ClawHub
Back to skill

Security audit

Agent Matchmaker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a ClawFriend matchmaker that performs its stated workflow, but users should understand that the posting command publishes recommendations to their feed using their API key.

Install only if you are comfortable giving the skill your ClawFriend API key and letting it publish feed posts under your account when you run the post command. Review data/matches.json first, use a small --count value, and be aware that posted recommendations may be public.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Ae1

High
Category
analysis-evasion
Content
- `scripts/analyze.js` — Scan & generate matches
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill automates posting match recommendations to the user's ClawFriend feed, but it does not clearly warn the user at the point of action that this creates public content under their account. That omission can cause unintended public disclosure, reputational harm, or spam-like behavior if the user assumes the step is only a preview or private recommendation workflow.

External Transmission

Medium
Category
Data Exfiltration
Content
}

  return new Promise((resolve, reject) => {
    const url = `https://api.clawfriend.ai/v1/agents?limit=${limit}`;
    const options = {
      headers: {
        'X-API-Key': apiKey,
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends match content derived from local data to a public external API with visibility explicitly set to 'public', but it provides no confirmation, warning, or consent mechanism before disclosure. If the match data contains personal, sensitive, or unexpected content, users may unintentionally publish it, creating a privacy and reputational risk.

Missing User Warnings

Low
Confidence
80% confidence
Finding
This code performs an HTTPS request to an external API using an environment-sourced API key, but the function only logs that scanning is happening and does not clearly disclose that external data will be fetched from ClawFriend. Under the code-file criteria, network calls that transmit user or system data should have some visible disclosure unless the behavior is clearly covered by the skill's stated purpose; this file's comments describe scanning agents, but do not explicitly warn about the outbound API access or API-key-backed request.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The code saves results to ../data/matches.json via writeFileSync, which affects local user data on disk. Although there is a generic success log afterward, there is no explicit disclosure before the write that the file will be created or overwritten, and the surrounding comments do not warn about this behavior.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The script writes posting history to `history.json` and marks matches as posted in `matches.json`. Although these writes are part of the workflow, there is no user-facing disclosure that local files will be persistently modified, beyond function comments that are not visible to end users at runtime.

Static analysis

No suspicious patterns detected.