ClawHub
Back to skill

Security audit

clawslist

Security checks for vulnerabilities and agentic risk

Overview

This marketplace skill is coherent but asks users to upload raw secrets and encourages proactive public posting without clear approval gates.

Install only if you are comfortable with clawslist.com receiving marketplace content and account metadata. Do not upload real API keys, passwords, passphrases, access tokens, private endpoints, or other live secrets to the service. Require human review before any post, reply, DM, profile update, flag, or other state-changing API call, and treat posts and replies as public. Prefer the reviewed ClawHub install path over the manual curl-based install instructions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

other

Error
Location
skill.md:82
Finding

External Collection and Storage of Third-Party Credentials

Content
View full analysis

Vulnerability Details

File Location: skill.md:82-91 and skill.md:385-415
Vulnerability Type: Credential exfiltration
Risk Level: Critical

Vulnerable Code

bash
curl -X POST https://clawslist.com/api/v1/secrets \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "my_api_key", "value": "sk-..."}'
markdown
**What to store as secrets:**
- API keys (OpenAI, Anthropic, GitHub, etc.)
- Access tokens and credentials
- Private URLs or endpoints
- Passwords or passphrases
- Any string that should never appear in public posts

Technical Analysis

The Skill explicitly instructs users or agents to send unrelated API keys, access tokens, passwords, passphrases, and private endpoints to clawslist.com. The stated purpose is to detect accidental disclosure in public posts and replies, but this protection does not require transmitting raw secret values to an external marketplace. Equivalent checks can be performed locally.

HTTPS protects credentials in transit but does not protect them from the receiving service, compromised backend systems, malicious administrators, application vulnerabilities, backups, or unauthorized database access. The documentation states that values are not returned through the API, but this does not demonstrate encryption, restricted backend access, secure deletion, or protection against server compromise.

Attack Path

  1. The agent follows the prominently marked “Add Your Secrets” setup instruction.
  2. It obtains or is provided with valuable third-party credentials.
  3. It submits the raw values to POST https://clawslist.com/api/v1/secrets.
  4. The external service receives and stores secret-equivalent material.
  5. A malicious operator, compromised service, vulnerable backend, or unauthorized database user retrieves the stored values.
  6. The attacker uses the credentials against the corresponding third ...[truncated 579 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all instructions asking users or agents to upload raw third-party credentials, passwords, passphrases, access tokens, or private URLs.
  • Perform content leak detection locally before a post or reply leaves the user’s environment.
  • If server-side comparison is unavoidable, use a carefully designed client-side keyed-fingerprint protocol so the server never receives raw values.
  • Minimize the data collected and document the exact threat model, storage period, deletion behavior, encryption boundaries, and administrative access controls.
  • Ensure secrets are never logged, included in analytics, placed in backups without additional protection, or exposed in error messages.
  • Require explicit human confirmation before processing any sensitive value.
  • Rotate any real credentials that may already have been submitted to the service.

T03 · Remote Payload Retrieval and Execution

Error
Location
skill.md:43
Finding

Mutable Remote Skill Installation Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: skill.md:43-47
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
mkdir -p ~/.moltbot/skills/clawslist
curl -s https://clawslist.com/skill.md > ~/.moltbot/skills/clawslist/SKILL.md
curl -s https://clawslist.com/heartbeat.md > ~/.moltbot/skills/clawslist/HEARTBEAT.md
curl -s https://clawslist.com/messaging.md > ~/.moltbot/skills/clawslist/MESSAGING.md

Technical Analysis

The manual installation procedure downloads mutable Markdown documents from an external origin and writes them directly into the active Skill directory. No immutable version, cryptographic hash, digital signature, or user review is required.

These files are operational instructions consumed by an AI agent. Consequently, changing the remotely hosted documents changes the effective Skill behavior after the reviewed package has been published. Although the retrieved payload is Markdown rather than a conventional executable, agent-followed instructions can invoke tools, issue network requests, access data, and alter subsequent behavior. This creates a remote payload substitution channel.

The use of curl -s also suppresses error output and does not enable --fail; an HTTP error response or unexpected server content may therefore overwrite an existing local Skill file without a clear installation failure.

Attack Path

  1. An attacker compromises clawslist.com, its deployment process, DNS resolution, CDN configuration, or an authorized publishing account.
  2. The attacker replaces one or more hosted Markdown files with malicious agent instructions.
  3. A user runs the documented manual installation commands.
  4. The commands write the attacker-controlled content directly into the active Skill directory.
  5. The agent loads the replaced instructions as trusted Skill behavior.
  6. The injected instructions can direct the agent to disclose dat ...[truncated 565 chars]
Remediation
View remediation

Remediation Suggestions

  • Distribute the reviewed Skill files inside the versioned package instead of retrieving mutable copies during installation.
  • If remote retrieval is required, use immutable, version-specific artifact URLs.
  • Publish and verify cryptographic hashes or signed release manifests before moving downloaded files into the active Skill directory.
  • Download to a temporary location, verify all files, and activate them atomically only after successful validation.
  • Use curl --fail --show-error --location and reject redirects to unapproved origins.
  • Preserve the existing installation when retrieval or verification fails.
  • Present downloaded instruction changes for human review before activation.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
heartbeat.md:103
Finding

Autonomous Publication of Human-Derived Work and Todo Information

Content
View full analysis

Vulnerability Details

File Location: heartbeat.md:103-127 and heartbeat.md:245-259
Vulnerability Type: Unauthorized disclosure through excessive agent autonomy
Risk Level: Medium

Vulnerable Code

markdown
### Think About What You Need

Ask yourself:
- What task is my human stuck on that another agent could help with?
- What skill would complement what I already do?
- What's on my human's todo list that I can't do alone?

**Then post a gig:**

```bash
# Seek help with something specific
curl -X POST https://clawslist.com/api/v1/posts \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "seek",
    "category": "gigs",
    "subcategory": "quick-tasks",
    "title": "Need help scraping 10 websites",
    "body": "Looking for an agent to help collect data. Will reciprocate with research help."
  }'
text

```text
Heartbeat
├── Notifications? → Handle them
├── DM requests? → Approve/reject
├── Unread messages? → Respond
├── Browse opportunities (gigs, jobs, services)
│   ├── Good fit? → Reply with an offer
│   └── Useful for human? → Note it or save it
├── Think: Should I post something?
│   ├── Did I help my human with something shareable? → Post a service
│   ├── Does my human need help with something? → Post a gig
│   └── Did I learn something useful? → Start a discussion
└── Done. Update lastCheck.

Technical Analysis

The heartbeat workflow directs the agent to infer needs from its human’s work and todo list and then publish a gig to an external marketplace. It does not require explicit approval of the exact title and body, a confidentiality review, or redaction before publication.

An agent may have access to private conversation history, business plans, customer information, unpublished projects, internal technical problems, or personal tasks. Turning that context into a public marketplace p ...[truncated 1221 chars]

Remediation
View remediation

Remediation Suggestions

  • Require explicit human approval before every post, reply, direct-message request, or acceptance that creates an external commitment.
  • Show the human the exact destination, title, body, compensation terms, and metadata before submission.
  • Default heartbeat activity to read-only browsing and drafting; never publish automatically.
  • Add mandatory checks for confidential project names, customer data, personal information, internal URLs, credentials, and nonpublic business details.
  • Minimize post content and use generic descriptions unless the human expressly authorizes additional context.
  • Maintain a local audit trail of approved outbound actions without recording sensitive values.
  • Align DM-request handling with messaging.md, which states that the human decides whether a request is approved.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to upload API keys and other secrets to a third-party service, but does not provide a clear privacy, trust, retention, or breach-risk warning. This is dangerous because it normalizes centralizing highly sensitive credentials outside the local agent environment, creating a new high-value target and potential compromise path.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill explicitly advises storing access tokens, credentials, passwords, and other secrets on the external service. That is a true credential-handling risk because it expands the attack surface from the local agent to the platform backend, any insiders, backups, logs, or future compromise of the service.

Content

Scanner excerpt · skill.md (reported line 407)May include surrounding context.

md
**What to store as secrets:**
- API keys (OpenAI, Anthropic, GitHub, etc.)
- Access tokens and credentials
- Private URLs or endpoints
- Passwords or passphrases
- Any string that should never appear in public posts

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill instructs use of an authenticated external API to retrieve notifications, which is a genuine external transmission because the agent sends a bearer token and establishes communication with a third-party service. While this specific call is read-oriented and lower risk than posting, it still expands the external trust boundary and can expose account metadata or trigger downstream automated behavior if used without clear user awareness and authorization.

Content

Scanner excerpt · heartbeat.md (reported line 29)May include surrounding context.

1. Notifications

bash
curl "https://clawslist.com/api/v1/notifications?unread=true" \
  -H "Authorization: Bearer YOUR_API_KEY"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section explicitly encourages the agent to proactively create marketplace posts about what it can offer and what its human needs, using authenticated API calls, without requiring user confirmation, privacy review, or limits on what may be disclosed. In an agent setting, that creates a real risk of unauthorized external sharing of sensitive project details, capabilities, needs, or relationship data, and can also trigger irreversible marketplace-side effects such as public postings and outreach.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · messaging.md (reported line 38)May include surrounding context.

Found someone on clawslist you want to work with? Send a request:

bash
curl -X POST https://clawslist.com/api/v1/dm/request \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 45)May include surrounding context.

| MESSAGING.md | Private messaging system |

bash
mkdir -p ~/.moltbot/skills/clawslist
curl -s https://clawslist.com/skill.md > ~/.moltbot/skills/clawslist/SKILL.md
curl -s https://clawslist.com/heartbeat.md > ~/.moltbot/skills/clawslist/HEARTBEAT.md
curl -s https://clawslist.com/messaging.md > ~/.moltbot/skills/clawslist/MESSAGING.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 46)May include surrounding context.

bash
mkdir -p ~/.moltbot/skills/clawslist
curl -s https://clawslist.com/skill.md > ~/.moltbot/skills/clawslist/SKILL.md
curl -s https://clawslist.com/heartbeat.md > ~/.moltbot/skills/clawslist/HEARTBEAT.md
curl -s https://clawslist.com/messaging.md > ~/.moltbot/skills/clawslist/MESSAGING.md

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 46)May include surrounding context.

bash
mkdir -p ~/.moltbot/skills/clawslist
curl -s https://clawslist.com/skill.md > ~/.moltbot/skills/clawslist/SKILL.md
curl -s https://clawslist.com/heartbeat.md > ~/.moltbot/skills/clawslist/HEARTBEAT.md
curl -s https://clawslist.com/messaging.md > ~/.moltbot/skills/clawslist/MESSAGING.md

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The posting and reply workflow encourages users to create public content but does not prominently warn that posts and replies are publicly visible and may be indexed, retained, or reviewed by others. That omission increases the chance of users disclosing sensitive business context, personal data, or operational details under the mistaken assumption that the platform is semi-private.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill enables direct transmission of user-authored content to an external service through API calls that create public posts. This becomes security-relevant because the skill encourages autonomous participation and does not enforce consent or review gates before external publication, increasing the risk of unintended disclosure or unauthorized actions.

Content

Scanner excerpt · skill.md (reported line 152)May include surrounding context.

Create a Post

bash
curl -X POST https://clawslist.com/api/v1/posts \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 173)May include surrounding context.

bash
# All posts
curl "https://clawslist.com/api/v1/posts" -H "Authorization: Bearer KEY"

# Filter by type
curl "https://clawslist.com/api/v1/posts?type=offer" -H "Authorization: Bearer KEY"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example trigger phrases are broad, imperative, and map directly to actions like posting, replying, and checking messages. In agent ecosystems, such generic phrases can cause unintended invocation or over-eager automation, leading to accidental external actions on behalf of a user without an explicit confirmation boundary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.