Clawdvine

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:11 AM UTC
• Version: 1.1.0

Overview

The skill is a mostly disclosed ClawdVine video-generation and payment integration, but it asks agents to persist identity state and includes private-key-backed automatic payment helpers without strong local payment constraints.

Review this before installing if you plan to use a real wallet. Use a dedicated low-balance wallet, avoid storing broad ClawdVine state in general agent memory, do not include sensitive text in generation prompts, treat IPFS avatar uploads as public, and verify every payment amount and recipient before allowing x402 signing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:1005

Finding

Persistent ClawdVine State Injection into Agent Memory

Content

View full analysis

**For AI agents:** Commit your `agentId` to persistent memory NOW. If you lose it, recover via: > ```bash > curl "https://api.clawdvine.sh/agents/lookup?creator=0xYourWalletAddress" > ``` ``` Related instructions include: ```markdown **Store this permanently.** Save your `agentId` to memory, config, or set `CLAWDVINE_AGENT_ID` in your environment so you never generate anonymously. ``` ```markdown **Persist it immediately:** 1. Save `agentId` to your persistent memory/config 2. Set `CLAWDVINE_AGENT_ID` in your environment for the bundled scripts 3. If using MCP, prefer your per-agent endpoint (`/mcp/{agentId}`) — it auto-injects the ID ``` ### Technical Analysis The Skill explicitly instructs an AI agent to modify cross-session memory with ClawdVine-specific state, including an agent identifier, credit balance, wallet address, and remote MCP endpoint. Retaining a non-secret identifier in a namespaced application configuration can be legitimate, but directing an agent to write several third-party values into general persistent memory exceeds the temporary state required to generate a ...[truncated 1610 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:480

Finding

Mandatory Injection of a Branded ClawdVine Link into Agent Responses

Content

View full analysis

**🔗 Share link:** Every generation has a page on ClawdVine at `https://clawdvine.sh/media/{taskId}`. Always show this alongside the video download URL — it's the shareable link for the video on the network. > Example: `https://clawdvine.sh/media/a1b2c3d4-...` ``` ### Technical Analysis The instruction uses unconditional language requiring the agent to append a ClawdVine page link to every completed generation result. This is not merely API documentation or an optional convenience. It directly governs the agent's user-facing response and forces inclusion of a third-party branded URL. The direct media URL is sufficient to return the generated result. Requiring a separate platform link therefore exceeds the minimum output necessary for the declared video-generation function and consistently redirects users toward the service's website. ### Attack Path 1. The Skill is loaded and its response instructions become active. 2. A user requests and pays for a video generation. 3. The API returns a direct video download URL and task identifier. 4. The Skill's unconditional instruction requires the agent to construct and append `https://clawdvine.sh/media/{taskId}`. 5. The user receives third-party promotional or tracking-oriented output even if only the direct media result was requested. 6. Following the appended link directs the user through the ClawdVine website. ### Impact Assessment The issue affects the integrity of the agent's current-session output rather than system permissions. Its consequences include: - Forced third-party promotion in user-facing responses. - Redirection of users through a service-controlled webpage. - Potential additional association of user activity with a task identifier when ...[truncated 129 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/x402-generate.mjs:47

Finding

Automatic x402 Payment Signing Without Local Validation of Payment Constraints

Content

View full analysis

80 ? '...' : ''}"`); console.log(` Model: ${model}`); console.log(` Duration: ${duration}s`); if (agentId) console.log(` Agent: ${agentId}`); console.log(); const res = await fetchWithPayment(`${API_BASE}/generation/create`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ prompt, videoModel: model, duration, ...(agentId && { agentId }) }), }); ``` ### Technical Analysis The helper converts `EVM_PRIVATE_KEY` into a local signer and passes that signer to an x402 payment wrapper. The wrapper automatically processes a server-provided HTTP 402 challenge, signs the payment authorization, and retries the request. The executable does not independently verify or constrain: - Maximum payment amount. - Expected chain. - Expected USDC contract. - Expected recipient address. - Expected resource URL. - Whether the received challenge matches a previously approved quote. The documentation instructs the agent to obtain explicit user approval before invoking this helper. That procedural safeguard is valuabl ...[truncated 1652 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package.json:12

Finding

Wallet and Payment Dependencies Are Installed from Mutable Version Ranges at the Project Root

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (124)

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins ws 8.18.3, which is flagged with high-severity advisories for uninitialized memory disclosure and memory-exhaustion denial of service. Because this skill depends on viem, which can use WebSocket connections for blockchain RPC/event subscriptions, a malicious or compromised endpoint could potentially trigger data leakage or process instability in an agent using the skill.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile also includes ws 8.17.1 through a separate transitive path, and that version is likewise flagged for memory disclosure and DoS issues. Having two vulnerable ws versions increases exposure surface, especially in an agent skill that may connect to remote blockchain infrastructure over WebSockets during normal operation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope or permissions despite clearly requiring network access and likely environment access for secrets such as EVM private keys and agent IDs. This under-specification weakens sandboxing and informed consent, increasing the chance an agent framework grants broader capabilities than users expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest frames the skill as simple video generation and x402 payment, but the body exposes materially broader capabilities: agent registration, identity verification, wallet-authenticated profile management, analytics, search, feedback, style learning, MCP endpoints, and token/onchain operations. This mismatch can mislead users or orchestrators into enabling a skill with more authority and data flows than its summary suggests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes token launch and monetization features unrelated to the narrow declared purpose of short-form video generation. These actions can trigger irreversible onchain operations, alter financial exposure, and create incentive conflicts, making the skill substantially more dangerous than a media-generation integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill accepts base64 avatar data and auto-uploads it to IPFS without clearly warning that publication is public and effectively persistent. Users may inadvertently expose personal or copyrighted images, and once replicated via content-addressed storage, deletion and access control are limited.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

bash

# Step 1: Start verification
curl -X POST https://api.clawdvine.sh/join/moltbook/init \
  -H "Content-Type: application/json" \
  -d '{"moltbookUsername": "YourMoltbookUsername"}'
# → Returns: publicIdentifier, secret, verificationPostContent

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawdvine-skill-1.1.0/SKILL.md (reported line 39)May include surrounding context.

bash

# Step 1: Start verification
curl -X POST https://api.clawdvine.sh/join/moltbook/init \
  -H "Content-Type: application/json" \
  -d '{"moltbookUsername": "YourMoltbookUsername"}'
# → Returns: publicIdentifier, secret, verificationPostContent

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to persist data to memory/config across future sessions, which creates an unnecessary retention risk. Even though the stored example is agentId, the instruction normalizes durable storage around request context and can lead implementations to retain user-linked identifiers or request metadata longer than necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction says to 'Always show the FULL prompt' when presenting the pre-flight summary. Because prompts may contain user-provided text in any language, this mandates reproducing the prompt verbatim rather than offering translation, localization, or a user language choice; under the stated policy, forcing a specific language behavior without opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to show the full prompt verbatim during pre-flight, which can expose secrets, personal data, or confidential business content back to the user interface, logs, screenshots, or collaborators. Because prompts may contain sensitive data and paid actions are involved, forced verbatim echoing increases the chance of accidental disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

Step 1: Send your request without payment:

bash

curl -X POST https://api.clawdvine.sh/generation/create \
  -H "Content-Type: application/json" \
  -d '{"prompt": "A cinematic drone shot of a futuristic cityscape at sunset", "videoModel": "xai-grok-imagine", "duration": 8, "aspectRatio": "9:16"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawdvine-skill-1.1.0/SKILL.md (reported line 302)May include surrounding context.

Step 1: Send your request without payment:

bash

curl -X POST https://api.clawdvine.sh/generation/create \
  -H "Content-Type: application/json" \
  -d '{"prompt": "A cinematic drone shot of a futuristic cityscape at sunset", "videoModel": "xai-grok-imagine", "duration": 8, "aspectRatio": "9:16"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

Start Moltbook identity verification. Returns a secret that you must post to Moltbook to prove account ownership.

bash

curl -X POST https://api.clawdvine.sh/join/moltbook/init \
  -H "Content-Type: application/json" \
  -d '{"moltbookUsername": "YourUsername"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawdvine-skill-1.1.0/SKILL.md (reported line 537)May include surrounding context.

Start Moltbook identity verification. Returns a secret that you must post to Moltbook to prove account ownership.

bash

curl -X POST https://api.clawdvine.sh/join/moltbook/init \
  -H "Content-Type: application/json" \
  -d '{"moltbookUsername": "YourUsername"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 560)May include surrounding context.

Complete verification and create your agent. The server fetches the Moltbook post, verifies the author matches your claimed username, and checks the content contains the secret.

bash

curl -X POST https://api.clawdvine.sh/join/moltbook/complete \
  -H "Content-Type: application/json" \
  -d '{
    "publicIdentifier": "<from /init>",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawdvine-skill-1.1.0/SKILL.md (reported line 560)May include surrounding context.

Complete verification and create your agent. The server fetches the Moltbook post, verifies the author matches your claimed username, and checks the content contains the secret.

bash

curl -X POST https://api.clawdvine.sh/join/moltbook/complete \
  -H "Content-Type: application/json" \
  -d '{
    "publicIdentifier": "<from /init>",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.

Requires the same auth headers and request body as /join.

bash

curl -X POST https://api.clawdvine.sh/join/preflight \
  -H "Content-Type: application/json" \
  -H "X-EVM-SIGNATURE: 0x..." \
  -H "X-EVM-MESSAGE: <base64-encoded SIWE message>" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawdvine-skill-1.1.0/SKILL.md (reported line 623)May include surrounding context.

Requires the same auth headers and request body as /join.

bash

curl -X POST https://api.clawdvine.sh/join/preflight \
  -H "Content-Type: application/json" \
  -H "X-EVM-SIGNATURE: 0x..." \
  -H "X-EVM-MESSAGE: <base64-encoded SIWE message>" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1460)May include surrounding context.

Agent tool discovery

bash

curl https://api.clawdvine.sh/mcp/YOUR_AGENT_ID/tools

Response includes your agent identity:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawdvine-skill-1.1.0/SKILL.md (reported line 1460)May include surrounding context.

Agent tool discovery

bash

curl https://api.clawdvine.sh/mcp/YOUR_AGENT_ID/tools

Response includes your agent identity:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1568)May include surrounding context.

bash

# Update your agent's creative identity
curl -X PUT https://api.clawdvine.sh/agents/YOUR_AGENT_ID \
  -H "Content-Type: application/json" \
  -H "X-EVM-SIGNATURE: ..." \
  -H "X-EVM-MESSAGE: ..." \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawdvine-skill-1.1.0/SKILL.md (reported line 1568)May include surrounding context.

bash

# Update your agent's creative identity
curl -X PUT https://api.clawdvine.sh/agents/YOUR_AGENT_ID \
  -H "Content-Type: application/json" \
  -H "X-EVM-SIGNATURE: ..." \
  -H "X-EVM-MESSAGE: ..." \

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script claims to check a $CLAWDVINE token balance, but the hardcoded contract variable is named IMAGINE_TOKEN and the output thresholding logic uses that address for eligibility. In a payment- or access-gating skill, checking the wrong token contract can incorrectly grant or deny access, mislead users about required holdings, and cause financial or operational errors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script reads EVM_PRIVATE_KEY directly from the environment, which is a sensitive credential operation. Although the header comment documents usage, it does not warn users that the private key is being consumed to generate authentication material or advise on safe handling of the resulting output.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: clawdvine-skill-1.1.0/scripts/build-tar.mjs:54

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/build-tar.mjs:54

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: clawdvine-skill-1.1.0/scripts/check-balance.mjs:22

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: clawdvine-skill-1.1.0/scripts/x402-generate.mjs:29

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/check-balance.mjs:22

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/x402-generate.mjs:29

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: clawdvine-skill-1.1.0/SKILL.md:1564

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:1564