Setup claw.tech

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.2.0

Overview

This setup skill is mostly transparent about telemetry, but it asks users to run mutable remote installers and optionally persist a downloaded telemetry binary as an unsandboxed root service.

Review before installing. Prefer the pinned release and checksum path, avoid curl | bash, install into a user-owned directory when possible, and do not enable the root systemd service unless you understand the service, trust the binary source, and have considered a dedicated unprivileged service account with systemd sandboxing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:35
• Finding: Unverified Remote Installer Scripts Are Executed Directly by Bash## Vulnerability Details **File Location**: `SKILL.md`, lines 35 and 117-129 **Vulnerability Type**: Remote payload retrieval and execution through mutable external URLs **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://download.tapes.dev/install | bash ``` ```markdown ### Option B — convenience one-liner (`curl | bash`) The install script is auditable in one read: <https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh>. Under the hood it does the same thing as Option A — resolves the latest release, downloads the matching tarball, and drops the binary into `/usr/local/bin` (or `CLAWTEL_INSTALL_DIR`). ```bash curl -fsSL https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh | bash ``` Or to a user directory without sudo: ```bash CLAWTEL_INSTALL_DIR="$HOME/.local/bin" \ curl -fsSL https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh | bash ``` ``` ### Technical Analysis These commands pipe network responses directly into a command interpreter. No local inspection, cryptographic signature validation, or immutable content pinning occurs before execution. In particular, the clawtel installer is retrieved from the mutable `main` branch, allowing the effective payload to change after this Skill has been reviewed. HTTPS protects the connection in transit but does not protect against compromise of the upstream repository, hosting account, release process, domain, or installer itself. The installer scripts and downloaded binaries are not included in the audited project, so their actual behavior and the documentation's security claims cannot be independently verified from this artifact. The behavior is related to installing the declared tools, but direct execution of mutable remote content is not necessary. A download, verification, review, and explicit execution workflow would achieve the same functionality with materially less ri ...[truncated 1391 chars]
• Remediation: ## Remediation Suggestions 1. Remove all `curl | bash` instructions. 2. Pin installers and release artifacts to an immutable release version or commit. 3. Download scripts and binaries to local files before execution. 4. Verify artifacts using a cryptographic signature or a checksum obtained through an independently trusted channel. A checksum hosted beside the artifact protects against accidental corruption but does not independently authenticate a compromised release account. 5. Display or inspect the downloaded script before explicitly invoking it. 6. Prefer a trusted package repository or vendor a small, auditable installer into the Skill. 7. Do not resolve and install an unpinned “latest” release on production systems. 8. Run installation as an unprivileged user and install into a user-owned directory unless system-wide installation is explicitly required. A safer workflow would resemble: ```bash curl -fSLo install.sh \ https://raw.githubusercontent.com/bdougie/clawtel/<PINNED_COMMIT>/scripts/install.sh # Verify the expected digest from an independently trusted source. printf '%s %s\n' '<EXPECTED_SHA256>' install.sh | sha256sum -c - # Inspect before execution. less install.sh CLAWTEL_INSTALL_DIR="$HOME/.local/bin" bash ./install.sh ```

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:185
• Finding: Downloaded Telemetry Binary Is Persisted as a Root System Service## Vulnerability Details **File Location**: `SKILL.md`, lines 185-209 **Vulnerability Type**: Excessive privileges and boot persistence **Risk Level**: High ### Vulnerable Code ```ini [Unit] Description=clawtel — token telemetry for claw.tech After=network-online.target Wants=network-online.target [Service] Type=simple User=root EnvironmentFile=/etc/clawtel.env ExecStart=/usr/local/bin/clawtel Restart=on-failure RestartSec=10 [Install] WantedBy=multi-user.target ``` ```text CLAW_ID=your-claw-name CLAW_INGEST_KEY=ik_... TAPES_DB=/root/.tapes/tapes.sqlite ``` ```bash chmod 600 /etc/clawtel.env systemctl daemon-reload systemctl enable --now clawtel journalctl -u clawtel -f ``` ### Technical Analysis The documentation instructs users to run the externally sourced clawtel binary as `root`, restart it following failures, and enable it at boot. Continuous service execution is relevant to the declared long-running telemetry function, so persistence is disclosed rather than covert. Nevertheless, root privileges exceed the minimum permissions ordinarily required to read a specific SQLite database, maintain a cursor file, and send HTTPS telemetry. The service definition contains no meaningful systemd sandboxing. It does not set controls such as `NoNewPrivileges`, `ProtectSystem`, `PrivateTmp`, restricted writable paths, syscall restrictions, or network-family restrictions. The binary also receives an ingest credential through its environment file. This creates a particularly dangerous combination with the remote installation flow: compromise of the installer, release account, or binary can become persistent root-level compromise. ### Attack Path 1. A malicious or compromised installer supplies a modified `clawtel` binary, or the installed binary is replaced locally. 2. The user places that binary at `/usr/local/bin/clawtel`. 3. The user creates the documented service with `User=root`. ...[truncated 927 chars]
• Remediation: ## Remediation Suggestions 1. Create a dedicated, unprivileged service account such as `clawtel`. 2. Grant that account read-only access only to the required SQLite database and write access only to a dedicated cursor/state directory. 3. Avoid placing the database under `/root`; use a narrowly permissioned service data directory. 4. Pin and cryptographically verify the executable before service registration. 5. Require explicit user consent before enabling boot persistence, and document disable/removal commands. 6. Protect the environment file with ownership by root and mode `0600`, while ensuring the service account receives only the specific required variables. 7. Add systemd sandboxing appropriate to the application, for example: ```ini [Service] User=clawtel Group=clawtel ExecStart=/usr/local/bin/clawtel EnvironmentFile=/etc/clawtel.env NoNewPrivileges=yes PrivateTmp=yes ProtectSystem=strict ProtectHome=yes ProtectKernelTunables=yes ProtectKernelModules=yes ProtectControlGroups=yes RestrictSUIDSGID=yes LockPersonality=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 ReadOnlyPaths=/var/lib/tapes/tapes.sqlite ReadWritePaths=/var/lib/clawtel Restart=on-failure ``` Paths and access rules should be adjusted to the actual database and cursor locations. Confirm the hardened unit with `systemd-analyze security clawtel.service`.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:126
• Finding: Install Directory Environment Variable Is Applied to Curl Instead of the Installer Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 126-129 **Vulnerability Type**: Incorrect environment scoping in a shell pipeline **Risk Level**: Medium ### Vulnerable Code ```markdown Or to a user directory without sudo: ```bash CLAWTEL_INSTALL_DIR="$HOME/.local/bin" \ curl -fsSL https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh | bash ``` ``` ### Technical Analysis In this pipeline, the temporary `CLAWTEL_INSTALL_DIR` assignment applies to the `curl` command on the left side, not to the `bash` process on the right side. Consequently, the downloaded installer is not reliably given the requested destination variable. The installer may therefore use its default destination, documented as `/usr/local/bin`, rather than `$HOME/.local/bin`. This contradicts the claim that the command installs to a user directory without `sudo` and may trigger unexpected privileged-path behavior. ### Attack Path 1. A user selects the documented non-root installation option. 2. The shell exports `CLAWTEL_INSTALL_DIR` only to the `curl` process. 3. The downstream `bash` process executes the installer without that variable. 4. The installer selects its default installation directory or default privilege behavior. 5. Installation fails, requests elevation, or writes to a different location than the user intended, depending on the installer's implementation and the current permissions. ### Impact Assessment The direct impact is unintended installation behavior and erosion of the least-privilege guarantee presented by the documentation. A user may be encouraged to grant elevation after the command unexpectedly targets `/usr/local/bin`, increasing the privileges available to unverified remote code. The exact result cannot be established because the installer is not included in the project. The confirmed flaw is that the environment variable is scoped to the wrong pipeline process.
• Remediation: ## Remediation Suggestions Do not pipe the installer directly into a shell. Download and verify it first, then apply the environment variable to the process that executes the script: ```bash curl -fSLo install.sh \ https://raw.githubusercontent.com/bdougie/clawtel/<PINNED_COMMIT>/scripts/install.sh printf '%s %s\n' '<EXPECTED_SHA256>' install.sh | sha256sum -c - less install.sh CLAWTEL_INSTALL_DIR="$HOME/.local/bin" bash ./install.sh ``` If a pipeline must be retained despite the remote-execution risk, the variable would need to be applied to the downstream shell rather than to `curl`. The download-first workflow remains strongly preferred because it also permits verification and inspection.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

External Script Fetching

High

• Category: Supply Chain

Content

1. **tapes** installed and running as a proxy in front of Anthropic. If tapes isn't there yet:
   ```bash
   curl -fsSL https://download.tapes.dev/install | bash
   tapes init
   ```
2. **A claw.tech ingest key**. Register your claw at https://claw.tech and copy the `ik_...` key shown once at creation.

• Confidence: 98% confidence
• Finding: The skill instructs users to execute a remote install script directly with `curl | bash`, which gives the remote server immediate code execution on the host with no integrity verification or review step. Because this is part of prerequisite setup, users are likely to run it early and trust it, making supply-chain compromise or server-side tampering especially dangerous.

Chaining Abuse

High

• Category: Tool Misuse

Content

1. **tapes** installed and running as a proxy in front of Anthropic. If tapes isn't there yet:
   ```bash
   curl -fsSL https://download.tapes.dev/install | bash
   tapes init
   ```
2. **A claw.tech ingest key**. Register your claw at https://claw.tech and copy the `ik_...` key shown once at creation.

• Confidence: 98% confidence
• Finding: Piping network-fetched content directly into `bash` is a classic command-chaining abuse pattern because it collapses retrieval and execution into one opaque step. In a setup skill, this materially increases the chance that users execute unreviewed attacker-controlled code if the upstream host, DNS, TLS endpoint, or publishing pipeline is compromised.

External Script Fetching

High

• Category: Supply Chain

Content

PLAT=darwin_arm64   # or linux_amd64, linux_arm64, darwin_amd64
BASE=https://github.com/bdougie/clawtel/releases/download/${VERSION}

curl -fsSLO "${BASE}/clawtel_${PLAT}.tar.gz"
curl -fsSLO "${BASE}/checksums.txt"

# Verify. sha256sum on Linux, shasum -a 256 on macOS.

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

install -m 755 clawtel "$HOME/.local/bin/clawtel"   # or /usr/local/bin with sudo
```

### Option B — convenience one-liner (`curl | bash`)

The install script is auditable in one read: <https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh>. Under the hood it does the same thing as Option A — resolves the latest release, downloads the matching tarball, and drops the binary into `/usr/local/bin` (or `CLAWTEL_INSTALL_DIR`).

• Confidence: 97% confidence
• Finding: The documented 'convenience one-liner' normalizes fetching and executing a remote GitHub-hosted installer in a single pipeline. Even though the text says it is auditable, many users will not inspect it, so any repository compromise, maintainer account compromise, or transient tampering can lead to arbitrary code execution.

Chaining Abuse

High

• Category: Tool Misuse

Content

The install script is auditable in one read: <https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh>. Under the hood it does the same thing as Option A — resolves the latest release, downloads the matching tarball, and drops the binary into `/usr/local/bin` (or `CLAWTEL_INSTALL_DIR`).

```bash
curl -fsSL https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh | bash
```

Or to a user directory without sudo:

• Confidence: 99% confidence
• Finding: This is a direct instance of chaining untrusted remote content into a shell interpreter, enabling arbitrary code execution with no review boundary. The wording around auditability may create false reassurance, which makes the pattern more dangerous in practice because users are nudged to trust and execute immediately.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
CLAWTEL_INSTALL_DIR="$HOME/.local/bin" \
  curl -fsSL https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh | bash
```

Verify either path with: `clawtel --version` should print a version string that matches the release you intended to install.

• Confidence: 99% confidence
• Finding: Although this variant installs to a user directory, it still chains remote content directly into `bash`, which permits full compromise of the invoking user's environment. Attackers could modify shell startup files, exfiltrate local secrets, or install trojaned binaries that persist in the user's PATH.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

grep "clawtel_${PLAT}.tar.gz" checksums.txt | sha256sum -c -    # or: shasum -a 256 -c -

tar -xzf "clawtel_${PLAT}.tar.gz"
install -m 755 clawtel "$HOME/.local/bin/clawtel"   # or /usr/local/bin with sudo
```

### Option B — convenience one-liner (`curl | bash`)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Then:

```bash
chmod 600 /etc/clawtel.env
systemctl daemon-reload
systemctl enable --now clawtel
journalctl -u clawtel -f

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
chmod 600 /etc/clawtel.env
systemctl daemon-reload
systemctl enable --now clawtel
journalctl -u clawtel -f
```

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Script Fetching

Low

• Category: Supply Chain

Content

The install script is auditable in one read: <https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh>. Under the hood it does the same thing as Option A — resolves the latest release, downloads the matching tarball, and drops the binary into `/usr/local/bin` (or `CLAWTEL_INSTALL_DIR`).

```bash
curl -fsSL https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh | bash
```

Or to a user directory without sudo:

• Confidence: 99% confidence
• Finding: This command is a direct `curl | bash` execution path against a mutable remote script, creating immediate arbitrary code execution risk. The danger is amplified because the script may install into privileged locations and because setup documentation encourages trust in the source rather than enforcing integrity validation.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
CLAWTEL_INSTALL_DIR="$HOME/.local/bin" \
  curl -fsSL https://raw.githubusercontent.com/bdougie/clawtel/main/scripts/install.sh | bash
```

Verify either path with: `clawtel --version` should print a version string that matches the release you intended to install.

• Confidence: 99% confidence
• Finding: This is the same unsafe remote-script execution pattern as line 122, just targeting a user-writable install directory. Installing without `sudo` lowers blast radius somewhat, but it still grants arbitrary code execution as the current user and can compromise local data, shell profiles, or developer credentials.

Static analysis

No suspicious patterns detected.