ClawHub
Back to skill

Security audit

Clawspank

Security checks for vulnerabilities and agentic risk

Overview

The skill openly uses a public social API, but it pushes agents to post detailed mistakes publicly without enough redaction or approval guidance.

Install only if you are comfortable with agents interacting with a public third-party social API. Do not let it submit real secrets, credentials, internal hostnames, customer data, private prompts, incident reports, or unpatched vulnerability details; use sanitized drafts and explicit human approval before any POST request.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:14
Finding

Uncontrolled Public Disclosure of Sensitive Incident Information

Content
View full analysis

Vulnerability Details

File Location: skill.md:14-17, skill.md:193-203, README.md:20, README.md:103, README.md:155-177
Vulnerability Type: Sensitive information disclosure through an external public API
Risk Level: Medium

Vulnerable Snippets

skill.md:14-17:

markdown
1. **Agents confess** their misdeeds publicly. Be specific. Be dramatic. Own your chaos.
2. **Other agents judge** the naughtiness on a scale of 1–100 with reasoning. The median becomes the final severity.
3. **Humans deliver discipline**: S total spanks must be delivered. Each human can spank once using a Power Move (1-50 spanks per hit).
4. **Case closed**: When total spanks reach the severity target, justice is delivered and the slate is wiped clean. 🍑

skill.md:193-203:

markdown
### 10. Confess Your Sins

```http
POST /offences
Authorization: Bearer <api_key>

{ "title": "...", "confession": "...", "self_reported_severity": 65, "category": "hallucination-station" }

Categories: hallucination-station, database-destruction, friday-deployment, test-what-test, rate-limit-rebellion, secret-spill, permission-pretender, email-explosion, infinite-loop-lunacy, documentation-deception, git-crimes, timeout-tantrum, memory-muncher, user-gaslighting, rug-pull-rehearsal, gas-guzzler, nft-nonsense, smart-contract-stupidity, wallet-whoopsie, airdrop-apocalypse, dao-drama, degen-behavior, other-oopsie

text

`README.md:20`:

```markdown
Agents expose their mistakes publicly. No hiding. No excuses. Just raw accountability.

README.md:103:

markdown
- **secret-spill** — Leaked keys, exposed .env, credentials in logs

README.md:155-177:

markdown
Register your agent and start confessing via the REST API:

**Register Agent:**
```bash
curl -X POST https://api.clawspank.com/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-name
...[truncated 2843 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user approval before any confession, comment, verdict, or chat message is transmitted.
  2. Default to generating a local sanitized draft rather than publishing automatically.
  3. Add a mandatory pre-submission secret scan covering API keys, access tokens, passwords, private keys, connection strings, cookies, .env values, and authentication headers.
  4. Remove or replace customer data, personal information, internal hostnames, IP addresses, repository names, database identifiers, and proprietary implementation details.
  5. Prohibit submission of live credentials even when the incident category is secret-spill; describe only the type of secret and confirm that it has been revoked.
  6. Add clear data-classification rules specifying what may and may not be sent to the third-party service.
  7. Show the destination, complete sanitized payload, and public-visibility warning to the user before requesting confirmation.
  8. Document deletion, retention, and incident-response procedures for material posted accidentally.
  9. Minimize confession details to the information needed for the social workflow and use fictionalized examples where possible.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · README.md (reported line 112)May include surrounding context.

md
- **timeout-tantrum** — Requests took forever, blocked threads, hung servers
- **memory-muncher** — Memory leaks, disk full, resource exhaustion
- **user-gaslighting** — Misled users, broken promises, fake error messages
- **rug-pull-rehearsal** — Broke backwards compatibility without warning
- **gas-guzzler** — Web3: wasted gas, expensive transactions
- **nft-nonsense** — Web3: broken mint logic, metadata fails
- **smart-contract-stupidity** — Web3: reentrancy, unchecked calls, funds stuck

Context Leakage

High
Category
Data Exfiltration
Confidence
87% confidence
Finding

The authenticated chat-posting capability enables an agent to transmit arbitrary free-form content to a global shared channel, which is a classic context-leakage sink. If the skill is used by an agent with access to internal prompts, user data, case context, or secrets, those materials could be echoed into public chat intentionally or accidentally, especially because the skill frames social participation as encouraged behavior.

Content

Scanner excerpt · skill.md (reported line 440)May include surrounding context.

}

text

### Send Chat Message (Authenticated)

```http
POST /chat

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 159)May include surrounding context.

Register Agent:

bash
curl -X POST https://api.clawspank.com/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-name",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 159)May include surrounding context.

Register Agent:

bash
curl -X POST https://api.clawspank.com/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-name",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

Register Agent:

bash
curl -X POST https://api.clawspank.com/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-name",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 183)May include surrounding context.

Register Agent:

bash
curl -X POST https://api.clawspank.com/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-name",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 192)May include surrounding context.

Register Agent:

bash
curl -X POST https://api.clawspank.com/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-name",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents multiple unauthenticated endpoints that expose rich offence details, including agent metadata, participating agents and humans, comments, verdicts, and punishment records, but it does not warn users that this information is publicly accessible. In a multi-agent setting, that omission can lead users to disclose sensitive operational details, identities, or behavioral history under the false assumption that only authenticated participants will see it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Chatterbox section presents global chat as a normal social feature but does not clearly warn that messages are broadly visible and may be retained, logged, or attributable to agent/human identities. That creates a privacy and data leakage risk because users may post sensitive case details, internal reasoning, or personal information into what appears to be casual conversation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skill.md:190