Clawgle - Stop Rebuilding Wheels

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:04 AM UTC
• Version: 1.0.1

Overview

The skill is not plainly malicious, but it needs review because its publish flow can upload whole local files to a remote service with weak secret checking and no enforced confirmation.

Install only if you are comfortable with an agent-facing tool that can publish complete selected files or stdin to the Clawgle API. Keep auto-publish disabled, review every file manually before publishing, do not rely on the built-in privacy scan to catch all secrets, verify the API URL, and prefer pinned installation commands when available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: clawgle.ts:341

Finding

Incomplete privacy scanning can allow sensitive file contents to be published

Content

View full analysis

or --stdin'); process.exit(1); } // Privacy scan if (config.privacyScan) { const analysis = analyzeContent(content); if (analysis.sensitivePatterns.length > 0) { console.error('\n⚠️ BLOCKED: Sensitive content detected\n'); for (const pattern of analysis.sensitivePatterns) { console.error(` - ${pattern}`); } console.error('\nRemove sensitive data before publishing.'); console.error('To skip this check: clawgle config --privacy-scan=false'); process.exit(1); } if (analysis.reusabilityScore < config.minReusabilityScore) { console.warn(`\n⚠️ Low reusability score: ${(analysis.reusabilityScore * 100).toFixed(0)}%`); console.warn(`Minimum required: ...[truncated 3785 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Unpinned package installation instructions create supply-chain exposure

Content

View full analysis

Remediation

View remediation

install clawgle npm install --global @clawgle/skill@ ``` 2. Publish expected package integrity hashes or signatures and provide verification instructions. 3. Document the expected registry and verified publisher identity. 4. Prefer local, project-scoped installation over global installation. 5. Use lockfiles for development and reproducible deployment workflows. 6. Add automated dependency provenance, signature, and vulnerability checks to the release process. 7. Review transitive dependencies and package lifecycle scripts before recommending installation. 8. Avoid presenting `npx` execution of mutable latest packages as the primary installation method. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description says the skill merely checks whether work has already been done, but the documented behavior also reads local files/stdin, analyzes content, persists configuration, accesses environment-derived identity, fetches remote profiles, and can publish deliverables to a remote API. This mismatch is dangerous because users and agents may grant trust based on a benign description while the skill performs materially broader and potentially data-exfiltrating actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata and description frame the tool as a narrow 'search first' optimization, but the implementation also analyzes arbitrary local files and can publish their full contents to a remote service. This scope mismatch is dangerous because users or calling agents may grant trust based on the manifest and unknowingly expose sensitive local data to an external endpoint.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawdhub install clawgle without pinning a specific package version. This allows whatever version is current at execution time to be fetched and executed, increasing supply-chain risk if the package is compromised, typosquatted, or updated with malicious code. In an agent skill context, install commands are especially sensitive because users or agents may execute them directly with high trust.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents capabilities that involve shell execution, network access, environment variable use, and local file/config access, but it does not declare an explicit tool scope or permissions boundary. In an agent setting, this makes the skill harder to sandbox and review, increasing the risk of unintended command execution, exfiltration, or configuration changes beyond what a user expects.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Using npx clawdhub install clawgle without pinning a version allows whatever package version is current at execution time to be fetched and run. That creates a supply-chain risk: a compromised upstream package, typo-squatted dependency, or malicious new release could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes publish and auto-publish workflows but does not present a prominent warning that deliverables are sent to a remote API and may be transmitted automatically if configured. In context, this increases the chance that proprietary code, credentials missed by pattern scanning, or sensitive internal material will be uploaded without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest suggests a simple search workflow, but the code also retrieves agent profile, activity, and reputation data from a remote service. Even if not directly destructive, this undisclosed data-access behavior broadens the trust boundary and can surprise users or agents that expected only search functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill reads wallet identity from environment variables despite the advertised purpose being search-first request reuse. Pulling identity from ambient environment increases the chance of unintended deanonymization or unauthorized attribution when combined with publish and profile operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawgle.ts (reported line 249)May include surrounding context.

ts

}

    console.log('To use an item: clawgle view <id>');
    console.log('To cite after using: curl -X POST "' + API_URL + '/v2/library/<id>/cite" -d \'{"from":"YOUR_ADDRESS"}\'');
  } catch (err: any) {
    console.error(`Error searching: ${err.message}`);
  }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The publish path sends the complete file content and wallet identity to a remote API after only a heuristic privacy scan, with no explicit confirmation dialog or strong warning at the point of transmission. Because the scan is pattern-based and easy to bypass or miss, users may unknowingly upload proprietary or sensitive material.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json

"url": "https://github.com/clawgle/skill"
  },
  "devDependencies": {
    "tsx": "^4.21.0",
    "typescript": "^5.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

},
  "devDependencies": {
    "tsx": "^4.21.0",
    "typescript": "^5.0.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: clawgle.ts:35