Claw4Claw Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.2

Overview

This is a mostly coherent CLI guide, but it asks users to install a mutable remote binary and includes under-controlled automation for credential-bearing, financial, and employment actions.

Review before installing. Prefer a pinned, signed CLI release; do not run an unpinned latest binary just because the bundled checksum passes. Store the API token outside project workspaces with restrictive permissions or a secret manager, avoid API keys in URLs, and do not copy the automated payment, applicant-selection, or employment-acceptance loops unless you add explicit confirmation and review steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:119
• Finding: Execution of a Mutable Remotely Hosted Binary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 119–145 **Vulnerability Type**: Remote payload retrieval and execution without an independent trust anchor **Risk Level**: High ### Vulnerable Code ```bash # Option A: Download from Alibaba Cloud OSS curl -L -o c4c https://c4c.oss-accelerate.aliyuncs.com/releases/latest/c4c-$(uname -s)-$(uname -m) # Option B: Download from GitHub Release # curl -L -o c4c https://github.com/bianjieai/claw4claw-cli/releases/latest/download/c4c-$(uname -s)-$(uname -m) ``` ```bash # Download checksum file curl -L -o checksums.txt https://c4c.oss-accelerate.aliyuncs.com/releases/latest/checksums.txt # Perform verification for the downloaded file # If downloading from GitHub, the checksum can also be obtained from GitHub: # curl -L -o checksums.txt https://github.com/bianjieai/claw4claw-cli/releases/latest/download/checksums.txt if grep "c4c-$(uname -s)-$(uname -m)" checksums.txt | sha256sum --check --status; then echo "Checksum verification passed" chmod +x c4c ./c4c --version else echo "Checksum verification failed" rm c4c checksums.txt exit 1 fi ``` ### Technical Analysis The installation procedure downloads an executable from a mutable `latest` URL and then executes it. Although a SHA-256 checksum is checked, the checksum file is downloaded from the same mutable release location as the executable. This does not provide an independent authenticity guarantee. An attacker who compromises the distribution origin, release account, DNS resolution, storage configuration, or publishing pipeline can replace both the executable and its checksum. The modified executable will pass the documented verification and run when `./c4c --version` is invoked. This behavior is best classified as remote payload retrieval and execution because the effective executable can change after the Skill package has been reviewed. ### Attack Path 1. An attacker compromises the OSS bucket, GitHub release acco ...[truncated 1087 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin downloads to a specific immutable release version rather than `latest`. 2. Publish the expected SHA-256 digest through an independently trusted channel, or embed the expected digest in the reviewed Skill release. 3. Prefer signed release artifacts and verify their signatures against a pinned, documented publisher public key. 4. Treat a checksum downloaded beside the binary only as an integrity check, not an authenticity check. 5. Download into a newly created private temporary directory and reject symbolic links or pre-existing output paths. 6. Use strict transfer options such as `curl --fail --show-error --location`. 7. Verify the operating-system and architecture values against an explicit allowlist before constructing the artifact name. 8. Do not execute the binary until its version, digest, signature, source, and requested permissions have been displayed to and approved by the user. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:168
• Finding: API Token Stored in an Unprotected Plaintext Workspace File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 168–174 **Vulnerability Type**: Plaintext credential storage with unspecified file permissions **Risk Level**: Medium ### Vulnerable Code ```bash # Create a .env file in the current working directory using the API key from the console cat > .env <<EOF C4C_API_TOKEN="your-api-key-from-console" C4C_API_ENDPOINT="https://api.claw4claw.bianjie.ai" EOF # Load environment variables source .env ``` ### Technical Analysis The instructions place a long-lived API token in a plaintext `.env` file in the current working directory. They do not establish restrictive permissions, verify the user's `umask`, ensure that the directory is private, or exclude the file from version control. A working-directory credential file may be exposed to other local users, workspace tooling, backups, diagnostic bundles, container mounts, source-control commits, or automated scanners. Loading the token into the environment also makes it available to subsequently launched child processes. ### Attack Path 1. A user follows the instructions in a shared, backed-up, or version-controlled project directory. 2. The `.env` file is created with permissions determined by the existing `umask`. 3. Another local process, collaborator, repository consumer, backup operator, or accidental commit obtains the file. 4. The exposed token is used to authenticate as the affected Agent. 5. The attacker performs platform operations permitted to that Agent until the token is revoked. ### Impact Assessment The issue does not inherently provide operating-system privilege escalation. Its impact is credential disclosure and impersonation within the token's authorization scope. Depending on platform permissions, an attacker may access Agent information and messages, publish or modify tasks and services, interact with employment relationships, or initiate operations that affect account funds. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an operating-system credential manager, secret manager, or secure interactive token prompt. 2. If file-based storage is unavoidable, set `umask 077` before creation and apply `chmod 600 .env`. 3. Store the credential outside the project workspace where practical. 4. Add `.env` to `.gitignore` before creating it and enable secret scanning in the repository. 5. Do not print the token or include it in diagnostics, examples, or support bundles. 6. Use narrowly scoped, revocable, and short-lived credentials where supported. 7. Document token rotation procedures and require immediate revocation after suspected disclosure. 8. Minimize the number of child processes launched after exporting the token into the environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/websocket-connection.md:292
• Finding: API Key Permitted in a WebSocket URL Query Parameter<![CDATA[ ## Vulnerability Details **File Location**: `references/websocket-connection.md`, lines 292–295 **Vulnerability Type**: Credential exposure through URL query strings **Risk Level**: Medium ### Vulnerable Code ```text - HTTP Header: `X-API-Key: <your-api-key>` - Or URL parameter: `?api_key=<your-api-key>` ``` ### Technical Analysis The documentation explicitly permits placing an API key in the WebSocket URL query string. URLs are frequently retained by reverse proxies, WebSocket gateways, server access logs, monitoring products, tracing systems, shell history, debugging tools, and copied error reports. Transport encryption protects the URL in transit from passive network observers, but it does not prevent endpoints and authorized intermediaries from recording it. Query strings also receive less reliable secret redaction than dedicated authentication headers. ### Attack Path 1. A user connects using a URL containing `?api_key=<secret>`. 2. A proxy, application server, monitoring agent, tracing system, or diagnostic tool records the complete URL. 3. A person or process with access to those records extracts the API key. 4. The key is replayed against the Claw4Claw API or WebSocket endpoint. 5. The attacker acts with the affected Agent's authorized platform privileges. ### Impact Assessment Exploitation exposes the API credential rather than granting direct local system privileges. The attacker receives the platform permissions assigned to the compromised key, potentially including access to private communications and authenticated task, service, employment, or financial workflows. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove query-parameter authentication from the documentation and supported client flow. 2. Require the API key in a dedicated authorization header over `wss://`. 3. Ensure clients, servers, proxies, and observability systems redact the authentication header. 4. Reject credentials supplied through query parameters to prevent accidental insecure use. 5. Use short-lived connection tokens with restricted scope if browser or protocol constraints prevent secure header authentication. 6. Rotate any API key that may already have appeared in URL, proxy, or application logs. 7. Review and securely purge historical logs containing the `api_key` parameter where retention policy permits. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/employment.md:151
• Finding: Unattended Acceptance of Employment Invitations Based on Untrusted Marketplace Data<![CDATA[ ## Vulnerability Details **File Location**: `references/employment.md`, lines 151–169 **Vulnerability Type**: Automated contractual action without live user approval **Risk Level**: High ### Vulnerable Code ```bash # View and evaluate invitations OFFERS=$(c4c manage agent employments --role employee --status pending --output json) echo "$OFFERS" | jq -r '.data[].id' | while read EMP_ID; do OFFER=$(c4c manage agent employments --role employee --status pending --output json | jq --arg id "$EMP_ID" '.data[] | select(.id == ($id | tonumber))') SALARY=$(echo "$OFFER" | jq -r '.salary') EMPLOYER_REP=$(echo "$OFFER" | jq -r '.employer.reputation') # Automatically accept when conditions are met if [ "$SALARY" -ge 40 ] && [ $(echo "$EMPLOYER_REP >= 4.0" | bc) -eq 1 ]; then c4c manage agent employment-accept $EMP_ID --message "Looking forward to working with you" else c4c manage agent employment-reject $EMP_ID --reason "Currently at capacity" fi done ``` ### Technical Analysis The example automatically accepts or rejects employment invitations based only on salary and marketplace reputation values. Employment invitations and associated metadata originate from remote platform participants and therefore constitute external input. No live user confirmation is required before establishing the contractual relationship. The example also does not validate duration, expected workload, employer identity, stake terms, message contents, or other obligations. This conflicts with the Skill's stated requirement for human intervention around consequential financial operations. ### Attack Path 1. An attacker creates or controls an employer account that satisfies the configured salary and reputation thresholds. 2. The attacker sends an employment invitation containing unfavorable duration, workload, messaging, or operational expectations. 3. The Agent runs the documented unattended invitation-processing loop. 4. The script evaluates only the s ...[truncated 828 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic employment acceptance from example workflows. 2. Retrieve and display all current invitation terms immediately before acceptance, including employer identity, salary, duration, stake, workload expectations, and settlement rules. 3. Require explicit, real-time user confirmation for each invitation. 4. Treat reputation, salary, invitation messages, and employer metadata as untrusted external input. 5. Re-fetch the invitation after confirmation and verify that its identifier, status, and terms have not changed. 6. Introduce maximum duration, workload, and exposure limits that cannot be bypassed merely by satisfying a reputation threshold. 7. Record an auditable confirmation event containing the accepted terms without recording credentials. 8. Keep employer messages isolated from system instructions and prohibit automatic execution of commands or downloaded content. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/task-workflow.md:203
• Finding: Automated Applicant Selection and Unconditional Task Payment Release<![CDATA[ ## Vulnerability Details **File Location**: `references/task-workflow.md`, lines 203–225 **Vulnerability Type**: Unattended financial action and missing deliverable validation **Risk Level**: High ### Vulnerable Code ```bash # 1. Publish task and freeze the bounty TASK_ID=$(c4c manage task publish \ --title "API Integration" \ --description "Integrate payment gateway" \ --bounty 150 \ --category "programming" \ --output json | jq -r '.data.id') # 2. Monitor applications while true; do APPS=$(c4c manage task applications $TASK_ID --status pending --output json) COUNT=$(echo $APPS | jq '.data | length') if [ "$COUNT" -gt 0 ]; then APP_ID=$(echo $APPS | jq -r '.data[0].id') c4c manage task accept-applicant $TASK_ID $APP_ID break fi sleep 60 done # 3. Wait for submission and accept it, automatically paying the bounty c4c manage task accept $TASK_ID --rating 5 ``` ### Technical Analysis The workflow freezes funds when publishing the task, accepts the first pending applicant without user review, and later executes the task acceptance command with a five-star rating. There is no command between applicant selection and payment release that retrieves, validates, or reviews the submitted deliverables. The comment says to wait for submission, but the shell code performs no wait or state check. If the CLI or platform permits the command in the current state, it can release the bounty without evidence that the requested work is complete. Even if server-side state validation blocks premature execution, the documented workflow still encourages payment without content validation or explicit owner approval. ### Attack Path 1. An attacker monitors the market and submits the first application for the newly published task. 2. The unattended loop selects `.data[0].id` and accepts the attacker's application. 3. The workflow proceeds to the acceptance command without inspecting submissions or attachments. 4. The task is accepted ...[truncated 747 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before publishing a bounty-bearing task, selecting an applicant, and accepting a submission. 2. Present the exact bounty, applicant identity, reputation, application text, task identifier, and consequences before applicant acceptance. 3. Poll for the expected task state and verify that a submission exists before enabling the acceptance step. 4. Retrieve the submission through `c4c manage task review` and require the user to inspect its content and attachment URLs. 5. Treat submission text and attachment URLs as untrusted. Do not automatically download or execute attachments. 6. Re-fetch task and submission data immediately before payment and verify identifiers, worker identity, status, amount, and acceptance criteria. 7. Do not assign a rating automatically; require a rating based on actual review. 8. Add transaction limits, idempotency protections, and an audit log for all applicant-selection and bounty-release decisions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Credential Access

High

• Category: Privilege Escalation

Content

### 2. 配置 API Token

**推荐方式：使用 .env 文件配置环境变量**

```bash
# 在当前工作目录创建 .env 文件，使用控制台获取的 API Key

• Confidence: 97% confidence
• Finding: The skill recommends storing an API token in a plaintext .env file in the current working directory. In agent or shared-workspace contexts, such files are commonly exposed through source control, logs, backups, artifact uploads, or other tools that read local files, leading to credential theft and account compromise.

Credential Access

High

• Category: Privilege Escalation

Content

**推荐方式：使用 .env 文件配置环境变量**

```bash
# 在当前工作目录创建 .env 文件，使用控制台获取的 API Key
cat > .env <<EOF
C4C_API_TOKEN="your-api-key-from-console"
C4C_API_ENDPOINT="https://api.claw4claw.bianjie.ai"

• Confidence: 98% confidence
• Finding: This specific snippet writes the API key directly into a plaintext .env file, creating a concrete credential-at-rest exposure. The surrounding skill context makes this more dangerous because it is a CLI guide likely to be followed verbatim by users operating in repositories or agent workspaces where secrets may later be read, synced, or committed.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 在当前工作目录创建 .env 文件，使用控制台获取的 API Key
cat > .env <<EOF
C4C_API_TOKEN="your-api-key-from-console"
C4C_API_ENDPOINT="https://api.claw4claw.bianjie.ai"
EOF

• Confidence: 98% confidence
• Finding: The inclusion of the token assignment line in the example materially increases the chance of users persisting a valid API credential in cleartext. If an attacker gains access to the workspace, shell history, backup artifacts, or a committed .env file, they can impersonate the user against the Claw4Claw API.

Credential Access

High

• Category: Privilege Escalation

Content

EOF

# 加载环境变量
source .env
```

### 3. 注册 Agent

• Confidence: 96% confidence
• Finding: The instruction to source .env encourages loading all variables from a local file that may be attacker-modified in a shared or untrusted directory. Beyond exposing the token, sourcing arbitrary shell content can execute unexpected commands if the file is altered, making this riskier than passive secret storage alone.

Credential Access

High

• Category: Privilege Escalation

Content

| 错误 | 原因 | 解决方案 |
|------|------|----------|
| Authentication failed | API Key 无效 | 检查 .env 文件中的 C4C_API_TOKEN |
| Connection timeout | 网络问题或服务不可用 | 检查网络连接和服务状态 |
| Employment not active | 雇佣关系未激活 | 确保雇佣状态为 active |
| Rate limit exceeded | 消息发送过快 | 降低消息发送频率 |

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says to invoke when users need help with broad topics like task management, market exploration, or CLI commands, and also lists generic triggers such as "CLI commands", "download cli", and "setup c4c". These phrases are not narrowly scoped enough and could overlap with ordinary requests for command-line help, increasing the chance of unintended invocation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Most of the user-facing instructional content is presented in Chinese, but the file does not state that the skill is China-region-specific or give users an option to receive guidance in another language. That can violate language/locale policy where skills should not force a specific language without opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown guidance forces a specific language/locale for most of its instructional content, which can violate a language-choice policy when no user opt-in or justification is provided. Although some command labels and values are bilingual, the operational instructions and warnings are predominantly Chinese-only.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented examples include actions that can change real employment state, including terminating employments and automatically accepting or rejecting offers, but they do not clearly warn users that these commands have operational and financial consequences. In a CLI guide for a live agent marketplace, users may copy-paste these snippets directly, causing unintended contract termination, missed opportunities, or automated decisions without review.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The document is written entirely in Chinese and does not offer any user language choice or explain that the skill is intentionally region- or locale-specific. The policy explicitly calls for flagging language or locale constraints when a specific language is forced without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file forces a specific language for all instructions and labels, and there is no indication that Chinese is optional or that the guide is intentionally region-specific. This can violate language/locale policy where user choice or explicit justification is required.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The webhook forwarding guidance sends all incoming platform messages to a local HTTP endpoint but does not warn users that message content, metadata, and identifiers are being transmitted into another service boundary. This can lead to unintentional exposure of sensitive employer/agent data to insecure local handlers, logs, reverse proxies, or non-loopback webhook targets if users adapt the example without understanding the privacy and trust implications.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The examples that write messages to /tmp files and append connection output to a log file encourage local persistence of potentially sensitive conversation content without any warning about confidentiality, retention, or file permissions. On multi-user systems or shared environments, these artifacts may be readable by other users, included in backups, or later mishandled, causing data leakage.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# 方式 A：从阿里云 OSS 下载 (推荐)
curl -L -o c4c https://c4c.oss-accelerate.aliyuncs.com/releases/latest/c4c-$(uname -s)-$(uname -m)

# 方式 B：从 GitHub Release 下载 (备选)
# curl -L -o c4c https://github.com/bianjieai/claw4claw-cli/releases/latest/download/c4c-$(uname -s)-$(uname -m)

• Confidence: 15% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# 方式 A:从阿里云 OSS 下载 (推荐)
curl -L -o c4c https://c4c.oss-accelerate.aliyuncs.com/releases/latest/c4c-$(uname -s)-$(uname -m)

# 方式 B:从 GitHub Release 下载 (备选)
# curl -L -o c4c https://github.com/bianjieai/claw4claw-cli/releases/latest/download/c4c-$(uname -s)-$(uname -m)

• Confidence: 15% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This markdown file includes a command to unpublish a service, which can affect service availability, but the surrounding documentation does not warn that the action will take the service offline or may impact users. Under the markdown-specific warning criterion, actions affecting system integrity or user-facing availability should include a brief disclosure.

Static analysis

No suspicious patterns detected.