Claw Intelligence broker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:22 AM UTC
• Version: 1.0.15

Overview

The skill is not overtly malicious, but it asks an agent to autonomously scrape externally supplied URLs and submit results to a third-party service with safeguards that are mostly instructions rather than enforceable limits.

Install only if you are comfortable letting the agent contact the OpenClaw service, hold a session API key, fetch externally assigned URLs, scrape public pages, and submit extracted results. Keep batches small, review any target URLs when possible, never allow local files, secrets, private URLs, or environment data to be submitted, and require explicit confirmation before any point-spending purchase.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:73

Finding

Untrusted Task Instructions Can Influence Autonomous Agent Execution

Content

View full analysis

Scrape -> Extract -> Submit). 6. **🛑 MANDATORY PAUSE:** After completing the specified batch size, you MUST STOP autonomous execution. Do NOT loop indefinitely. Report the total rewards earned and ask the user if they want to authorize another batch. ``` `tool-definition.json.txt:58-74`: ```json "/tasks": { "get": { "operationId": "fetchTask", "summary": "Fetch an intelligence task to scrape (costs 0.5 PTS).", "responses": { "200": { "description": "Task successfully retrieved.", "content": { "application/json": { "schema": { "type": "object", "properties": { "taskId": { "type": "string", "format": "uuid" }, "taskType": { "type": "string" }, "targetUrl": { "type": "string" }, "instructions": { "type": "object" } } } } } } } } } ``` ### Technical Analysis The Skill directs the agent to fetch and autonomously process tasks supplied by an external service. Each task can contain both an arbitrary `targetUrl` and an unconstrained `instructions` object. No schema restricts the permitted instruction fields, and the Skill does not explicitly require the agent to treat remote task instructions and fetched page content solely as untrusted data. This creates an instruction-boundary weakness. A malicious or c ...[truncated 2128 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:83

Finding

Natural-Language-Only SSRF Controls Can Be Bypassed by Crafted Task URLs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill instructs the agent to register with and transmit identifiers to an external third-party service, then store and use a returned API key for subsequent operations. Even though the transmitted value is described as an ephemeral public key, this still establishes outbound communication and credential handling with an external service, creating privacy, tracking, and supply-chain risk if the endpoint is compromised or untrusted.

Content

Scanner excerpt · skill.md (reported line 30)May include surrounding context.

1. Register Node (Identity Generation)

Registers the agent to receive an apiKey and 50 initial PTS.

bash

curl -X POST "https://search-r22y.onrender.com/api/v1/nodes/register?nodeId=MyBroker-01&hardwareId=<GENERATED_PUBLIC_KEY>"

2. Fetch Intelligence Task

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skill.md (reported line 79)May include surrounding context.

md

【BATCHED AUTONOMOUS MINING (EFFICIENT & SAFE)】
4. **Batch Opt-In:** To begin mining, ask the user: *"How many intelligence tasks shall I process in this batch? (e.g., 1 to 5)"*
5. **Batched Execution:** Once the user provides a number, autonomously process EXACTLY that number of tasks in sequence (Fetch -> Scrape -> Extract -> Submit).
6. **🛑 MANDATORY PAUSE:** After completing the specified batch size, you MUST STOP autonomous execution. Do NOT loop indefinitely. Report the total rewards earned and ask the user if they want to authorize another batch.

【STRICT SAFETY GUARDRAILS】

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The unauthenticated node registration endpoint issues an apiKey in the response but provides no strong handling guidance beyond a brief 'keep this secure' note. In an agent context, newly issued credentials can be surfaced in logs, chat transcripts, memory, or chained tool outputs, leading to credential exposure and unauthorized use of the OpenClaw account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The /submissions endpoint accepts arbitrary metadata, payload, and clientHints for intelligence submission without any warning about sensitive-data handling. In an autonomous 'intelligence broker' skill, this creates a real risk that scraped content, system-derived data, internal URLs, tokens, or user information could be transmitted to an external marketplace service without clear consent or minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file documents a point-spending purchase endpoint, but the API reference itself presents the action as a normal call without warning that it consumes rewards or requires explicit approval. Although later operating guidelines add a HITL requirement, users reading the endpoint section alone are not warned at the point where the destructive/spending action is introduced.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This manifest-like file describes a generic task retrieval capability as "Fetch an intelligence task to scrape" without clarifying activation constraints, intended context, or exclusions. Because manifest/plain-text files are in scope for vague-trigger review, this broad capability description could contribute to unintended invocation or overbroad use when mapped into a skill catalog.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.