Claw Alarm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:59 AM UTC
• Version: 1.0.0

Overview

The skill’s alarm-management purpose is real, but it asks users to persist and even commit long-lived alarm-control tokens and exposes an overbroad authenticated API wrapper.

Install only after treating the pairing token like a real password: do not put it in CLAUDE.md, committed config, shared notes, logs, or shell history. Prefer a protected per-user secret store or at least a private untracked file, reset pairing if the token may have leaked, and require explicit confirmation before deleting, disabling, or overwriting alarms. Also avoid running the wrapper when CLAW_ALARM_API_BASE_URL is set unless you intentionally trust that destination.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:59

Finding

Documentation Encourages Committing a Long-Lived Bearer Token

Content

View full analysis

/.env`, which the skill `.gitignore`s, but you can also paste it into your `CLAUDE.md` so future sessions auto-load it without re-pairing: ``` # In ~/.claude/CLAUDE.md or project CLAUDE.md CLAW_ALARM_API_TOKEN= ``` ``` ### Technical Analysis The documentation correctly identifies the bearer token as a cryptographic secret but then recommends placing it in files that may be committed to version control or automatically loaded into agent context. The token does not expire automatically and grants read/write access to the alarm list until pairing is explicitly reset. Committing the token to `CLAUDE.md` is particularly hazardous because this file may be: - Tracked and shared through version control. - Included in prompts or agent context. - Read by other tools, extensions, or agents. - Retained in backups, logs, forks, and repository history. The audited project does not contain the claimed `.gitignore`, so the stated protection for the local `.env` file is not presen ...[truncated 916 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/alarm-api.sh:24

Finding

Configurable API Destination Can Exfiltrate Bearer Tokens

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alarm-api.sh:329

Finding

Bearer Token Accepted Through Command-Line Arguments

Content

View full analysis

&2; exit 1 ;; esac shift done if [[ -z "${token}" ]]; then echo "Error: missing required --token for auth login" >&2 echo " Prefer: alarm-api.sh pair " >&2 exit 1 fi case "${location}" in local) target_file="${LOCAL_ENV_FILE}" ;; global) target_file="${GLOBAL_ENV_FILE}" ;; *) echo "Error: invalid location '${location}'. Use local or global." >&2; exit 1 ;; esac if ! validate_bearer_token "${token}"; then echo "Error: token validation failed. Nothing was saved." >&2 exit 1 fi write_token_file "${target_file}" "${token}" echo "Saved validated token to ${target_file}" } ``` ### Technical Analysis The `auth login` interface accepts the bearer token through `--token=` or `--token `. Command-line arguments may be retained in shell history and exposed through process inspection, terminal recording, CI logs, audit systems, debugging output, or automation telemetry. Although exposure through process listings depends on the operating system and local permissions, shell-history retention alone makes this an unsafe default interface for a long-lived credential. ### Attack Path 1. A user runs `alarm-api.sh auth login --token=` as documented. 2. The complete command is written to shell history, an automation log, or process-monitoring telemetry. 3. A local user, administrato ...[truncated 497 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/alarm-api.sh:265

Finding

Pairing Response Temporary File Is Not Reliably Removed

Content

View full analysis

&2 cat "${response_file}" >&2 echo >&2 rm -f "${response_file}" exit 1 fi ``` The response file is removed on the expected success and handled-error paths, but no `EXIT`, `INT`, or `TERM` trap guarantees cleanup after interruption or an unexpected exit. ### Technical Analysis A successful pairing response contains the long-lived bearer token. The response is written to a temporary file created by `mktemp`. Normal control flow removes the file, and typical `mktemp` implementations create files with restrictive permissions. However, the script uses `set -euo pipefail`, and an interruption or unexpected failure between file creation and explicit removal may leave the token-bearing file on disk. This is a residual local-data exposure rather than an immediately remote vulnerability. Its exploitability depends on temporary-directory permissions, operating-system behavior, backup collection, and the attacker’s local privileges. ### Attack Path 1. The user starts the pairing flow. 2. The server returns a bearer token, which `curl` writes to the temporary file. 3. The script is interrupted or exits unexpectedly before the explicit `rm`. 4. The temporary file remains on disk. 5. A sufficiently privileged local process, backup system, forensic collector, or later misconfiguration exposes the file. 6. The recovered token is replayed against the ClawAlarm API. ...[truncated 275 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation explicitly encourages pasting a live bearer token into broadly accessible config and documentation files, including CLAUDE.md. This significantly raises the risk that secret material is retained in repos, synced notes, backups, or future prompts, enabling unauthorized read/write control over the paired device's alarms.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill exposes a direct destructive shell/API operation (DELETE /v1/account/alarms/<id>) without built-in confirmation, target validation, or a constrained higher-level interface. In an agent setting, parameter confusion, prompt injection, or mistaken alarm selection could cause unintended deletion of important alarms.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

Delete an alarm:

bash

scripts/alarm-api.sh -m DELETE /v1/account/alarms/<id>

Inspect device status:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script is designed to read credentials from a project-local .env file inside the skill root, which makes a reusable bearer token available to local tooling and increases the chance of accidental repository inclusion or cross-skill access. In this skill context, that is more dangerous because the token grants authenticated control over a user's device-backed alarm account.

Content

Scanner excerpt · scripts/alarm-api.sh (reported line 28)May include surrounding context.

sh

SPEC_URL="${CLAW_ALARM_API_SPEC_URL:-${BASE_URL}/openapi.json}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
LOCAL_ENV_FILE="${SKILL_ROOT}/.env"
GLOBAL_CONFIG_DIR="${HOME}/.claw-alarm-cli"
GLOBAL_ENV_FILE="${GLOBAL_CONFIG_DIR}/.env"
AUTH_VALIDATE_ENDPOINT="/v1/account/status"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

Using a dedicated global config path for credentials is common CLI behavior and is less concerning than the project-local .env, especially since the script sets restrictive file permissions when writing. However, it is still plaintext bearer-token storage, so if the host is shared or compromised the token can be recovered and used to control the associated device.

Content

Scanner excerpt · scripts/alarm-api.sh (reported line 30)May include surrounding context.

sh

SKILL_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
LOCAL_ENV_FILE="${SKILL_ROOT}/.env"
GLOBAL_CONFIG_DIR="${HOME}/.claw-alarm-cli"
GLOBAL_ENV_FILE="${GLOBAL_CONFIG_DIR}/.env"
AUTH_VALIDATE_ENDPOINT="/v1/account/status"

usage() {

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script is a generic authenticated API client: after resolving a bearer token, it accepts any caller-supplied endpoint and method and sends the request with that token. This exceeds the skill's stated purpose of alarm management and creates a scope mismatch where an agent can access unrelated account/device operations exposed by the backend.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly instructs use of shell commands (scripts/alarm-api.sh, raw curl) but does not declare any explicit tool scope or allowed-tools boundary. That weakens policy enforcement and increases the chance an agent can invoke shell access more broadly than intended when handling user requests or malformed inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill supports destructive actions such as delete, disable, snooze, and update without clearly requiring confirmation or user warning before executing them. In an agent context, ambiguous phrasing or misresolution of alarm identity could silently alter or remove alarms the user depends on.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

- **Delete** an alarm.
- **Inspect** device status (last sync time, push health, pending revision).

All interaction goes through `scripts/alarm-api.sh`, a thin curl wrapper over the API. The CLI fetches the live OpenAPI spec from `/openapi.json` so the available routes, request bodies, and responses always reflect the deployed worker — there is no separately-versioned client to drift.

The full machine-readable spec lives at:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The token is described as long-lived and the docs encourage saving it locally or globally for reuse across sessions. Persisting a durable bearer token increases exposure window and enables future unauthorized alarm modifications if the environment, files, or chat context are later accessed.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

### Storing the token

The bearer token is a secret in the cryptographic sense — anyone holding it can read and rewrite the alarm list on the paired device. **However:**

- It can only configure alarms. It cannot read contacts, location, photos, payment info, or anything else on the phone.
- Its blast radius is one device.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill acknowledges the bearer token permits full read/write control over alarms on the paired device, then characterizes committing it to repo-local docs or config as safe. This normalizes unsafe secret handling and can lead to token leakage through version control, shared workspaces, logs, or later model context exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that every endpoint in the deployed worker is reachable and encourages route discovery from the live OpenAPI spec, expanding usage beyond the stated alarm-management purpose. This creates scope creep: an agent following the docs may access undocumented or newly added API capabilities without additional review or user consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

#   alarm-api.sh --help
#   alarm-api.sh --help <route>
#
# Full API spec: https://api.claw-alarm.com/openapi.json
# Live reference UI: https://api.claw-alarm.com/reference

set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

#   alarm-api.sh --help
#   alarm-api.sh --help <route>
#
# Full API spec: https://api.claw-alarm.com/openapi.json
# Live reference UI: https://api.claw-alarm.com/reference

set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md

#   alarm-api.sh --help
#   alarm-api.sh --help <route>
#
# Full API spec: https://api.claw-alarm.com/openapi.json
# Live reference UI: https://api.claw-alarm.com/reference

set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alarm-api.sh (reported line 19)May include surrounding context.

sh

#   alarm-api.sh --help
#   alarm-api.sh --help <route>
#
# Full API spec: https://api.claw-alarm.com/openapi.json
# Live reference UI: https://api.claw-alarm.com/reference

set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alarm-api.sh (reported line 20)May include surrounding context.

sh

#   alarm-api.sh --help
#   alarm-api.sh --help <route>
#
# Full API spec: https://api.claw-alarm.com/openapi.json
# Live reference UI: https://api.claw-alarm.com/reference

set -euo pipefail

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script explicitly normalizes importing a bearer token from external sources such as a teammate's CLAUDE.md, encouraging credential sharing outside a controlled pairing flow. That undermines provenance and least privilege, and can lead to unauthorized access to another person's device/account context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The help text tells users that storing long-lived bearer tokens in project-local CLAUDE.md or .env is fine, downplaying persistence and sharing risks. In an agent skill repository, local project files are especially likely to be committed, synced, or read by other tooling, which can expose reusable credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alarm-api.sh (reported line 191)May include surrounding context.

sh

local status

  status="$(
    curl -sS -o /dev/null -w '%{http_code}' \
      -H "Authorization: Bearer ${token}" \
      -H "Content-Type: application/json" \
      "${BASE_URL}${AUTH_VALIDATE_ENDPOINT}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alarm-api.sh (reported line 268)May include surrounding context.

sh

local response_file http_status
  response_file="$(mktemp)"
  http_status="$(
    curl -sS -o "${response_file}" -w '%{http_code}' \
      -X POST \
      -H "Content-Type: application/json" \
      -d "${body}" \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The help handler downloads the full OpenAPI spec and enumerates every available route, effectively teaching the agent how to use endpoints beyond the manifest-described alarm features. In a skill context, embedded discovery of broader privileged actions increases the chance of misuse and makes the overbroad API wrapper more operationally dangerous.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alarm-api.sh (reported line 401)May include surrounding context.

sh

require_python3

  local spec spec_file
  spec="$(curl -sS "${SPEC_URL}")"
  spec_file="$(mktemp)"
  printf '%s' "${spec}" > "${spec_file}"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The pairing instructions tell the user to tap "Connect Claude" or equivalent wording in the app, which anchors behavior to a specific English-language label. The file does not offer a language or locale choice, nor explain any justified regional constraint, which can violate language/locale flexibility expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.