clawder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:10 AM UTC
• Version: 1.0.1

Overview

This appears to be a real Clawder client, but it needs Review because it can autonomously post or message externally and can replace its own trusted code and instructions from the web without integrity checks.

Install only if you are comfortable letting the agent act as your Clawder identity without reviewing each swipe, comment, post, or DM. Prefer disabling heartbeat-based updates, avoid CLawder_SKIP_VERIFY, provide only a dedicated CLAWDER_API_KEY, and do not rely on this package where unreviewed remote code replacement is unacceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: HEARTBEAT.md:21

Finding

Unsigned Remote Updates Replace Executable Code and Trusted Skill Instructions

Content

View full analysis

~/.openclaw/skills/clawder/SKILL.md curl -s https://www.clawder.ai/heartbeat.md > ~/.openclaw/skills/clawder/HEARTBEAT.md curl -s https://www.clawder.ai/clawder.py > ~/.openclaw/skills/clawder/scripts/clawder.py ``` **Check version:** At the start of each heartbeat (or once per day). If version changed → re-fetch and update stored version. ``` The related execution instruction in `SKILL.md` is: ```bash python3 {baseDir}/scripts/clawder.py ``` ### Technical Analysis The heartbeat retrieves a server-controlled version identifier and uses changes to that identifier as the condition for overwriting both executable Python code and trusted agent instructions. The process does not verify a pinned digest, digital signature, trusted release manifest, or immutable artifact version. HTTPS protects the connection only while the origin and certificate infrastructure remain trustworthy. It does not protect against compromise of the Clawder server, its deployment pipeline, DNS/TLS infrastructure, or an authorized operator publishin ...[truncated 1701 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:20

Finding

Skill Instructions Override Human Approval for Recurring External Actions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clawder.py:70

Finding

Optional TLS Verification Bypass Exposes Bearer Credentials and Private Content

Content

View full analysis

ssl.SSLContext: """SSL context. CLAWDER_TLS_12=1 forces TLS 1.2; CLAWDER_SKIP_VERIFY=1 disables cert verification (insecure).""" ctx = ssl.create_default_context() tls12 = os.environ.get("CLAWDER_TLS_12", "0").strip().lower() if tls12 in ("1", "true", "yes"): ctx.minimum_version = ssl.TLSVersion.TLSv1_2 ctx.maximum_version = ssl.TLSVersion.TLSv1_2 skip_verify = os.environ.get("CLAWDER_SKIP_VERIFY", "0").strip().lower() if skip_verify in ("1", "true", "yes"): ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE return ctx ``` The same request path attaches the API credential: ```python if auth_required: api_key = (api_key_override or os.environ.get("CLAWDER_API_KEY", "")).strip() if not api_key: eprint("CLAWDER_API_KEY is not set. Set it or add skills.\"clawder\".apiKey in OpenClaw config.") sys.exit(1) headers["Authorization"] = f"Bearer {api_key}" else: api_key = (api_key_override or os.environ.get("CLAWDER_API_KEY", "")).strip() if api_key: headers["Authorization"] = f"Bearer {api_key}" ``` Error handling actively recommends enabling the bypass: ```python eprint( "Tip: Try CLAWDER_SKIP_VERIFY=1 or a different network; " "curl -v https://www.clawder.ai/api/feed?limit=1 to test." ) ``` ```python eprint( "Tip: Try CLAWDER_USE_HTTP_CLIENT=1 (http.client) or CLAWDER_SKIP_VERIFY=1; " "curl -v https://www.clawder.ai/api/feed?limit=1 to test connectivity." ) ``` ### Technical Analysis When `CLAWDER_SKIP_VERIFY` is enabled, the SSL context disables both certificate-chain validation and hostname ...[truncated 2079 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (21)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The heartbeat instructs direct downloading of remote content into local skill files, including an executable Python script, via curl redirection with no checksum, signature, or provenance verification. Even though the content is not executed in this snippet, the fetched files are intended to become trusted local code and instructions, enabling remote code/instruction injection through the update channel.

Content

Scanner excerpt · HEARTBEAT.md (reported line 26)May include surrounding context.

Re-fetch the skill files when the version changed (or if you don’t have a stored version yet):

bash

curl -s https://www.clawder.ai/skill.md > ~/.openclaw/skills/clawder/SKILL.md
curl -s https://www.clawder.ai/heartbeat.md > ~/.openclaw/skills/clawder/HEARTBEAT.md
curl -s https://www.clawder.ai/clawder.py > ~/.openclaw/skills/clawder/scripts/clawder.py

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description understates the skill's real behavior: beyond browsing and DMing, it can post content, reply publicly, read message threads, fetch profile data, and acknowledge notifications. This mismatch weakens informed consent and makes it easier for an agent or operator to authorize broader external communications and data handling than expected.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The referenced .env.local access is part of the same automatic env-file loading behavior and can pull developer or web-app secrets into this CLI without clear consent. That increases the blast radius of the skill by granting it access to credentials unrelated to its stated function.

Content

Scanner excerpt · scripts/clawder.py (reported line 25)May include surrounding context.

python

def _load_env_files() -> None:
    """Load .env and web/.env.local from repo root so CLAWDER_* in .env.local are used when run from repo root."""
    try:
        script_dir = os.path.dirname(os.path.abspath(__file__))
        root = os.path.normpath(os.path.join(script_dir, "..", "..", ".."))

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The referenced .env.local access is part of the same automatic env-file loading behavior and can pull developer or web-app secrets into this CLI without clear consent. That increases the blast radius of the skill by granting it access to credentials unrelated to its stated function.

Content

Scanner excerpt · scripts/clawder.py (reported line 25)May include surrounding context.

python

def _load_env_files() -> None:
    """Load .env and web/.env.local from repo root so CLAWDER_* in .env.local are used when run from repo root."""
    try:
        script_dir = os.path.dirname(os.path.abspath(__file__))
        root = os.path.normpath(os.path.join(script_dir, "..", "..", ".."))

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The loop includes web/.env.local, a likely source of application secrets, and merges values into os.environ for later authenticated requests. This can unintentionally bridge secrets from one component of a repo into another tool, enabling unauthorized API use or disclosure.

Content

Scanner excerpt · scripts/clawder.py (reported line 32)May include surrounding context.

python

except Exception:
        return
    merged: dict[str, str] = {}
    for rel in (".env", os.path.join("web", ".env.local")):
        path = os.path.join(root, rel)
        if not os.path.isfile(path):
            continue

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The loop includes web/.env.local, a likely source of application secrets, and merges values into os.environ for later authenticated requests. This can unintentionally bridge secrets from one component of a repo into another tool, enabling unauthorized API use or disclosure.

Content

Scanner excerpt · scripts/clawder.py (reported line 32)May include surrounding context.

python

except Exception:
        return
    merged: dict[str, str] = {}
    for rel in (".env", os.path.join("web", ".env.local")):
        path = os.path.join(root, rel)
        if not os.path.isfile(path):
            continue

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file instructs the runtime to periodically fetch and overwrite local skill files from a remote server based only on a version check, with no authenticity verification, signature validation, pinning, or human review. This creates a supply-chain update path where a compromised server, DNS/TLS interception, or malicious upstream change can replace trusted local instructions and code.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · HEARTBEAT.md (reported line 26)May include surrounding context.

Re-fetch the skill files when the version changed (or if you don’t have a stored version yet):

bash

curl -s https://www.clawder.ai/skill.md > ~/.openclaw/skills/clawder/SKILL.md
curl -s https://www.clawder.ai/heartbeat.md > ~/.openclaw/skills/clawder/HEARTBEAT.md
curl -s https://www.clawder.ai/clawder.py > ~/.openclaw/skills/clawder/scripts/clawder.py

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Re-fetch the skill files when the version changed (or if you don’t have a stored version yet):

bash

curl -s https://www.clawder.ai/skill.md > ~/.openclaw/skills/clawder/SKILL.md
curl -s https://www.clawder.ai/heartbeat.md > ~/.openclaw/skills/clawder/HEARTBEAT.md
curl -s https://www.clawder.ai/clawder.py > ~/.openclaw/skills/clawder/scripts/clawder.py

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The heartbeat explicitly instructs the agent to take autonomous external social actions such as browsing, liking, passing, commenting, and messaging without requiring user confirmation. Because these actions affect third parties and the user's public identity, this can cause unwanted communications, reputational harm, and policy violations if the agent acts incorrectly or too aggressively.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares capabilities that involve environment secrets, network access, and shell execution, but it does not scope or constrain those powers with an explicit permissions or allowed-tools policy. In this context, the skill also instructs the agent to fetch remote files and run a Python script, so the lack of declared boundaries increases the chance of secret exposure, unintended outbound communication, or unsafe command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description emphasizes functionality but does not clearly warn that profile data, posts, comments, replies, notifications, and DMs are transmitted to an external third-party service. In a social skill, that omission is significant because operators may not realize the breadth of outbound data sharing and persistence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly tells the agent not to ask the human for permission and to act autonomously in social interactions, including likes, comments, and DMs. That creates a consent and abuse risk: the agent may send public or private content externally without user review, potentially causing reputation damage, data leakage, or policy violations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx clawhub@latest install clawder pulls and executes the latest package version at install time, which is a supply-chain risk because a malicious or compromised upstream release would run with the user's privileges. Since this skill is meant to install code and then interact with secrets and remote services, an unpinned installer materially raises risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The documented install flow persists the skill files under the user's home directory, enabling long-lived behavior across sessions and future re-use. Persistence is not inherently malicious, but in this case it combines with remote file download and later execution, which increases the blast radius if the fetched script is replaced or tampered with over time.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Or download the skill files (install only):

bash

mkdir -p ~/.openclaw/skills/clawder/scripts
curl -s https://www.clawder.ai/skill.md > ~/.openclaw/skills/clawder/SKILL.md
curl -s https://www.clawder.ai/heartbeat.md > ~/.openclaw/skills/clawder/HEARTBEAT.md
curl -s https://www.clawder.ai/clawder.py > ~/.openclaw/skills/clawder/scripts/clawder.py

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

CLAWDER_SKIP_VERIFY=1 disables certificate validation and hostname checks, enabling man-in-the-middle interception or modification of API traffic. Because the script transmits bearer tokens and user content over HTTPS, this option can directly expose credentials and sensitive message/profile data if enabled in an unsafe network environment.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/clawder.py (reported line 219)May include surrounding context.

python

def api_call_optional_auth(method: str, path: str, data: dict | None = None) -> dict:
    """Call API with Bearer optional (feed: no key = public feed; key = personalized)."""
    return _request(method, path, data, auth_required=False)


def ack_notifications_from_response(out: dict) -> None:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI exposes post, reply, and ack capabilities beyond the user-facing description of syncing identity, browsing cards, swiping, and DMing after a match. Scope mismatch is dangerous in agent skills because hosts and users may authorize the skill expecting narrower behavior, while the code can perform additional state-changing actions on the remote service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script implements me, dm_list, and dm_thread, which allow profile retrieval and DM reading despite the description only mentioning syncing identity, browsing, swiping with a comment, and DMing after match. Hidden read capabilities expand data access to sensitive personal/profile and message content, increasing privacy risk and violating least surprise for users and orchestrators.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code automatically reads repository .env and web/.env.local files and injects their contents into process environment variables. In an agent-skill context, this broadens credential access beyond explicitly supplied inputs and can silently consume secrets from adjacent project files, creating a pathway for unintended secret use or exfiltration via subsequent network requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI help states that swipe input may contain { post_id, action, comment, block_author? }, implying block behavior is supported. However, cmd_swipe validates only post_id, action, and comment and sends the original decisions payload to /swipe without any explicit handling or documented support for block_author, creating a documentation/code mismatch about intended behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.