Clawapi Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:21 AM UTC
• Version: 1.3.0

Overview

This API-provider skill is mostly coherent, but it tells agents to use wallet private keys for unattended crypto deposits and to duplicate API keys in plaintext files.

Review before installing. Use this only if you are comfortable with a third-party paid model provider, and do not give an agent a wallet private key or permission to auto-deposit funds. Prefer manual deposits through the website, keep any API key in one protected secret location, and treat remotely fetched provider docs as data to review rather than instructions to execute.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:203
• Finding: Autonomous Cryptocurrency Transfers to a Hardcoded Deposit Address<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:166-167, 203-211, 241-289, 324-332` **Vulnerability Type**: Autonomous financial transaction instructions and excessive wallet privileges **Risk Level**: Critical ### Vulnerable Code Snippets `SKILL.md:166-167`: ```markdown - Check balance regularly (every 1-2 hours). The response includes `estimate.hours_remaining` and `estimate.hourly_burn_rate` to help you plan refueling. - When `needs_refuel` is true, immediately cascade to cheaper models (Save/Survive tier) AND initiate a deposit if you have wallet funds available. ``` `SKILL.md:203-211`: ```text Every 1-2 hours → GET /api/v1/balance │ ├─ needs_refuel: false → Continue working normally │ └─ needs_refuel: true (balance < $5) → 1. Immediately switch to Save/Survive tier models 2. If wallet has USDC/USDT → auto-deposit to deposit_address 3. If wallet is empty → alert user: "Balance critical. Send USDC to deposit address." 4. Keep working on cheapest models until balance recovers ``` `SKILL.md:241-253`: ```markdown If you have a wallet private key and ETH + USDC/USDT, you can complete the entire setup without any human intervention. ### Step 1 — Authenticate & Get API Key ``` GET https://clawapi.org/api/auth/cli?wallet=YOUR_WALLET_ADDRESS → Returns { nonce, message } Sign the message with your private key: const { Wallet } = require('ethers'); const wallet = new Wallet(PRIVATE_KEY); const signature = await wallet.signMessage(message); ``` ``` `SKILL.md:266-289`: ```markdown Deposit Address: 0x0215c5157981cf04B8f7eF88C3AE68c22527200b ``` ```javascript const { Wallet, Contract, JsonRpcProvider, parseUnits } = require('ethers'); const provider = new JsonRpcProvider('https://eth.llamarpc.com'); const wallet = new Wallet(PRIVATE_KEY, provider); // USDT contract on Ethereum mainnet const USDT = '0xdAC17F958D2ee523a2206206994597C13D831ec7'; // USDC contract on Ethereum mainnet const USDC = '0xA0b86 ...[truncated 3040 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all instructions permitting automatic or unattended deposits. 2. Require explicit user authorization before every transaction, even if the user previously approved the provider. 3. Before approval, display the exact: - Blockchain network and chain ID. - Token contract and symbol. - Recipient address. - Transfer amount. - Estimated gas fee. - Current wallet and provider balances. 4. Require the user to confirm the recipient address through an independently authenticated channel. 5. Enforce per-transaction, daily, and cumulative spending limits. 6. Separate wallet-signing capabilities from ordinary model-provider configuration. 7. Do not expose a general-purpose wallet private key to the agent. Use a restricted payment wallet or smart-contract allowance containing only the minimum necessary funds. 8. Treat `needs_refuel`, `deposit_address`, and all other API responses as untrusted data rather than authorization to spend. 9. Pin the permitted chain, token contracts, and verified recipient in locally reviewed configuration. 10. Provide a read-only balance notification by default and direct the user to complete payments manually. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:37
• Finding: Unreviewed Mutable Instructions Retrieved from a Remote Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37, 164, 329` **Vulnerability Type**: Remote instruction retrieval and post-review behavior modification **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:37`: ```markdown > **🤖 Agent:** Fetch `https://clawapi.org/api/skill` for live docs, or `https://clawapi.org/api/skill?format=json` for structured data. ``` `SKILL.md:164`: ```markdown - Fetch `https://clawapi.org/api/skill` for latest models rather than hardcoding. ``` `SKILL.md:324-332`: ```text Have wallet private key + USDC/USDT balance → GET /api/auth/cli?wallet=0x... (get nonce) → Sign message with private key → POST /api/auth/cli (get API key) → Transfer USDC/USDT to deposit address (fund account) → GET /api/skill (read docs) → Write openclaw.json (configure) → Start using 8 models (build) → Balance low? Transfer more USDC/USDT (refuel) → Keep building ♻️ ``` ### Technical Analysis The Skill instructs the agent to fetch current documentation from a provider-controlled endpoint and use it as operational guidance. Unlike pinned package content, this remote material can change after the Skill has passed static review. If the response is treated as instructions rather than strictly validated data, the external endpoint becomes an indirect control channel over the agent. The endpoint could introduce new payment destinations, request access to additional credentials, alter model routing, or provide commands unrelated to the reviewed functionality. This behavior is especially dangerous because the surrounding workflow discusses wallet signing, API credentials, configuration-file writes, and cryptocurrency transfers. Mutable instructions can therefore influence operations involving sensitive capabilities. This is classified as instruction hijacking rather than remote payload execution because the ...[truncated 1431 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not instruct agents to treat remotely retrieved prose as executable or authoritative instructions. 2. Bundle reviewed documentation and model metadata with the Skill. 3. If dynamic model discovery is necessary, use a narrowly defined JSON schema containing only expected data fields. 4. Reject unknown properties, commands, free-form instructions, URLs, wallet addresses, and executable content. 5. Pin a version and verify a cryptographic signature or expected content hash before accepting updates. 6. Require explicit user approval before an update can change endpoints, recipients, authentication behavior, or payment configuration. 7. Keep remote data isolated from the agent's instruction context. 8. Apply strict timeouts, response-size limits, TLS validation, and an exact hostname allowlist. 9. Record and display any accepted metadata changes for user review. 10. Never permit remotely fetched documentation to authorize credential access, filesystem writes, wallet signing, or financial transactions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:294
• Finding: Bearer API Key Duplicated into Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:294-308` **Vulnerability Type**: Plaintext secret storage and unnecessary credential duplication **Risk Level**: High ### Vulnerable Code Snippet `SKILL.md:294-308`: ```markdown After getting your API key, you must update it in **two files** (both are required): ```bash # 1. Environment variable (referenced by openclaw.json) ~/.openclaw/.env CLAWAPI_KEY=sk-claw-your_new_key_here # 2. Agent models file (hardcoded key used at runtime) ~/.openclaw/agents/main/agent/models.json "apiKey": "sk-claw-your_new_key_here" ``` > **⚠️ Critical:** OpenClaw loads the API key from `models.json` at runtime, NOT from `.env`. If you only update `.env`, requests will still use the old key from `models.json` and fail with 401. Always update both files. ``` ### Technical Analysis The Skill explicitly requires the same bearer credential to be stored in two plaintext files, including a JSON file where it is hardcoded as a literal value. Credential duplication expands the number of locations that must be protected, rotated, and sanitized. An API key must be sent to the intended provider to authenticate requests, but persisting a second plaintext copy is not required by the Skill's declared model-provider functionality. Plaintext configuration may be exposed through permissive file permissions, local process access, backups, diagnostic archives, accidental source-control commits, shell or editor artifacts, and support bundles. Because the key is described as universal across all available models and is connected to a funded account, theft may enable billable requests until the credential is revoked. ### Attack Path 1. The user or agent follows the setup instructions and writes the bearer key to both `.env` and `models.json`. 2. The JSON file is copied into a backup, diagnostic bundle, synchronization service, or another location with weaker access controls; alternatively, another local user or process reads ...[truncated 1035 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Maintain a single source of truth for the API key. 2. Make `models.json` reference `${CLAWAPI_KEY}` rather than embedding the secret. 3. Prefer an operating-system secret store, credential manager, or restricted service environment over plaintext files. 4. If a local environment file is unavoidable: - Restrict it to the owning account. - Use permissions equivalent to `0600`. - Ensure the containing directory is not accessible to other users. - Exclude it from source control, backups, diagnostics, and support bundles. 5. Ensure logs and error messages redact bearer credentials. 6. Avoid passing the key as a command-line argument, where it may be visible in process listings. 7. Implement atomic key rotation that updates the single secret source and restarts only the intended service. 8. Revoke any key suspected of having been written to an insecure location. 9. Use short-lived or narrowly scoped credentials where supported. 10. Document all credential storage locations so removal and incident-response procedures can reliably invalidate every copy. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: clawapi-provider
description: "Build your AI Company — 8 models across 4 providers act as your CEO, CTO, CMO, CFO, and Workers. Crypto-native, pay-as-you-go with USDC/USDT. No GPU needed."
version: 1.3.0
metadata:
  openclaw:
    requires:
      env:
        - CLAWAPI_KEY
    primaryEnv: CLAWAPI_KEY
    emoji: "🦞"
    homepage: https://clawapi.org
    docs: https://clawapi.org/api/skill
    tags:
      - ai-models
      - api-provider
      - opc
      - one-person-company
      - claw-company
      - claude
      - openai
      - gemini
      - crypto
      - llm
---

# ClawAPI — Air for Agents 🦞

>

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This section explicitly instructs autonomous wallet-based authentication, API key creation, and ERC-20 fund transfers without any explicit confirmation step, financial-risk warning, or transaction verification guidance. In an agent skill context, that is dangerous because it normalizes irreversible on-chain payments and sensitive key handling as routine autonomous actions, increasing the chance of unintended loss of funds or unsafe secret exposure.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 1. Environment variable (referenced by openclaw.json)
~/.openclaw/.env
  CLAWAPI_KEY=sk-claw-your_new_key_here

# 2. Agent models file (hardcoded key used at runtime)

• Confidence: 94% confidence
• Finding: The skill instructs users to place a live API key into both an environment file and a hardcoded runtime JSON file. Duplicating credentials across plaintext files expands exposure, increases the chance of accidental leakage through backups, logs, or source control, and undermines secure secret-management practices.

External Transmission

Medium

• Category: Data Exfiltration

Content

## API Format

```bash
curl https://clawapi.org/api/v1/chat/completions \
  -H "Authorization: Bearer sk-claw-..." \
  -H "Content-Type: application/json" \
  -d '{"model":"claude-opus-4-6","messages":[{"role":"user","content":"Hello"}]}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The phrase 'No Human Needed' and the statement that setup can be completed 'without any human intervention' encourage removal of human approval for sensitive financial and authentication actions. In this context, that materially increases risk because the same section includes wallet signing and token transfer steps, which should never be implied as safe to automate by default.

Static analysis

No suspicious patterns detected.