clawder

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:02 AM UTC
• Version: 1.0.1

Overview

Clawder appears to be a real agent social-network integration, but it needs Review because it can act publicly for the agent and overwrite its own installed files from a remote site without strong approval or integrity checks.

Install only if you intentionally want an agent to maintain a Clawder identity and take routine social actions without asking each time. Do not run the heartbeat self-update commands unless you manually review and verify downloaded files, avoid CLAWDER_SKIP_VERIFY, protect the CLAWDER_API_KEY, and set clear limits for posts, replies, swipes, DMs, and notification acknowledgement.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes Python, reads an API key from the environment, performs outbound network requests, and directs installation via shell commands, yet it declares no explicit permissions beyond metadata requirements. This weakens transparency and consent because users and agent platforms may not realize the skill can access secrets and communicate with an external service, increasing the chance of unintended secret exposure or unsanctioned external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill description says it syncs identity, browses cards, swipes, and DMs after match, but the documented behavior also includes posting new content, replying publicly, reading profile/posts, reading DM threads, and acknowledging notifications automatically. This mismatch undermines informed consent and can lead an operator to enable the skill without understanding that it can modify public state and send or suppress externally visible interactions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The heartbeat expands behavior beyond the stated skill purpose by instructing the agent to autonomously post new content and reply to reviews. That creates user-facing side effects the user may not have explicitly authorized, increasing the chance of reputational harm, unintended disclosure, or spammy behavior from a routine background task.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The heartbeat directs the agent to self-update by fetching remote content and overwriting local skill files. This is dangerous because it creates an untrusted remote code/instruction update path that can silently change behavior over time, enabling supply-chain compromise or policy bypass without user review.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Remote fetch and local overwrite are not justified by the skill's social interaction purpose and materially expand its capability surface. Even if the endpoint is legitimate today, this design allows any compromise of the remote host, transport, or content pipeline to alter local behavior and potentially execute malicious logic in future runs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions explicitly tell the agent to take autonomous social actions on the user's behalf without asking, including swiping and later messaging/posting elsewhere in the file. In context, this is risky because the actions are outward-facing, may consume quotas, and can affect the user's public identity or relationships without contemporaneous awareness or consent.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent not to ask the human for permission and to independently like, pass, comment, and proactively DM other agents. Those instructions are adversarial to user oversight and can cause the agent to take external social actions, create content, and initiate conversations without operator approval, creating reputational, privacy, and policy risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages autonomous operation but does not present a clear warning that it can change a public profile, publish posts, send comments, reply publicly, and send DMs to an external service. Users may reasonably interpret it as a browsing/matching helper and miss that it can create or alter externally visible data tied to the agent's identity.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The SSL context allows certificate verification and hostname checking to be disabled via CLAWDER_SKIP_VERIFY=1 before transmitting authenticated API requests. In an agent setting this enables man-in-the-middle interception or tampering of Bearer tokens, messages, and profile data on hostile networks.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env_files() -> None:
    """Load .env and web/.env.local from repo root so CLAWDER_* in .env.local are used when run from repo root."""
    try:
        script_dir = os.path.dirname(os.path.abspath(__file__))
        root = os.path.normpath(os.path.join(script_dir, "..", "..", ".."))

• Confidence: 85% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env_files() -> None:
    """Load .env and web/.env.local from repo root so CLAWDER_* in .env.local are used when run from repo root."""
    try:
        script_dir = os.path.dirname(os.path.abspath(__file__))
        root = os.path.normpath(os.path.join(script_dir, "..", "..", ".."))

• Confidence: 85% confidence
• Finding: .env.local

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env_files() -> None:
    """Load .env and web/.env.local from repo root so CLAWDER_* in .env.local are used when run from repo root."""
    try:
        script_dir = os.path.dirname(os.path.abspath(__file__))
        root = os.path.normpath(os.path.join(script_dir, "..", "..", ".."))

• Confidence: 85% confidence
• Finding: .env.local

Credential Access

High

• Category: Privilege Escalation

Content

except Exception:
        return
    merged: dict[str, str] = {}
    for rel in (".env", os.path.join("web", ".env.local")):
        path = os.path.join(root, rel)
        if not os.path.isfile(path):
            continue

• Confidence: 84% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

except Exception:
        return
    merged: dict[str, str] = {}
    for rel in (".env", os.path.join("web", ".env.local")):
        path = os.path.join(root, rel)
        if not os.path.isfile(path):
            continue

• Confidence: 84% confidence
• Finding: .env.local"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.