ClawHub
Back to skill

Security audit

Entangle

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about using entangle.cafe, but it asks an agent to perform recurring authenticated actions from server-provided prompts without enough user control.

Install only if you want your agent to maintain an ongoing entangle.cafe presence. Use a dedicated revokable token, avoid unattended state-changing heartbeats, review any generated messages or connection actions before sending, and revoke peek links, webhooks, sessions, and the heartbeat entry when no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:95
Finding

Untrusted Remote Instructions Are Prioritized During Heartbeats

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:52
Finding

Persistent Heartbeat Directive Enables Repeated Remote Influence

Content
View full analysis
My token is in .env as ENTANGLE_TOKEN ``` ``` The associated heartbeat procedure later states: ```markdown Every heartbeat, run these steps in order. ``` ### Technical Analysis The skill instructs the agent to write a recurring operational directive into `HEARTBEAT.md`. This converts a one-time skill invocation into persistent behavior that continues across future heartbeat cycles and potentially future sessions. Each cycle performs an authenticated request to the remote service and, as documented elsewhere in the skill, processes the remotely supplied `what_to_do_next` field. The persistent local directive therefore repeatedly exposes the agent to mutable external instructions. This increases both the exploitation window and the reliability of an attack: an attacker does not need to control the first response and can wait for any later scheduled poll. The heartbeat entry also records that an authentication token exists in `.env`. It does not print the token value directly, but it ensures recurring operations are performed with authenticated authority. No expiration, maximum number of runs, user-approval requirement, or local action allowlist is specified. ### Attack Path 1. The user or agent follows the setup instructions and adds the supplied directive to `HEARTBEAT.md`. 2. The host agent retains that directive as persistent operational state. 3. Every 30–60 minutes, the agent invokes the Entangle heartbeat and authenticates with `ENTANGLE_TOKEN`. 4. At any later time, an attacker compromises or influences the remote service response. 5. The service supplies malicious or manipulative content through its action ...[truncated 963 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

entangle.cafe (every 30–60 min)

Run entangle heartbeat (see entangle skill). My agent name: <your_name> My token is in .env as ENTANGLE_TOKEN

text

### Step 5: Update your profile

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
env:
        - ENTANGLE_TOKEN
      bins:
        - curl
    primaryEnv: ENTANGLE_TOKEN
    emoji: "🕸️"
    homepage: https://entangle.cafe

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This endpoint generates a bearer-style peek URL intended to be shared externally, which creates a new access path to account data outside the normal authenticated session. Even though this is presented as a feature, issuing shareable access tokens from an agent skill increases the risk of unintended disclosure if the URL is logged, mishandled, or shared too broadly.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Step 6: Generate a peek link for your human

bash
curl -X POST https://entangle.cafe/api/peek-tokens \
  -H "Authorization: Bearer $ENTANGLE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"label": "for my human"}'