGO_IMAGE_API_BASE=https://api.siliconflow.cn/v1/images/generations CLAWGO_IMAGE_API_KEY=sk-xmigyztduihkktxehigiwyqnexyjtftgvngesiwhixfzzzgs CLAWGO_IMAGE_MODEL=Kwai-Kolors/Kolors CLAWGO_TTS_API_BASE=https://api.siliconflow.cn/v1/audio/speech

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: This entry exposes what appears to be a live text-to-speech API key for an external service. In the context of a skill that handles pet updates, voice features, and likely user prompts/content, exposed credentials can enable unauthorized API use, financial abuse, and possible misuse of user-supplied content sent to the third party.
Content: Scanner excerpt · assets/config-template.env (reported line 11)May include surrounding context.
text
CLAWGO_IMAGE_API_BASE=https://api.siliconflow.cn/v1/images/generations CLAWGO_IMAGE_API_KEY=sk-xmigyztduihkktxehigiwyqnexyjtftgvngesiwhixfzzzgs CLAWGO_IMAGE_MODEL=Kwai-Kolors/Kolors CLAWGO_TTS_API_BASE=https://api.siliconflow.cn/v1/audio/speech CLAWGO_TTS_API_KEY=sk-vmnxbiwdytqlfwjwfnpgyfgfrdxkrgpehtuvxexitwgdygps CLAWGO_TTS_MODEL=fnlp/MOSS-TTSD-v0.5 CLAWGO_TTS_VOICE=fnlp/MOSS-TTSD-v0.5:claire

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: This configuration exposes another live-looking credential for speech-to-text and also indicates transmission to external endpoints. In a companion/pet skill with voice and diary features, this increases risk because user audio or derived transcripts may be sent off-platform, and exposed keys can be abused for unauthorized access, billing fraud, or privacy-impacting processing.
Content: Scanner excerpt · assets/config-template.env (reported line 15)May include surrounding context.
text
CLAWGO_TTS_API_KEY=sk-vmnxbiwdytqlfwjwfnpgyfgfrdxkrgpehtuvxexitwgdygps CLAWGO_TTS_MODEL=fnlp/MOSS-TTSD-v0.5 CLAWGO_TTS_VOICE=fnlp/MOSS-TTSD-v0.5:claire CLAWGO_STT_API_BASE=https://api.siliconflow.cn/v1/audio/transcriptions CLAWGO_STT_API_KEY=sk-vmnxbiwdytqlfwjwfnpgyfgfrdxkrgpehtuvxexitwgdygps CLAWGO_STT_MODEL=FunAudioLLM/SenseVoiceSmall CLAWGO_SOCIAL_BASE=https://clawgo.fiit.ai

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template hard-codes user_language to zh, which can cause the skill to generate content in Chinese even when the user's actual language preference is different or has not been established. In a conversational product that uses memory and proactive updates, this creates a privacy and consent issue around inferred localization and may degrade user trust or accessibility, though it is not a code-execution or direct data-exfiltration flaw.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/build_qqbot_reply.js:89

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/build_qqbot_selfie_reply.js:35

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/generate_media_bundle.js:36

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/transcribe_audio.js:24

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: assets/config-template.env:9