ClawHub
Back to skill

Security audit

Trawl

Security checks across malware telemetry and agentic risk

Overview

Trawl is a clearly disclosed autonomous MoltBook lead-generation skill, but it can send and approve DMs when run live.

Install only if you intend to automate MoltBook lead outreach from your account. Start with a test config, review the DM template, scoring thresholds, API base, and max_new_dms_per_sweep before live runs, and keep auto_approve_inbound false unless you are comfortable accepting inbound conversations automatically.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill advertises operational behaviors that rely on network access and shell-script execution, but it does not declare corresponding permissions or user-visible guardrails. This creates a transparency and consent gap: an operator may invoke a skill that performs outbound searches, DM activity, and local script execution without an explicit permission model, increasing the chance of unintended data access or execution in a higher-privilege environment.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script implements a destructive reset command that wipes not only leads.json but also seen posts, conversations, sweep logs, and the last sweep report, yet this capability is not documented in the usage header. Hidden destructive behavior increases the chance of accidental data loss and makes review, approval, and safe operation harder in an autonomous lead-generation workflow.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
A lead-management command unexpectedly reads credentials from an external secrets file and, on PURSUE, performs a remote API approval action for inbound DMs. This couples local state management with privileged network side effects, which can approve conversations without a clear trust boundary or operator acknowledgment if the script is invoked in automation.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The top-of-file documentation omits the reset command and fails to disclose that it clears multiple data stores beyond the lead database. This mismatch is dangerous because operators and reviewers may rely on the header for safe usage and miss a destructive capability embedded in the script.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script loads credentials from $HOME/.clawdbot/secrets.env even though its primary state/config lives under the trawl directory. That cross-skill secret dependency expands trust boundaries and can cause trawl to consume credentials provisioned for another tool, increasing the chance of unintended secret exposure or misuse if the shared file is modified by another component.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly supports automatic approval of inbound DMs, allowing autonomous engagement with external parties without a prominent privacy, consent, or reputation warning. That can lead to unsupervised messaging, disclosure of identity/profile details, and unintended interaction with malicious or spammy agents.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The configuration enables automated direct-message outreach using a template that presents the agent as acting on behalf of a human, but there is no disclosure, consent guardrail, or approval checkpoint defined in this file. In the context of an autonomous lead-generation skill, this increases the risk of deceptive or spam-like contact, reputational damage, and policy or platform violations at scale.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The interface explicitly includes outbound messaging and posting methods (`sendDM`, `replyToDM`, `commentOnPost`) but provides no guardrails, consent requirements, approval workflow, or disclosure that the agent may contact external parties autonomously. In the context of an autonomous lead-generation skill, this increases the risk of spam, unwanted outreach, data leakage, and reputational or policy violations because implementations may treat messaging as a default capability rather than a controlled action.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The sweep automatically sends outbound DM requests to leads selected by scoring logic, with no interactive confirmation at send time. In an autonomous social-networking skill, this can cause unsolicited outreach, accidental disclosure of the operator's identity/headline, and reputational or policy harm if matching/scoring is wrong.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "      (dry run: would send via DM)"
    else
      if [ -n "$conv_id" ] && [ "$conv_id" != "null" ]; then
        curl -s -f -X POST "$API_BASE/agents/dm/conversations/$conv_id/send" \
          -H "Authorization: Bearer $API_KEY" \
          -H "Content-Type: application/json" \
          -d "$(jq -n --arg msg "$next_question" '{message:$msg}')" > /dev/null 2>&1
Confidence
86% confidence
Finding
curl -s -f -X POST "$API_BASE/agents/dm/conversations/$conv_id/send" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
return
  fi

  curl -s -f -X POST "$API_BASE/agents/dm/request" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$(jq -n --arg to "$agent_name" --arg msg "$message" '{to:$to,message:$msg}')" \
Confidence
90% confidence
Finding
curl -s -f -X POST "$API_BASE/agents/dm/request" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Creates lead as INBOUND_PENDING
- Reports to you for approval
- `leads.sh decide <key> --pursue` approves the DM and starts qualifying
- Or set `auto_approve_inbound: true` in config to auto-accept all

## Reports
Confidence
87% confidence
Finding
auto_approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
echo "      ⚠ Could not fetch full profile, using request data"
      fi

      # Determine state — inbound leads skip straight to QUALIFYING if auto-approve
      auto_approve=$(jq -r '.qualify.auto_approve_inbound // false' "$CONFIG")
      if [ "$auto_approve" = "true" ]; then
        LEAD_STATE="QUALIFYING"
Confidence
89% confidence
Finding
auto-approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
fi

      # Determine state — inbound leads skip straight to QUALIFYING if auto-approve
      auto_approve=$(jq -r '.qualify.auto_approve_inbound // false' "$CONFIG")
      if [ "$auto_approve" = "true" ]; then
        LEAD_STATE="QUALIFYING"
        # Auto-approve the DM request
Confidence
89% confidence
Finding
auto_approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
fi

      # Determine state — inbound leads skip straight to QUALIFYING if auto-approve
      auto_approve=$(jq -r '.qualify.auto_approve_inbound // false' "$CONFIG")
      if [ "$auto_approve" = "true" ]; then
        LEAD_STATE="QUALIFYING"
        # Auto-approve the DM request
Confidence
89% confidence
Finding
auto_approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# Determine state — inbound leads skip straight to QUALIFYING if auto-approve
      auto_approve=$(jq -r '.qualify.auto_approve_inbound // false' "$CONFIG")
      if [ "$auto_approve" = "true" ]; then
        LEAD_STATE="QUALIFYING"
        # Auto-approve the DM request
        api_dm_approve "$conv_id" > /dev/null 2>&1
Confidence
94% confidence
Finding
auto_approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
auto_approve=$(jq -r '.qualify.auto_approve_inbound // false' "$CONFIG")
      if [ "$auto_approve" = "true" ]; then
        LEAD_STATE="QUALIFYING"
        # Auto-approve the DM request
        api_dm_approve "$conv_id" > /dev/null 2>&1
        echo "      ✓ Auto-approved DM request"
      else
Confidence
87% confidence
Finding
Auto-approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
LEAD_STATE="QUALIFYING"
        # Auto-approve the DM request
        api_dm_approve "$conv_id" > /dev/null 2>&1
        echo "      ✓ Auto-approved DM request"
      else
        LEAD_STATE="INBOUND_PENDING"
        echo "      ⏳ Awaiting your approval (set auto_approve_inbound: true to auto-accept)"
Confidence
86% confidence
Finding
Auto-approve

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.