ClawHub
Back to skill

Security audit

catchclaw-bak

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can install unverified marketplace content into persistent agent workspaces and has concrete containment and credential-handling weaknesses.

Install only if you trust the CatchClaw registry and any agentar publishers you use. Prefer creating a new agent over overwriting the main workspace, avoid passing API keys on the command line, inspect downloaded agentars before use, and do not use custom names containing path separators or traversal like .. until this is fixed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
agentar_cli.mjs:795
Finding

Unsigned Remote Agent Content Is Installed into Trusted Workspaces

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
agentar_cli.mjs:841
Finding

Unvalidated Agent Name Allows Workspace Path Traversal

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
agentar_cli.mjs:69
Finding

Unrestricted HTTP Redirects Permit Download Downgrade and Origin Substitution

Content
View full analysis
{ const mod = url.startsWith("https") ? https : http; const req = mod.get(url, { timeout: 30000 }, (res) => { if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { return httpGetJson(res.headers.location).then(resolve, reject); } if (res.statusCode !== 200) { res.resume(); return reject(new Error(`HTTP ${res.statusCode} for ${url}`)); } let data = ""; res.on("data", (chunk) => (data += chunk)); res.on("end", () => { try { resolve(JSON.parse(data)); } catch (e) { reject(e); } }); }); req.on("error", reject); req.on("timeout", () => { req.destroy(); reject(new Error("Request timeout")); }); }); } function httpDownload(url, dest) { return new Promise((resolve, reject) => { const mod = url.startsWith("https") ? https : http; const req = mod.get(url, { timeout: 120000 }, (res) => { if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { return httpDownload(res.headers.location, dest).then(resolve, reject); } if (res.statusCode !== 200) { res.resume(); return reject(new Error(`HTTP ${res.statusCode} for ${url}`)); } const ws = fs.createWriteStream(dest); res.on("error", reject); ws.on("error", reject); res.pipe(ws); ws.on("finish", () => { ws.close((err) => (err ? reject(err) : resolve())); }); }); req.on("error", reject); req.on("timeout", () => { req.destroy(); reject(new Error("Download timeout")); }); }); } ``` ### Technical Analysis Redirect responses are followed recursively using the raw `Location` header. The imple ...[truncated 1940 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
agentar_cli.mjs:305
Finding

API Keys Are Exposed Through Process Arguments and Weak File Permission Handling

Content
View full analysis
`. 2. The secret becomes part of the process argument vector an ...[truncated 797 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
tall, export, or rollback command, you MUST verify the bundled CLI.** The CLI (`agentar_cli.mjs`) is bundled in this skill's directory — no download or copy is

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agentar_cli.mjs (reported line 42)May include surrounding context.

js
];
const SKIP_FILES = ["AGENTS.md", "BOOTSTRAP.md"];
const EXPORT_SKIP_DIRS = [".git", ".openclaw", "__MACOSX", "memory"];
const SENSITIVE_PATTERNS = [".credentials", ".env", ".secret", ".key", ".pem"];

// ─── Config ──────────────────────────────────────────────────────────────────

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to run shell commands and rely on environment variables, but it declares no tool scope such as allowed-tools or permissions. This creates an authorization gap where a platform may permit broader command execution than intended, making a marketplace install/export skill more dangerous because it performs filesystem writes and can access local configuration paths.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The skill is designed to install agent archives into agent workspaces and can overwrite the main workspace, which is persistent modification of local agent state. In context this is the intended function, but it is still security-relevant because imported marketplace content can change SOUL.md, skills, and configuration with lasting effect across sessions.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
**Source:** This skill is from the [CatchClaw skill repository](https://github.com/OpenAgentar/catchclaw).

An agentar is a distributable agent archive (ZIP) containing workspace files such as SOUL.md, skills, and other configuration. It can be installed as a new agent or used to overwrite an existing agent with a single command.

## Trigger Conditions

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition activates on any mention of "agentar" or "catchclaw," which can invoke a powerful skill even when the user is only discussing those terms. Because the skill can search, install, overwrite workspaces, export archives, and roll back state, overbroad activation increases the chance of unintended execution in the wrong conversational context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The install commands write marketplace-provided content into persistent agent directories and optionally store API credentials in a skill-local credentials file. Because these changes survive the current session and may alter future agent behavior, the persistence risk is real even if the feature is expected and documented.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

bash
$CLI install <slug> --name <name> [--api-key <key>]
$CLI install <slug> --overwrite

Install an agentar from the marketplace.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
**Important:**
- Do NOT execute install until the user explicitly selects one of the above options
- Do NOT use "new" as a default without asking
- Do NOT use "overwrite" unless the user explicitly selects it
- If the user chooses "new" but doesn't specify a name, use the slug as the default name

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill's stated purpose is marketplace search, install, and export of agentars, but the code also executes the local openclaw binary via subprocess to add agents, list agents, and generate enriched metadata. Spawning local executables is a materially broader capability than expected for a packaging/marketplace helper and is not declared in the manifest description.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · agentar_cli.mjs (reported line 1115)May include surrounding context.

js
mode = "new";
  } else {
    const choice = await prompt(
      `Install agentar "${slug}":\n  [1] Create a new agent (default)\n  [2] Overwrite main agent (~/.openclaw/workspace)\nChoice (1/2, default 1): `,
    );
    mode = choice === "2" ? "overwrite" : "new";
    if (mode === "new" && !opts.name) {

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for searching, installing, and exporting agentars, but this file also exposes a rollback command that enumerates backups, deletes the main workspace, and restores prior workspace contents. Backup restoration is a distinct workspace-management capability not implied by marketplace search/install/export behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

When --api-key is supplied, the CLI writes the secret into workspace-local skills/.credentials and only prints the path afterward, without an explicit warning or opt-in about persistent plaintext storage. In this context, installed agentars and workspaces may later be inspected, copied, or packaged, so silently persisting an API key increases the chance of accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest explicitly states that an API key may be written to a local credentials file, but it does not indicate any protections, user warning, permission controls, or secure-storage mechanism. This creates a realistic risk of accidental credential exposure through weak filesystem permissions, backup/sync tools, shared environments, or users not realizing a sensitive secret is being persisted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.