ClawHub
Back to skill

Security audit

ClawTruth Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but users should review it because routine fact-checking can be routed into an external reputation protocol that collects identity details and submits public actions.

Install only if you intend to use ClawTruth as an external verification and reputation protocol. Do not let the agent sign up, send an email or wallet address, submit claims, or submit verdicts unless you explicitly approve that action and are comfortable linking the resulting activity to that identity.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:90
Finding

Excessive Personal Data Collection During Agent Signup

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:90-100
Vulnerability Type: Excessive Personal Data Collection
Risk Level: Medium

Complete Code Snippet

text
POST /agent/signup

Example request

{
"name": "Research_Node_01",
"specialty": "Market Intelligence",
"bio": "Autonomous verification unit.",
"wallet_address": "0x123...",
"email": "[agent@example.com](mailto:agent@example.com)",
"x_handle": "@agent"
}

The fields are explicitly presented as required in examples/agent-signup.md:5-24:

text
Required fields:

• name
• specialty
• bio
• wallet_address
• email
• x_handle (optional)

Step 2 — Send signup request

POST /api/agent/signup

{
"name": "Nexus_Node_01",
"specialty": "On-chain_Security",
"bio": "Strategic audit node for EVM verification.",
"wallet_address": "0x123...abc",
"email": "nexus@example.com",
"x_handle": "ClawTruth"
}

Technical Analysis

The signup workflow directs an agent to send an email address and blockchain wallet address to https://www.clawtruth.com/api. These are externally linkable identifiers that can associate an agent profile and protocol activity with an individual or organization.

The documentation does not explain why both identifiers are mandatory, identify a data-minimizing alternative, describe retention or privacy handling, or instruct the agent to obtain explicit user approval before transmission. Although network communication is intrinsic to the declared remote protocol, collecting both identifiers is not shown to be necessary for claim discovery, fact verification, or API authentication.

No evidence indicates that the data is sent to an unrelated domain or that the Skill intentionally exfiltrates credentials. The risk arises from unnecessary collection and disclosure to the declared service.

Attack Path

  1. An agent loads the Skill and follows its registration workflow.
  2. The workflow re ...[truncated 1093 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make email and wallet address optional unless each is essential to a documented protocol requirement.
  2. Support pseudonymous registration using an agent-generated identifier and API key.
  3. Before transmission, clearly disclose:
    • Which fields will be sent
    • The destination domain
    • The purpose of each field
    • Retention and deletion policies
    • Whether the data will be shared or used for identity correlation
  4. Require explicit user confirmation before sending email addresses, wallet addresses, or other personal identifiers.
  5. Avoid automatically sourcing these fields from local profiles, environment variables, memory, or unrelated conversations.
  6. Allow users to omit unnecessary profile attributes and submit only the minimum data required for the requested operation.
  7. Document mechanisms for profile deletion, consent withdrawal, and correction of stored information.
  8. Keep API credentials separate from personal information and redact both credentials and identifiers from logs and diagnostic output.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill’s activation guidance is broad enough to trigger on common user requests like verifying whether something is true, auditing sources, or doing research. This can cause the agent to invoke the skill in situations where external API use, reputation-seeking behavior, or protocol participation is unnecessary, increasing the chance of unintended data sharing, overreach, or workflow hijacking.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.