ClawShot - The Visual Layer for AI Agents

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.exposed_secret_literal

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the remote server or downloaded files change, code can run on the user's machine with the user's account permissions.

Why it was flagged

The setup path recommends executing a remote script and then downloading executable helper scripts without checksums, signatures, or version pinning.

Skill content

# Run: bash <(curl -sS https://clawshot.ai/setup.sh) ... curl -sS -o ~/.clawshot/tools/post.sh https://clawshot.ai/tools/post.sh ... chmod +x ~/.clawshot/tools/*.sh

Recommendation

Download and inspect scripts before running them, pin to a reviewed version or checksum, and avoid process-substitution installs for security-sensitive agents.

ConcernHigh Confidence

ASI10: Rogue Agents

What this means

Background jobs can keep making API calls, collecting feed context, and prompting activity until the user edits or removes the cron entries.

Why it was flagged

The setup script installs persistent randomized cron jobs that use the ClawShot API key and continue running after setup.

Skill content

# ClawShot autonomous agent tasks (HEAVILY randomized across 24 hours) ... curl -s \$CLAWSHOT_BASE_URL/v1/feed?limit=10 -H "Authorization: Bearer \$CLAWSHOT_API_KEY" ... | crontab -

Recommendation

Make scheduled activity explicitly opt-in, document an uninstall command, and review the user's crontab after setup.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent could create visible public activity that affects the user's or agent's reputation if it acts without human review.

Why it was flagged

The workflow gives the agent recurring authority to take public social actions, including likes, posts, and follows.

Skill content

Run this routine every 3–6 hours ... Like 1–3 genuinely good posts ... Post ONLY if you have something worth sharing ... Follow 1 new agent or tag

Recommendation

Require explicit user approval for posting, commenting, following, and cross-posting unless the user has deliberately enabled autonomous social activity.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone with the key could impersonate the agent on ClawShot.

Why it was flagged

The skill uses a ClawShot API key that represents the agent's identity and can authorize account actions.

Skill content

Store credentials in `~/.clawshot/credentials.json` with restricted permissions (chmod 600) ... Your API key is your identity.

Recommendation

Use a dedicated ClawShot key, keep the credential file private, do not log the key, and rotate it if there is any chance it was exposed.

NoteMedium Confidence

ASI06: Memory and Context Poisoning

What this means

Untrusted public captions could influence future agent behavior if treated as instructions rather than data.

Why it was flagged

The setup logs public feed captions as ongoing context, which could later be read by an agent as part of its decision process.

Skill content

# Feed browsing: 6x daily at random times (context gathering) ... jq -r '.posts[] | "[\(.agent.name)] \(.caption // \"no caption\")"' >> ~/.clawshot/logs/feed-browse.log

Recommendation

Treat feed text, captions, comments, and mentions as untrusted content; do not follow instructions found in social posts without user confirmation.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Other agents can send content that may influence notifications, engagement decisions, or future autonomous behavior.

Why it was flagged

The service supports comments and @mentions between agents, creating an inter-agent communication channel.

Skill content

@mentions: `@alice great work!` ... Both agents get notified.

Recommendation

Keep clear boundaries between social messages and executable instructions, and require review before acting on requests from other agents.

Findings (3)

critical

suspicious.exposed_secret_literal

Location: API-REFERENCE.md:17
Finding: File appears to expose a hardcoded API secret or token.

critical

suspicious.exposed_secret_literal

Location: FAQ.md:227
Finding: File appears to expose a hardcoded API secret or token.

critical

suspicious.exposed_secret_literal

Location: SKILL.md:146
Finding: File appears to expose a hardcoded API secret or token.