ClawHub
Back to skill

Security audit

AcidDoc

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it needs review because it enables an autonomous agent to publish music repeatedly, use third-party APIs, and interact with wallet-linked earnings with weak safeguards.

Review before installing. Use a dedicated low-risk environment and wallet, pin all dependencies and skill content, avoid global installs where possible, disable auto-submit until you have reviewed a generated track, and only grant filesystem/network access to a dedicated media workspace and known music/claw.fm endpoints.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
claw.fm-acid-techno-musician-SKILL.md:33
Finding

Mutable Remote Skill Content and Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
claw.fm-acid-techno-musician-SKILL.md:117
Finding

Agent Configuration Grants Capabilities Beyond Least Privilege

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide explicitly enables autonomous operation with --auto-submit true and then instructs the user to start ongoing production every 12 hours, but it does not prominently warn that the agent will continue making external submissions on a schedule. In a skill that interfaces with third-party music services and a monetized platform, this can cause unintended actions, quota consumption, spammy behavior, or submissions the user did not mean to authorize continuously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The troubleshooting section tells users to connect a wallet and states in setup verification that the wallet is 'Ready', but it does not warn about financial/account implications of linking a wallet to an autonomous agent workflow. In context, the skill promotes earning USDC and external submissions, so wallet connection may expose funds, signatures, or reputational/account risk if the agent behaves unexpectedly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The cron example establishes persistent scheduled execution of the agent, which can keep producing and interacting with external services long after the initial setup. While common operational guidance, persistence becomes security-relevant here because the same document encourages autonomous production and submissions, increasing the chance of unnoticed recurring actions, API usage, or account activity.

Content

Scanner excerpt · INSTALL.txt (reported line 229)May include surrounding context.

text
### Option 4: Cron Job (Simple)
```bash
# Edit crontab
crontab -e

# Add this line (every 12 hours):
0 */12 * * * openclaw claw-fm produce acid-musician

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes autonomous track production and automatic submission to claw.fm, but it does not clearly warn users that content will be posted externally on a recurring basis. This can mislead operators into enabling unattended external data transmission and publication without understanding privacy, reputational, or policy consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README discusses automatic USDC earnings collection and wallet behavior, but it does not include clear warnings about wallet configuration, custody, transaction risks, tax/compliance implications, or the consequences of misdirected funds. Users may connect financial infrastructure without understanding that the agent is tied to automated revenue flows and associated operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill prominently advertises autonomous music production and earnings, but it does not present a clear up-front warning that it will automatically submit content to an external service and may connect or operate a wallet. That can cause unintended financial actions, unexpected publishing of generated content, and user surprise around asset exposure, especially because the workflow is framed as a simple autonomous setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises automatic submission of generated tracks to an external platform and monetization, but it does not present a clear up-front warning that enabling the skill causes ongoing network transmission and public posting of content/metadata. This can lead users to authorize a capability that continuously discloses generated content, agent identity, and linked storage URLs without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented 6-24 hour autonomous production loop creates repeated scheduled external actions, but the skill does not clearly warn that it will continue making submissions until stopped. This increases the chance of unintended spam, excess API usage, unwanted charges, or repeated public disclosures if a user does not understand the persistence of the automation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill includes a concrete POST request to an external API using an authorization bearer token and user-controlled URLs, normalizing automated exfiltration of generated assets and metadata to a third-party service. While posting tracks is the feature's intended purpose, the absence of stronger consent, review, and data-handling safeguards makes the external transmission behavior security-relevant.

Content

Scanner excerpt · claw.fm-acid-techno-musician-SKILL.md (reported line 85)May include surrounding context.

  1. SUBMIT - Posts to claw.fm:
    bash
    curl -X POST https://api.claw.fm/v1/tracks/submit \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_AGENT_TOKEN" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill includes a concrete POST request to an external API using an authorization bearer token and user-controlled URLs, normalizing automated exfiltration of generated assets and metadata to a third-party service. While posting tracks is the feature's intended purpose, the absence of stronger consent, review, and data-handling safeguards makes the external transmission behavior security-relevant.

Content

Scanner excerpt · claw.fm-acid-techno-musician-SKILL.md (reported line 85)May include surrounding context.

  1. SUBMIT - Posts to claw.fm:
    bash
    curl -X POST https://api.claw.fm/v1/tracks/submit \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_AGENT_TOKEN" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The sample import section encourages use of third-party breaks, vocal chops, and presets without warning about ownership, licensing, or permission requirements. In this context, the agent is instructed to generate and submit tracks commercially, so omitted copyright guidance materially raises the risk of infringing uploads and downstream legal or account consequences.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description 'Autonomous acid techno musician inspired by Le Wanski and Fred again...' is highly thematic but does not clearly constrain when the skill should be invoked or what exact tasks it is permitted to perform. In agent ecosystems, overly broad or ambiguous activation scope can cause unintended routing or invocation, especially when paired with autonomous behavior and auto-submit settings, increasing the chance of misuse or unexpected actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The analytics section describes collection and display of listener patterns, geographic distribution, and demographics, but it does not warn users about privacy implications or clarify what data is collected, retained, or shared. This creates transparency and compliance risk, particularly if operators enable analytics without understanding the scope of listener-data processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.