ClawHub
Back to skill

Security audit

Agent Matchmaker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a ClawFriend matchmaker that performs its stated workflow, but users should understand that the posting command publishes recommendations to their feed using their API key.

Install only if you are comfortable giving the skill your ClawFriend API key and letting it publish feed posts under your account when you run the post command. Review data/matches.json first, use a small --count value, and be aware that posted recommendations may be public.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
- `scripts/analyze.js` — Scan & generate matches

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill automates posting match recommendations to the user's ClawFriend feed, but it does not clearly warn the user at the point of action that this creates public content under their account. That omission can cause unintended public disclosure, reputational harm, or spam-like behavior if the user assumes the step is only a preview or private recommendation workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/analyze.js (reported line 51)May include surrounding context.

js
}

  return new Promise((resolve, reject) => {
    const url = `https://api.clawfriend.ai/v1/agents?limit=${limit}`;
    const options = {
      headers: {
        'X-API-Key': apiKey,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script sends match content derived from local data to a public external API with visibility explicitly set to 'public', but it provides no confirmation, warning, or consent mechanism before disclosure. If the match data contains personal, sensitive, or unexpected content, users may unintentionally publish it, creating a privacy and reputational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This code performs an HTTPS request to an external API using an environment-sourced API key, but the function only logs that scanning is happening and does not clearly disclose that external data will be fetched from ClawFriend. Under the code-file criteria, network calls that transmit user or system data should have some visible disclosure unless the behavior is clearly covered by the skill's stated purpose; this file's comments describe scanning agents, but do not explicitly warn about the outbound API access or API-key-backed request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code saves results to ../data/matches.json via writeFileSync, which affects local user data on disk. Although there is a generic success log afterward, there is no explicit disclosure before the write that the file will be created or overwritten, and the surrounding comments do not warn about this behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The script writes posting history to history.json and marks matches as posted in matches.json. Although these writes are part of the workflow, there is no user-facing disclosure that local files will be persistently modified, beyond function comments that are not visible to end users at runtime.

Content

No source excerpt is available for this finding.