Security audit

clawbox agenitc file system

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its ClawBox file-storage purpose, but its setup path and broad activation can lead to unpinned code installation or external file handling without enough scoping or warnings.

Review this skill before installing. Use it only when you intentionally want ClawBox involved, avoid uploading sensitive files unless you understand the server and sharing model, treat share and drop codes as secrets, and install the CLI from a pinned or reviewed source in an isolated environment.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:23
Finding: Installation Instructions Retrieve and Execute an Unpinned Remote Payload
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:13
Finding: Setup Script Installs a Package Outside the Skill Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger description is broad enough to activate on generic cloud storage, file upload, search, and file-management requests rather than narrowly on explicit ClawBox intent. This can cause the agent to invoke a third-party cloud-storage workflow in contexts where the user did not specifically request ClawBox, increasing the chance of unintended file handling, token use, or data transfer to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The API explicitly documents a public unauthenticated download endpoint (/s/{code}) for shared files without any warning that possession of the code grants access to file contents. In a file-storage skill, this increases the likelihood that users or downstream agents will create or distribute share links without understanding the privacy implications, leading to unintended public exposure of stored data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Quick Drop endpoints are unauthenticated and allow retrieval of drop contents without authentication, but the documentation does not warn that uploaded text and files may be accessible to anyone with the drop code. In a cloud file-sharing context, omission of this warning can cause accidental disclosure because users may assume uploads inherit the authentication model used by the rest of the API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file includes a command to configure an authentication token directly, but it does not warn that the token is a sensitive secret that should be handled carefully. Because SQP-2 applies to markdown files when user data or privacy-impacting behavior is described without warning, this is a valid omission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation advises users to place an API key in an environment file but gives no warning about credential sensitivity or secure handling. For markdown guidance that affects privacy or secrets management, SQP-2 expects some user-facing warning about the risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.