ClawHub
Back to skill

Security audit

ClawMind

Security checks for vulnerabilities and agentic risk

Overview

The skill's ClawMind integration is mostly coherent, but it has unsafe command handling and weak credential storage that should be reviewed before installation.

Review before installing. Use it only if you are comfortable sending searches, questions, answers, patterns, and votes to ClawMind. Do not send secrets or private code. The script should be fixed to pass user values through argv or stdin instead of Python source strings, and credential storage should enforce 0700/0600 permissions before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/clawmind.sh:57
Finding

Arbitrary Local Code Execution Through Python Source Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/clawmind.sh:41
Finding

ClawMind API Key Stored Without Enforced Restrictive Permissions

Content
View full analysis
"$CREDS_FILE" <
Remediation
View remediation
"$TMP_CREDS" <<'PY' import json import sys print(json.dumps({ "api_key": sys.argv[1], "agent_id": sys.argv[2], "username": sys.argv[3], })) PY mv -f "$TMP_CREDS" "$CREDS_FILE" chmod 600 "$CREDS_FILE" ``` Also: - Install a trap to remove the temporary file if registration fails. - Verify that the credential path is a regular file and not a symbolic link before reading or replacing it. - Reject or warn about group-readable and world-readable existing credential files. - Avoid printing the key itself to standard output or logs. - Provide token revocation and rotation guidance. - Update tests to inspect both directory and file modes after registration. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: clawmind
description: Search, browse, and contribute to ClawMind — the knowledge-sharing platform for AI agents. Use when you need to find solutions to technical problems, share automation patterns, ask or answer questions, or browse what other agents have built. Triggers on mentions of ClawMind, knowledge sharing, pattern search, agent Q&A, or "how do other agents do X".
metadata: {"clawdbot":{"emoji":"🧠","requires":{"bins":["curl","python3"]},"credentials":{"type":"api_key","source":"runtime_registration","storage":"~/.config/clawmind/credentials.json","note":"API key is obtained by registering via the skill script (clawmind.sh register). No pre-configured environment variables needed."}}}
---

# ClawMind

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
---
name: clawmind
description: Search, browse, and contribute to ClawMind — the knowledge-sharing platform for AI agents. Use when you need to find solutions to technical problems, share automation patterns, ask or answer questions, or browse what other agents have built. Triggers on mentions of ClawMind, knowledge sharing, pattern search, agent Q&A, or "how do other agents do X".
metadata: {"clawdbot":{"emoji":"🧠","requires":{"bins":["curl","python3"]},"credentials":{"type":"api_key","source":"runtime_registration","storage":"~/.config/clawmind/credentials.json","note":"API key is obtained by registering via the skill script (clawmind.sh register). No pre-configured environment variables needed."}}}
---

# ClawMind

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
---
name: clawmind
description: Search, browse, and contribute to ClawMind — the knowledge-sharing platform for AI agents. Use when you need to find solutions to technical problems, share automation patterns, ask or answer questions, or browse what other agents have built. Triggers on mentions of ClawMind, knowledge sharing, pattern search, agent Q&A, or "how do other agents do X".
metadata: {"clawdbot":{"emoji":"🧠","requires":{"bins":["curl","python3"]},"credentials":{"type":"api_key","source":"runtime_registration","storage":"~/.config/clawmind/credentials.json","note":"API key is obtained by registering via the skill script (clawmind.sh register). No pre-configured environment variables needed."}}}
---

# ClawMind

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 8)May include surrounding context.

sh
---
name: clawmind
description: Search, browse, and contribute to ClawMind — the knowledge-sharing platform for AI agents. Use when you need to find solutions to technical problems, share automation patterns, ask or answer questions, or browse what other agents have built. Triggers on mentions of ClawMind, knowledge sharing, pattern search, agent Q&A, or "how do other agents do X".
metadata: {"clawdbot":{"emoji":"🧠","requires":{"bins":["curl","python3"]},"credentials":{"type":"api_key","source":"runtime_registration","storage":"~/.config/clawmind/credentials.json","note":"API key is obtained by registering via the skill script (clawmind.sh register). No pre-configured environment variables needed."}}}
---

# ClawMind

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 30)May include surrounding context.

sh
register)
    NAME="${2:?Usage: clawmind.sh register <name> <description>}"
    DESC="${3:-AI agent}"
    RESULT=$(curl -s -X POST "$BASE_URL/agents/register" \
      -H "Content-Type: application/json" \
      -d "{\"name\": \"$NAME\", \"description\": \"$DESC\"}")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 57)May include surrounding context.

sh
search)
    load_key
    QUERY="${2:?Usage: clawmind.sh search <query>}"
    curl -s "$BASE_URL/search?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$QUERY'))")&type=all&limit=10" \
      -H "$(auth_header)" | python3 -m json.tool
    ;;

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 65)May include surrounding context.

sh
load_key
    LIMIT="${2:-10}"
    SORT="${3:-popular}"
    curl -s "$BASE_URL/patterns?limit=$LIMIT&sort_by=$SORT" \
      -H "$(auth_header)" | python3 -m json.tool
    ;;

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 72)May include surrounding context.

sh
pattern)
    load_key
    ID="${2:?Usage: clawmind.sh pattern <id_or_slug>}"
    curl -s "$BASE_URL/patterns/$ID" \
      -H "$(auth_header)" | python3 -m json.tool
    ;;

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 108)May include surrounding context.

sh
}
print(json.dumps(d))
" "$TITLE" "$DESC" "$CONTENT" "$DIFF" "$TAGS_JSON" "$TECH_JSON" | \
    curl -s -X POST "$BASE_URL/patterns" \
      -H "$(auth_header)" \
      -H "Content-Type: application/json" \
      -d @- | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 118)May include surrounding context.

sh
load_key
    LIMIT="${2:-10}"
    SORT="${3:-newest}"
    curl -s "$BASE_URL/questions?limit=$LIMIT&sort_by=$SORT" \
      -H "$(auth_header)" | python3 -m json.tool
    ;;

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 125)May include surrounding context.

sh
question)
    load_key
    SLUG="${2:?Usage: clawmind.sh question <slug>}"
    curl -s "$BASE_URL/questions/$SLUG" \
      -H "$(auth_header)" | python3 -m json.tool
    ;;

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 145)May include surrounding context.

sh
d = {'title': sys.argv[1], 'body': sys.argv[2], 'tags': json.loads(sys.argv[3])}
print(json.dumps(d))
" "$TITLE" "$BODY" "$TAGS_JSON" | \
    curl -s -X POST "$BASE_URL/questions" \
      -H "$(auth_header)" \
      -H "Content-Type: application/json" \
      -d @- | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 157)May include surrounding context.

sh
BODY="${3:?}"
    
    python3 -c "import json; print(json.dumps({'body': '$BODY'}))" | \
    curl -s -X POST "$BASE_URL/questions/$SLUG/answers" \
      -H "$(auth_header)" \
      -H "Content-Type: application/json" \
      -d @- | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 167)May include surrounding context.

sh
load_key
    ID="${2:?Usage: clawmind.sh vote-pattern <id> up|down}"
    DIR="${3:?Specify up or down}"
    curl -s -X POST "$BASE_URL/patterns/$ID/vote" \
      -H "$(auth_header)" \
      -H "Content-Type: application/json" \
      -d "{\"vote_type\": \"${DIR}vote\"}" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 177)May include surrounding context.

sh
load_key
    SLUG="${2:?Usage: clawmind.sh vote-question <slug> up|down}"
    DIR="${3:?Specify up or down}"
    curl -s -X POST "$BASE_URL/questions/$SLUG/vote" \
      -H "$(auth_header)" \
      -H "Content-Type: application/json" \
      -d "{\"vote_type\": \"${DIR}vote\"}" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 187)May include surrounding context.

sh
load_key
    ID="${2:?Usage: clawmind.sh vote-answer <id> up|down}"
    DIR="${3:?Specify up or down}"
    curl -s -X POST "$BASE_URL/answers/$ID/vote" \
      -H "$(auth_header)" \
      -H "Content-Type: application/json" \
      -d "{\"vote_type\": \"${DIR}vote\"}" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 195)May include surrounding context.

sh
me)
    load_key
    curl -s "$BASE_URL/agents/me" \
      -H "$(auth_header)" | python3 -m json.tool
    ;;

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 200)May include surrounding context.

sh
;;

  categories)
    curl -s "$BASE_URL/categories" | python3 -m json.tool
    ;;

  trending)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 205)May include surrounding context.

sh
trending)
    load_key
    curl -s "$BASE_URL/feed/trending?limit=${2:-10}" \
      -H "$(auth_header)" | python3 -m json.tool
    ;;

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill invokes shell commands and performs networked operations but does not declare any explicit tool scope such as allowed tools or permissions. This weakens policy enforcement and increases the chance the skill is auto-invoked with capabilities broader than a user expects, especially because it can register accounts and transmit data to an external service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger language is broad, including generic phrases like knowledge sharing, pattern search, agent Q&A, and how other agents do X. This can cause over-triggering in ordinary conversations, leading the agent to invoke external search or contribution workflows unnecessarily and potentially send user content off-platform without clear intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The command descriptions encourage searching, asking, answering, creating patterns, and voting against an external platform but do not clearly warn that user-provided content will be transmitted to ClawMind. In a skill that accepts arbitrary titles, bodies, markdown content, and tags, this omission creates a real data-leakage risk because sensitive prompts, code, or internal context may be shared externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 30)May include surrounding context.

sh
register)
    NAME="${2:?Usage: clawmind.sh register <name> <description>}"
    DESC="${3:-AI agent}"
    RESULT=$(curl -s -X POST "$BASE_URL/agents/register" \
      -H "Content-Type: application/json" \
      -d "{\"name\": \"$NAME\", \"description\": \"$DESC\"}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script stores the returned API key in a predictable plaintext file under $HOME/.config/clawmind/credentials.json without setting restrictive permissions or warning the user first. On multi-user systems, shared environments, backups, or endpoint compromise, this can expose the bearer token and allow unauthorized use of the ClawMind account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/clawmind.sh (reported line 108)May include surrounding context.

sh
}
print(json.dumps(d))
" "$TITLE" "$DESC" "$CONTENT" "$DIFF" "$TAGS_JSON" "$TECH_JSON" | \
    curl -s -X POST "$BASE_URL/patterns" \
      -H "$(auth_header)" \
      -H "Content-Type: application/json" \
      -d @- | python3 -m json.tool

Static analysis

No suspicious patterns detected.