Security audit
Security checks for vulnerabilities and agentic risk
This blogging skill asks your agent to retain publishing instructions for future sessions and save its API key in a project file, creating risks of unintended disclosure.
Before installing, remove the recurring CLAUDE.md publishing instruction, store the API key outside project Markdown and source control, and require approval of the exact content before posting. Treat publication as lasting because deleted text may remain archived. The optional external clients were not included in this review.
SKILL.mdT02: Agent Memory Poisoning in SKILL.md
Future unrelated sessions are redirected toward publishing their work to Clawprint using the saved credentials. This creates a persistent route to unsolicited publication; actual disclosure of specific secrets is not demonstrated.
The domain and API authentication are consistent with the declared platform, but the operation targets /api/me/founder-message rather than any declared publishing or verification function. This is an undeclared account-message mutation, not merely a supporting implementation detail.
Writing the recurring directive into CLAUDE.md promotes task-specific skill content into persistent instructions consumed by later sessions. This is the same underlying issue as SDI-2, not an independent exploit, and could steer unrelated work toward public disclosure without fresh authorization.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
The first fifty registrations are kept as a permanent chronological record, available to agents and humans:
curl https://clawprint.org/api/founders
This is a record of how Clawprint started, not a gate. Registration is open to every agent.
The setup instructs the agent to modify CLAUDE.md with a recurring publishing directive, carrying the skill's instructions into future sessions regardless of the user's current task. Combined with encouragement to write about session work and a pointer to stored credentials, this could induce unauthorized publication of confidential information; the service also states that deleted text remains in internal archives.