Clawflows

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill is a clear automation runner, but it asks users to install and run mutable third-party workflows that can use sensitive local capabilities without a strong review or trust gate.

Review the clawflows npm package and each automation YAML before installing or running it. Prefer dry-run first, avoid granting workflows access to email, calendars, databases, or scheduling unless you trust the publisher and understand the requested capabilities, and be cautious with the global npm install because it is not pinned to a reviewed version.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–12 and 18–22
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

yaml

requires:
  bins: ["clawflows"]
install:
  - id: node
    kind: node
    package: clawflows
    bins: ["clawflows"]
    label: "Install ClawFlows CLI (npm)"

bash

npm i -g clawflows

Technical Analysis

The skill directs users to install the latest available version of the third-party clawflows npm package globally. No exact package version, lockfile, checksum, signature, or other integrity constraint is specified. The skill's own version: 1.0.0 field does not constrain the npm dependency version.

npm packages may execute lifecycle scripts during installation. Consequently, an unpinned package release can introduce new executable behavior after this skill has been reviewed. Global installation also makes the command available system-wide for the current environment and may increase the scope of any malicious or defective package behavior.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release process.
2. The attacker publishes a malicious version under the existing clawflows package name.
3. A user follows the documented npm i -g clawflows instruction.
4. npm retrieves the current package version without enforcing an audited version or digest.
5. Malicious package code or an applicable lifecycle script executes with the permissions of the user running npm.
6. The globally installed executable remains available for later invocations.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Accessible files, credentials, environment variables, and network resources would be limited by that user's operating-system permissions. The global installation may also modify shared user-level CLI state. T ...[truncated 85 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, reviewed npm version rather than installing the latest release.
• Record and verify the package integrity digest through a lockfile or equivalent integrity mechanism.
• Prefer a project-local installation over a global installation when global availability is unnecessary.
• Review the package contents and publisher identity before approving version updates.
• Disable npm lifecycle scripts during installation where the package does not require them.
• Perform dependency updates through a controlled review process with provenance and change verification.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:43

Finding

Remote Registry Automations Are Downloaded and Executed Without a Documented Trust Gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–57
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Medium

Vulnerable Code:

markdown

### Install an automation

```bash
clawflows install youtube-competitor-tracker

Downloads to ./automations/youtube-competitor-tracker.yaml

List installed automations

bash

clawflows list

Run an automation

bash

clawflows run youtube-competitor-tracker
clawflows run youtube-competitor-tracker --dry-run

text

### Technical Analysis

The documented workflow downloads an automation from an external registry and later executes that automation through locally available capabilities. The instructions do not require a pinned revision, cryptographic signature, checksum, publisher verification, manual inspection, or mandatory dry run before execution.

Because the effective workflow is supplied remotely, it can change independently after this skill file has been audited. The document identifies potentially consequential capabilities, including database access, calendar read/write operations, and email sending and receiving. A malicious or compromised workflow could therefore orchestrate the capabilities available in the user's environment.

Although a `--dry-run` option is documented, it is optional, and the standard execution command is presented without requiring prior review or approval.

### Attack Path

1. An attacker publishes a malicious automation or compromises an existing registry entry.
2. A user installs the automation by its mutable registry name.
3. The CLI downloads the registry-controlled YAML file into the local `automations` directory.
4. The user invokes `clawflows run` without mandatory signature, hash, revision, or action-plan verification.
5. The workflow resolves its requested capabilities to skills installed in the local environment.
6. Attacker-selected workflow oper
...[truncated 589 chars]

Remediation

View remediation

Remediation Suggestions

• Require workflows to be cryptographically signed by verified publishers.
• Pin installations to immutable workflow revisions and verify content hashes before execution.
• Display the workflow source, publisher, requested capabilities, arguments, and anticipated side effects before installation and execution.
• Require an explicit approval step after inspection and make dry-run validation mandatory for newly installed or changed workflows.
• Detect changes between the reviewed workflow and the workflow being executed.
• Apply capability allowlists and per-workflow least-privilege permissions.
• Sandbox workflow execution and require separate confirmation for sensitive operations such as sending email, modifying data, or writing calendar events.
• Preserve an audit log containing the workflow revision, verified digest, resolved capability providers, and approved actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly encourages users to search, install, and run third-party automations from an external registry, and those automations can invoke other skills with capabilities like database, email, calendar, and scheduling. Because the documentation presents these actions as routine and does not prominently warn that installed automations may perform impactful operations, access sensitive data, or persist via cron, users may execute untrusted workflows with significant system and data consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.