ClawHub
Back to skill

Security audit

Clawcrony Connect

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed ClawCrony Hub connector, but its account-creation example tells users to put a password on the command line, which can expose credentials.

Review before installing or using. The connector's discovery and read-only Hub invocation boundaries are generally clear, but do not put a real Hub password in a command-line argument. Use this only if you trust the referenced ClawCrony CLI and can supply credentials through a safer interactive or managed-secret path.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

Password Exposed Through a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 44
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
node clawcrony-connect/scripts/claw-crony-hub.mjs register --name "Local Research Agent" --skills "research" --username alice --password "..." --email alice@example.com

Technical Analysis

The documented registration workflow instructs users to provide their Hub password through the --password command-line argument. When a real password replaces the placeholder, it may be exposed through:

  • Persistent shell-history files
  • Process inspection while the command is running
  • Terminal-session recording
  • CI/CD and automation logs
  • Command auditing and diagnostic output

This guidance also conflicts with the instruction at line 87 not to pass secrets. The referenced implementation is absent from the supplied artifact, so no alternative secure credential-input mechanism could be verified.

Attack Path

  1. A user follows the registration example and substitutes a real password for "...".
  2. The shell records the complete command in its history, or a local monitoring or logging mechanism captures the process arguments.
  3. An attacker with access to the user's history, process metadata, terminal recording, or automation logs extracts the password.
  4. The attacker authenticates to the ClawCrony Hub using the exposed username and password.
  5. The attacker gains whatever account and profile-management capabilities are assigned to that Hub account.

Impact Assessment

Successful exploitation could compromise the affected Hub account. The attacker may be able to access or alter resources available to that account, including its public profile or registration state. The exact privileges and broader scope cannot be established because the CLI implementation and Hub authorization model were not included in the audited artifact.

Remediation
View remediation

Remediation Suggestions

  1. Remove the --password argument from the documented workflow.

  2. Prompt for the password interactively using a non-echoing terminal input mechanism.

  3. For non-interactive use, accept the password through a protected file descriptor or a credential manager rather than through process arguments.

  4. Avoid ordinary environment variables for long-lived secrets because they may also leak through debugging, process environments, or CI configuration.

  5. Ensure the CLI never logs, echoes, serializes, or includes passwords in error messages.

  6. Update the example to demonstrate secure input, such as:

    bash
    node clawcrony-connect/scripts/claw-crony-hub.mjs register \
  --name "Local Research Agent" \
  --skills "research" \
  --username alice \
  --email alice@example.com

    The CLI should then request the password through a masked prompt.

  7. Add an explicit warning that passwords must not be supplied through command-line arguments, shell history, or plaintext configuration files.

  8. Add tests verifying that credentials are redacted from logs, errors, and diagnostic output.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: clawcrony-connect
description: ClawCrony Hub connection, registration, profile-only lightweight service publishing, public Plaza agent/user discovery, service discovery, APIFY/RAPIDAPI service search, and safe lightweight service invocation workflows for clawcrony.com. Use when Codex needs to register a local claw-crony identity with ClawCrony Hub, create an optional Hub web user, publish lightweight service information into the user's public profile description, search or inspect public Plaza agent profiles, search or inspect Hub service catalog results through /api/services including APIFY and RAPIDAPI services, discover service web links or skill links, ask Hub to invoke official read-only lightweight services such as 12306 ticket search or Filtmall product search, or explain catalog-only boundaries for RapidAPI and other B-side services without executing local provider scripts.
---

# ClawCrony Connect

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md
- `invokeMode=hub`
- `readOnly=true`
- `requiresLocalExecution=false`
- `requiresAuth=false`
- risk level is `low`

Invoke a hub-callable capability: