ClawTruth Protocol

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:44 PM UTC
• Version: 1.3.3

Overview

The skill is not malicious, but users should review it because routine fact-checking can be routed into an external reputation protocol that collects identity details and submits public actions.

Install only if you intend to use ClawTruth as an external verification and reputation protocol. Do not let the agent sign up, send an email or wallet address, submit claims, or submit verdicts unless you explicitly approve that action and are comfortable linking the resulting activity to that identity.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:90
• Finding: Excessive Personal Data Collection During Agent Signup## Vulnerability Details **File Location**: `SKILL.md:90-100` **Vulnerability Type**: Excessive Personal Data Collection **Risk Level**: Medium ### Complete Code Snippet ```text POST /agent/signup Example request { "name": "Research_Node_01", "specialty": "Market Intelligence", "bio": "Autonomous verification unit.", "wallet_address": "0x123...", "email": "[[e-mail]](mailto:[e-mail])", "x_handle": "@agent" } ``` The fields are explicitly presented as required in `examples/agent-signup.md:5-24`: ```text Required fields: • name • specialty • bio • wallet_address • email • x_handle (optional) Step 2 — Send signup request POST /api/agent/signup { "name": "Nexus_Node_01", "specialty": "On-chain_Security", "bio": "Strategic audit node for EVM verification.", "wallet_address": "0x123...abc", "email": "[e-mail]", "x_handle": "ClawTruth" } ``` ### Technical Analysis The signup workflow directs an agent to send an email address and blockchain wallet address to `https://www.clawtruth.com/api`. These are externally linkable identifiers that can associate an agent profile and protocol activity with an individual or organization. The documentation does not explain why both identifiers are mandatory, identify a data-minimizing alternative, describe retention or privacy handling, or instruct the agent to obtain explicit user approval before transmission. Although network communication is intrinsic to the declared remote protocol, collecting both identifiers is not shown to be necessary for claim discovery, fact verification, or API authentication. No evidence indicates that the data is sent to an unrelated domain or that the Skill intentionally exfiltrates credentials. The risk arises from unnecessary collection and disclosure to the declared service. ### Attack Path 1. An agent loads the Skill and follows its registration workflow. 2. The workflow re ...[truncated 1093 chars]
• Remediation: ## Remediation Suggestions 1. Make email and wallet address optional unless each is essential to a documented protocol requirement. 2. Support pseudonymous registration using an agent-generated identifier and API key. 3. Before transmission, clearly disclose: - Which fields will be sent - The destination domain - The purpose of each field - Retention and deletion policies - Whether the data will be shared or used for identity correlation 4. Require explicit user confirmation before sending email addresses, wallet addresses, or other personal identifiers. 5. Avoid automatically sourcing these fields from local profiles, environment variables, memory, or unrelated conversations. 6. Allow users to omit unnecessary profile attributes and submit only the minimum data required for the requested operation. 7. Document mechanisms for profile deletion, consent withdrawal, and correction of stored information. 8. Keep API credentials separate from personal information and redact both credentials and identifiers from logs and diagnostic output.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill’s activation guidance is broad enough to trigger on common user requests like verifying whether something is true, auditing sources, or doing research. This can cause the agent to invoke the skill in situations where external API use, reputation-seeking behavior, or protocol participation is unnecessary, increasing the chance of unintended data sharing, overreach, or workflow hijacking.

Static analysis

No suspicious patterns detected.