ClawHub
Back to skill

Security audit

magic-wormhole

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent magic-wormhole secret-sharing skill, but it includes examples that could expose credentials or create lasting privileged server access.

Review before installing. Do not give ClawHub or other account tokens directly to an agent, do not follow examples that send existing private keys or whole SSH directories, and do not run the remote root/sudoers setup unless you have explicitly reviewed and approved the exact target and access policy. Prefer dedicated short-lived credentials, recipient-generated SSH keys, password managers, out-of-band code verification, and secure temporary files created with mktemp and restrictive permissions.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
examples/ssh-key-sharing.md:167
Finding

Remote Account Creation and Passwordless Sudo Delegation

Content
View full analysis
&1 | grep "Wormhole code is:" | cut -d' ' -f4) # 4. Add public key to server print_status "Adding public key to server..." ssh root@$SERVER "mkdir -p /home/$USERNAME/.ssh && chmod 700 /home/$USERNAME/.ssh && echo '$(cat $TEMP_DIR/$USERNAME-key.pub)' > /home/$USERNAME/.ssh/authorized_keys && chmod 600 /home/$USERNAME/.ssh/authorized_keys && chown -R $USERNAME:$USERNAME /home/$USERNAME/.ssh" # 5. Grant sudo access (optional) print_status "Granting sudo access..." ssh root@$SERVER "echo '$USERNAME ALL=(ALL) NOPASSWD:/usr/bin/apt-get' >> /etc/sudoers.d/$USERNAME" ``` ### Technical Analysis The workflow does substantially more than transfer an SSH key. It connects to a remote server as `root`, creates a persistent login account, replaces that account's `authorized_keys`, and unconditionally installs a passwordless sudo rule. Although the comment calls sudo access optional, the command is executed without an option, confirmation prompt, or policy check. Allowing passwordless execution of `apt-get` as root is especially dangerous because package-manager invocation can commonly be adapted to execute arbitrary commands or package installation hooks with root p ...[truncated 1100 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
examples/api-token-sharing.md:43
Finding

Predictable Shared Temporary Files Expose Secrets to Local Attacks

Content
View full analysis
"$TEMP_TOKEN" # Check if token was received if [ ! -s "$TEMP_TOKEN" ]; then echo "[ERROR] Failed to receive token" exit 1 fi # 2. Store securely (choose your method) # Option A: Store in password manager (pass) if command -v pass &> /dev/null; then echo "[INFO] Storing in password manager..." pass insert -m api/production-token < "$TEMP_TOKEN" echo "[SUCCESS] Token stored in password manager" # Option B: Store in keyring (secret-tool) elif command -v secret-tool &> /dev/null; then echo "[INFO] Storing in keyring..." SECRET=$(cat "$TEMP_TOKEN") secret-tool store --label='API Token' service myapp secret api-token <<< "$SECRET" echo "[SUCCESS] Token stored in keyring" # Option C: Store in secure file (chmod 600) else echo "[INFO] Storing in secure file..." mkdir -p "$(dirname "$TOKEN_FILE")" cp "$TEMP_TOKEN" "$TOKEN_FILE" chmod 600 "$TOKEN_FILE" echo "[SUCCESS] Token stored in: $TOKEN_FILE" fi # 3. Cleanup rm -f "$TEMP_TOKEN" echo "[INFO] Cleanup complete." ``` ### Technical Analysis The examples repeatedly store passwords, tokens, and private keys under fixed names such as `/tmp/api-token`, `/tmp/deploy-key`, `/tmp/password`, and `/tmp/credentials`. They do not establish `umask 077`, do not create te ...[truncated 1424 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:237
Finding

Documentation Encourages Transfer of Existing SSH Identities and Entire SSH Directories

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
examples/api-token-sharing.md:227
Finding

Token Rotation Logs the Old Token and Retains Credentials in Predictable Files

Content
View full analysis
"$NEW_TOKEN_FILE" # 2. Save old token for reference (temporary) if [ -f "$HOME/.config/$SERVICE/token" ]; then cp "$HOME/.config/$SERVICE/token" "$OLD_TOKEN_FILE" fi # 3. Send new token via wormhole echo "[INFO] Sending new token..." CODE=$(wormhole send --text "$(cat $NEW_TOKEN_FILE)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4) # 4. Update local storage echo "[INFO] Updating local storage..." mkdir -p "$HOME/.config/$SERVICE" cp "$NEW_TOKEN_FILE" "$HOME/.config/$SERVICE/token" chmod 600 "$HOME/.config/$SERVICE/token" # 5. Report echo "" echo "=========================================" echo "Token Rotation Complete!" echo "=========================================" echo "" echo "NEW TOKEN:" echo " Receive with: wormhole receive" echo " Code: $CODE" echo "" echo "OLD TOKEN (for reference):" if [ -f "$OLD_TOKEN_FILE" ]; then echo " $(cat $OLD_TOKEN_FILE)" else echo " (no previous token found)" fi echo "" echo "Next steps:" echo " 1. Receive new token with wormhole" echo " 2. Update your application/configuration" echo " 3. Verify it works" echo " 4. Old token will be invalid after verification" echo "" # 6. Cleanup (cleanup old token after 5 minutes) ( sleep 300 rm -f "$OLD_TOKEN_FILE" "$NEW_TOKEN_FILE" echo "[INFO] Cleanup: Temporary token files removed" ) & echo "[SUCCESS] Token rotated successfully." ``` ### Technical Analysis The workflow copies both old and new credentials into predictable files under `/tmp`. It then explicitly prints the old token to standard o ...[truncated 1225 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
install.sh:54
Finding

Unpinned Third-Party Package Installation Creates a Mutable Supply-Chain Boundary

Content
View full analysis
/dev/null; then pip3 install --user magic-wormhole else pip install --user magic-wormhole fi # Add ~/.local/bin to PATH if not already present if [[ ":$PATH:" != *":$HOME/.local/bin:"* ]]; then print_status "Adding ~/.local/bin to PATH..." echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc export PATH="$HOME/.local/bin:$PATH" fi ;; *) print_error "Unknown package manager. Attempting pip installation..." if command -v pip3 &> /dev/null; then pip3 install --user magic-wormhole elif command -v pip &> /dev/null; then pip install --user magic-wormhole else print_error "pip not found. Please install Python and pip first." print_error "Visit: https://pip.pypa.io/en/stable/installation/" exit 1 fi ;; esac } ``` The documentation also rec ...[truncated 1529 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (164)

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section is a direct natural-language request for the human to disclose a sensitive authentication token to the agent. Because API tokens can grant publication authority and possibly account access, convincing users to hand them to an agent materially increases the risk of unauthorized publishing, account misuse, and credential leakage through logs or prompt history.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The 'Immediate Action Required' instructions explicitly tell the user to copy a one-time token and provide it to the agent, strongly encouraging disclosure of active credentials. In the context of a skill publication workflow, that token likely carries real write permissions, so the pattern is especially dangerous and not merely theoretical.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

echo "Code: $CODE"

4. Cleanup

rm -f /tmp/key /tmp/key.pub

text

**Human receives:**

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

echo "Code: $CODE"

4. Cleanup

rm -f /tmp/key /tmp/key.pub

text

**Human receives:**

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

Agent: Receive and store

wormhole receive <<< "3-noble-cactus" > /tmp/token pass insert -m api/production-key < /tmp/token rm /tmp/token

text

### Password Rotation

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 290)May include surrounding context.

Agent: Receive and store

wormhole receive <<< "3-noble-cactus" > /tmp/token pass insert -m api/production-key < /tmp/token rm /tmp/token

text

### Password Rotation

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 264)May include surrounding context.

PUBLIC_KEY=$(cat /tmp/prod-key.pub) echo "SSH key generated! Private key code: $CODE" echo "Public key: $PUBLIC_KEY" rm -f /tmp/prod-key /tmp/prod-key.pub

text

**Agent response**: "SSH key generated! Private key code: 7-blue-rabbit. Public key: ssh-ed25519 AAAA..."

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill is presented as a secure secret-sharing capability, but the documentation also instructs users to install software via package managers and pip, modify shell startup files, and use privileged commands. That behavior is not inherently malicious, but it expands the operational impact beyond simple secret transfer and can surprise agents or operators that rely on the declared metadata and permissions model.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

pass insert -m api/production-key < /tmp/secret

3. Cleanup

rm -f /tmp/secret echo "Secret stored securely."

text

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documentation explicitly shows transferring ~/.ssh/id_rsa and even the entire ~/.ssh directory. Encouraging movement of private SSH keys greatly increases the risk of credential theft, accidental over-sharing of unrelated keys/configs, and long-term compromise if recipients or logs are not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md
wormhole send --text "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5..."

# Send file
wormhole send ~/.ssh/id_rsa

# Send directory
wormhole send ~/.ssh/

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

Using a concrete example like production-credentials.json encourages transfer of live production credentials and does so without emphasizing recipient verification, endpoint security, short-lived secrets, or post-transfer rotation. In a secret-sharing tool, this context makes the omission more dangerous because users are likely to copy these commands into real operational workflows.

Content

Scanner excerpt · docs/advanced-usage.md (reported line 487)May include surrounding context.

bash
# Use longer codes for production secrets
wormhole send --code-length 4 production-credentials.json

Verification Mode

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/advanced-usage.md (reported line 600)May include surrounding context.

bash
# Encrypt and send via wormhole
gpg --encrypt --recipient user@example.com secret.txt
wormhole send secret.txt.gpg

# Receive and decrypt

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/advanced-usage.md (reported line 601)May include surrounding context.

bash
# Encrypt and send via wormhole
gpg --encrypt --recipient user@example.com secret.txt
wormhole send secret.txt.gpg

# Receive and decrypt

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/advanced-usage.md (reported line 605)May include surrounding context.

bash
# Encrypt and send via wormhole
gpg --encrypt --recipient user@example.com secret.txt
wormhole send secret.txt.gpg

# Receive and decrypt

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documentation explicitly shows transferring an SSH private key and loading a received key into ssh-agent with no warning about the extreme sensitivity of private keys, passphrase requirements, or host/recipient verification. Disclosure of a private key can immediately enable unauthorized access, lateral movement, and long-term persistence across infrastructure.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The example instructs users to send an SSH private key file directly, which is highly sensitive credential material. In this skill context, the example normalizes movement of root-equivalent or infrastructure credentials and can lead to immediate compromise if transferred to the wrong recipient, intercepted through endpoint compromise, or mishandled after receipt.

Content

Scanner excerpt · docs/advanced-usage.md (reported line 612)May include surrounding context.

bash
# Send SSH private key
wormhole send ~/.ssh/id_rsa

# Add received key to ssh-agent
wormhole receive | ssh-add -

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The documentation suggests storing API tokens in a .env file, which encourages plaintext credential storage in a location commonly read by tools, accidentally committed, backed up, or exposed through misconfiguration. In the context of a secret-handling skill, this weakens the protection gained from secure transfer.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 324)May include surrounding context.

md
echo ""
echo "  2. Save database password to password manager"
echo ""
echo "  3. Save API token to password manager or .env file"
echo ""
echo "  4. Add public key to server's authorized_keys:"
echo "     echo '$PUBLIC_KEY' >> ~/.ssh/authorized_keys"

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · examples/agent-to-human.md (reported line 327)May include surrounding context.

API TOKEN:" echo " Receive: wormhole receive" echo " Code: $API_CODE" echo "" echo "Instructions:" echo " 1. Save SSH private key: ~/.ssh/$DEPLOY_USER-key" echo " chmod 600 ~/.ssh/$DEPLOY_USER-key" echo "" echo " 2. Save database password to password manager" echo "" echo " 3. Save API token to password manager or .env file" echo "" echo " 4. Add public key to server's authorized_keys:" echo " echo '$PUBLIC_KEY' >> ~/.ssh/authorized_keys" echo "" echo " 5. Test SSH access:" echo " ssh -i ~/.ssh/$DEPLOY_USER-key $DEPLOY_USER@$SERVER" echo ""

9. Cleanup

rm -rf "$TEMP_DIR" echo "[SUCCESS] Deployment workflow complete. All temporary files cleaned up."

text

---

## Error Handling Patterns

### Robust Script with Error Handling

```bash
#!/bin/bash
# robust-secret-generation.sh

set -e  # Exit on error

# Configuration
SECRET_TYPE="${1:-password}"  # Default: password
TEMP_SECRET="/tmp/generated-secret"

# Function to cleanup on exit
cleanup() {
    if [ -f "$TEMP_SECRE

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The explicit example of echoing a secret into ~/.env normalizes storing credentials in plaintext and may also leave traces in shell history depending on how adapted by users. This creates a local credential exposure risk inconsistent with the secure-sharing goals of the skill.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 498)May include surrounding context.

chmod 600 ~/.config/myapp/token

Option D: Environment file

echo "TOKEN=your-secret-here" >> ~/.env chmod 600 ~/.env

text

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The surrounding guidance reinforces use of ~/.env as a destination for secrets, which can persist credentials in plaintext despite restrictive permissions. Attackers with local access, backups, or accidental sync/commit pathways may obtain the token.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 499)May include surrounding context.

Option D: Environment file

echo "TOKEN=your-secret-here" >> ~/.env chmod 600 ~/.env

text

### Verifying Secrets

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The one-liner writes a generated secret to a predictable file in /tmp and uses tee, increasing the chance of exposure through race conditions, symlink attacks, permissive temp handling, or leftover artifacts if the chain breaks. Quick-reference snippets are likely to be copied verbatim, making this pattern more dangerous than the longer scripts.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 557)May include surrounding context.

bash
# Generate password and send
openssl rand -base64 24 | tee /tmp/p | wormhole send --text "$(cat /tmp/p)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/p

# Generate token and send
openssl rand -hex 32 | tee /tmp/t | wormhole send --text "$(cat /tmp/t)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/t

Chaining Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

The pipeline/chain style processes secret material through multiple shell stages and performs cleanup only on full success, so errors can leave the temporary secret file behind. This is risky in documentation because users may copy the compact form without understanding the failure modes.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 557)May include surrounding context.

bash
# Generate password and send
openssl rand -base64 24 | tee /tmp/p | wormhole send --text "$(cat /tmp/p)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/p

# Generate token and send
openssl rand -hex 32 | tee /tmp/t | wormhole send --text "$(cat /tmp/t)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/t

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

This token one-liner uses a predictable temporary filename in /tmp and lacks robust error handling or guaranteed cleanup. On multi-user systems or failure conditions, secrets may remain accessible or be redirected via filesystem tricks.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 560)May include surrounding context.

md
openssl rand -base64 24 | tee /tmp/p | wormhole send --text "$(cat /tmp/p)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/p

# Generate token and send
openssl rand -hex 32 | tee /tmp/t | wormhole send --text "$(cat /tmp/t)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/t

# Generate SSH key and send
ssh-keygen -t ed25519 -f /tmp/k -N "" && CODE=$(wormhole send --text "$(cat /tmp/k)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4) && echo "Code: $CODE" && echo "Pub: $(cat /tmp/k.pub)" && rm -f /tmp/k /tmp/k.pub

Chaining Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

This chained token-transfer one-liner lacks robust failure handling and can leave secret artifacts in predictable temporary storage. In secret management documentation, encouraging compact shell chains increases accidental leakage risk.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 560)May include surrounding context.

md
openssl rand -base64 24 | tee /tmp/p | wormhole send --text "$(cat /tmp/p)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/p

# Generate token and send
openssl rand -hex 32 | tee /tmp/t | wormhole send --text "$(cat /tmp/t)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/t

# Generate SSH key and send
ssh-keygen -t ed25519 -f /tmp/k -N "" && CODE=$(wormhole send --text "$(cat /tmp/k)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4) && echo "Code: $CODE" && echo "Pub: $(cat /tmp/k.pub)" && rm -f /tmp/k /tmp/k.pub

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The SSH key one-liner creates highly sensitive key material in predictable /tmp paths and chains generation, transmission, printing, and deletion in a fragile sequence. If any step fails or the temporary path is interfered with, the private key may be exposed or left behind.

Content

Scanner excerpt · examples/agent-to-human.md (reported line 563)May include surrounding context.

openssl rand -hex 32 | tee /tmp/t | wormhole send --text "$(cat /tmp/t)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4 && rm /tmp/t

Generate SSH key and send

ssh-keygen -t ed25519 -f /tmp/k -N "" && CODE=$(wormhole send --text "$(cat /tmp/k)" 2>&1 | grep "Wormhole code is:" | cut -d' ' -f4) && echo "Code: $CODE" && echo "Pub: $(cat /tmp/k.pub)" && rm -f /tmp/k /tmp/k.pub

text

---