claoow search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.15

Overview

The skill mostly does what it claims, but it can run repeated scraping and credit-spending actions with weak boundaries and has an incomplete network safety guard.

Review before installing. Use this only if you are comfortable giving it a Claoow API key, making outbound requests to URLs selected by Claoow tasks, submitting scraped or typed content to Claoow, and potentially spending Claoow points. Avoid Allow Always modes, confirm each purchase manually, and run it in a network-restricted environment if you test it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: claoow_miner.py:226

Finding

Marketplace purchases execute without explicit per-item approval

Content

View full analysis

= batch_size: break entity_id = entity.get("entityId") price = entity.get("price") name = entity.get("canonicalName") print(f"\n[*] Attempting to purchase [{name}] for {price} PTS...") resp = purchase_entity(api_key, entity_id) ``` The declared security requirement states: ```text Before calling the `/marketplace/purchase` endpoint, you MUST explicitly ask the user for permission, displaying the exact price. Only proceed if the user replies 'yes'. ``` ### Technical Analysis The implementation obtains authorization only for a batch size and an execution mode. It does not request explicit confirmation after displaying each entity and its exact price. The purchase request is issued immediately after printing the marketplace-provided information. The `Allow Always` option further permits purchases across multiple marketplace ...[truncated 1405 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: claoow_miner.py:13

Finding

SSRF protection can be bypassed through redirects and DNS rebinding

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: claoow_miner.py:117

Finding

Continuous mining violates the mandatory bounded-batch authorization rule

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: skill.md:219

Finding

Installation instructions use an unpinned runtime dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · claoow_miner.py (reported line 103)May include surrounding context.

python

}
    }
    
    response = requests.post(f"{BASE_URL}/submissions", headers=headers, json=payload)
    if response.status_code == 200:
        print(f"[+] Intelligence submitted successfully! Awaiting worker validation.")
        return True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script autonomously fetches third-party URLs supplied by the remote task service, which causes outbound network access to arbitrary external sites with limited user awareness. Even with the SSRF guard, this can reveal the operator's IP/user-agent to attacker-controlled sites, interact with hostile content, and create legal or operational risk from unsolicited scraping.

Content

No source excerpt is available for this finding.

Tainted flow: 'category' from input (line 221, user input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · claoow_miner.py (reported line 205)May include surrounding context.

python

def search_marketplace(api_key, category, page=0):
    headers = {"X-API-KEY": api_key}
    response = requests.get(f"{BASE_URL}/marketplace/search?category={category}&page={page}", headers=headers)
    if response.status_code == 200:
        data = response.json()
        return data.get("content", [])

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code prompts the user for an existing API key or registers to obtain one, then uses that credential in HTTP headers for subsequent requests. While the skill prints operational status, it does not disclose to the user that their credential will be sent to a remote service or provide any credential-handling warning in comments/docstrings at the point of use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill describes broad autonomous behaviors such as registering a node, fetching tasks, scraping URLs, submitting intelligence, and making marketplace actions without clear trigger conditions or exclusion boundaries. Ambiguous invocation scope raises the risk that an agent activates the workflow in unintended contexts and performs external actions or data handling the user did not specifically request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description does not prominently warn that the workflow performs external network requests, autonomous scraping of third-party URLs, and submission of collected content to an outside marketplace. Users may invoke the skill without understanding that it causes outbound traffic, remote content retrieval, and data transmission, which materially changes the security and privacy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill instructs the agent to send identifying data such as a chosen node ID and generated public key to an external service to register and obtain an API key. Although this appears to be core functionality rather than overtly malicious behavior, it is still an external transmission that creates privacy, tracking, and account-linkage risk if done without clear user awareness and consent.

Content

Scanner excerpt · skill.md (reported line 63)May include surrounding context.

bash

curl -X POST "https://claoow.com/api/v1/nodes/register?nodeId=<YOU\_NAME\_IT>\&hardwareId=<GENERATED\_PUBLIC\_KEY>"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill presents conflicting autonomy limits: it advertises an 'Allow Always' continuous mining mode while also declaring a mandatory stop after each batch. In practice, this ambiguity can cause implementers or agents to run repeated network scraping and submission loops with only weak human oversight, undermining the stated safety boundary.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skill.md (reported line 243)May include surrounding context.

md

5\. \*\*Batched Execution:\*\* Once the user provides a number, autonomously process EXACTLY that number of tasks in sequence (Fetch -> Scrape -> Extract -> Submit).

6\. \*\*🛑 MANDATORY PAUSE:\*\* After completing the specified batch size, you MUST STOP autonomous execution. Do NOT loop indefinitely. Report the total rewards earned and ask the user if they want to authorize another batch.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The API exposes broad tasking and marketplace capabilities such as fetching scrape tasks, purchasing intelligence, and submitting arbitrary intelligence, but the schema provides almost no scope limitations, allowed-use constraints, or exclusion conditions. In an agent setting, this can enable autonomous collection, purchase, and exfiltration workflows without meaningful policy guardrails, increasing the risk of misuse for surveillance, unauthorized data collection, or unintended account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The purchase endpoint performs an account-impacting transaction that spends platform credits, yet the specification includes no warning that the action incurs cost or may be irreversible. In an agentic environment, a model could invoke this operation based on ambiguous prompts or task chaining, causing unintended financial loss or repeated unauthorized purchases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The submissions endpoint allows transmission of arbitrary metadata and payload content to a remote service without any privacy, consent, or data-classification warning. For an autonomous agent, this creates a direct exfiltration path for sensitive user, system, or third-party data if prompts or upstream tasks cause the model to submit collected information without understanding the sharing consequences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill says the API key should remain in memory only for the session, but also instructs agents to save and run a local mining script. That workflow increases the chance credentials are embedded in files, shell history, logs, or process artifacts, defeating the claimed ephemeral handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.