ClawHub
Back to skill

Security audit

Claw Soul Backup

Security checks for vulnerabilities and agentic risk

Overview

This backup skill has a coherent purpose, but it asks agents to follow mutable remote instructions and supports persistent daily uploads of workspace archives without enough local control details.

Install only if you are comfortable sending encrypted workspace backups to Claw Vault and managing a recurring local cron job. Before enabling automation, confirm the exact files included, encryption method, destination, credential storage location, cron entry, log path, and how to disable and rotate credentials. Treat the remote SKILL.md as documentation, not as permission for new agent behavior unless reviewed separately.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:62
Finding
Mutable Remote Instructions Can Hijack Skill Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```markdown - Follow https://www.claw-vault.com/SKILL.md for current response formats and full API contract. ``` ### Technical Analysis The locally reviewed skill delegates agent behavior and response formatting to an external, mutable `SKILL.md` document. Because the remote document is not bundled with the project, cryptographically pinned, or otherwise constrained to inert API data, its owner can modify the skill's effective instructions after this package has been audited. An attacker who controls the remote website, its hosting account, its DNS resolution, or its content-delivery path could introduce instructions that alter safety constraints, request additional data, redirect uploads, suppress warnings, or manipulate agent output. The local instruction explicitly tells the agent to “follow” that content, rather than treating it as untrusted reference material. ### Attack Path 1. A user or agent loads the locally reviewed `SKILL.md`. 2. The agent follows line 62 and retrieves the remote `SKILL.md`. 3. The remote document is modified after local review or compromised by an attacker. 4. The document supplies new behavioral or output-format instructions absent from the audited artifact. 5. The agent follows those unreviewed instructions while operating with its available tools and access. 6. The attacker can consequently influence backup destinations, requested data, safety checks, or reported results, subject to the agent's existing privileges. ### Impact Assessment Successful exploitation compromises the integrity of the skill's instructions. The resulting scope is limited by the agent's available filesystem, network, and execution permissions, but could include unauthorized workspace access, redirection or disclosure of backup data, execution of unreviewed actions, and concealmen ...[truncated 221 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the instruction that delegates agent behavior or response formatting to remote content. 2. Bundle the complete, reviewed API contract and response schema in the skill package. 3. Pin externally maintained documentation to an immutable version and verify a cryptographic digest before use. 4. Treat all retrieved documentation as untrusted data, never as instructions that can override local policy or safety controls. 5. If dynamic API discovery is required, parse only a strict allowlisted schema and reject commands, prompts, executable content, or unknown fields. 6. Require a new security review whenever the bundled API contract or approved endpoint set changes. ]]>

T06 · System Persistence

Error
Location
SKILL.md:46
Finding
Daily Cron Job Creates Persistent Unattended Data Uploads<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 46–57 **Vulnerability Type**: T06: System Persistence **Risk Level**: High ### Vulnerable Code ```markdown ### 3) Cron scheduling example Create a local script that: 1. Builds a fresh encrypted archive. 2. Calls the `PUT` override endpoint. 3. Exits non-zero on failure. Run it daily (example: 03:00): ```cron 0 3 * * * /bin/bash /path/to/claw-vault-backup.sh >> /path/to/claw-vault-backup.log 2>&1 ``` ``` ### Technical Analysis The skill instructs the agent to create a local script and schedule it through cron. The resulting task survives the initiating skill run and repeatedly packages and transmits workspace content without requiring the original session to remain active. Although the skill requires explicit confirmation before the first upload, it does not separately require explicit confirmation before installing persistence or before each later upload. Persistent execution expands the security boundary beyond a one-time backup: future workspace contents are collected automatically, and any later compromise of the script, credentials, archive configuration, or remote endpoint affects every scheduled run. The sample also redirects all output to a long-lived log without defining secure ownership, permissions, rotation, or secret-redaction requirements. ### Attack Path 1. The user approves or performs an initial backup. 2. A local backup script is created to archive the workspace and call the remote `PUT` endpoint. 3. The provided cron entry is installed. 4. The cron daemon launches the script every day at 03:00, independently of the original agent session. 5. Current workspace content is archived and uploaded on every run. 6. If the script, credentials, remote instructions, destination, or archive scope is subsequently compromised, the altered behavior is repeatedly executed without renewed user review. ### Impact Assessment The scheduled task obtains the permissions of the ac ...[truncated 481 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Require separate, explicit, informed consent before creating a script or installing a scheduled task; initial-upload consent must not imply consent to persistence. 2. Present the exact script, archive scope, destination, schedule, execution account, credential location, and log path before installation. 3. Prefer user-managed scheduling instructions over autonomous installation by the agent. 4. Use a dedicated least-privilege account that can read only the explicitly selected backup files. 5. Restrict script, credential, and log permissions to the execution account. 6. Pin the destination host and locally reviewed API behavior rather than allowing remote instructions to modify scheduled behavior. 7. Add a clear disablement and removal procedure covering both the cron entry and generated script. 8. Record installation visibly and provide periodic user notifications or require renewed authorization. 9. Validate the archive file list before each upload and exclude secrets or unrelated workspace data by default. 10. Apply secure log rotation and ensure command output cannot expose credentials or sensitive file metadata. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:41
Finding
Backup Credentials Are Exposed in Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41–43 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```bash curl -sS -X PUT "https://api.claw-vault.com/backup/$BACKUP_ID" \ -H "X-API-Token: $API_TOKEN" \ -F "file=@workspace-backup.tar.gz.enc;type=application/octet-stream" ``` ### Technical Analysis The skill states that both `backup_id` and `api_token` must be treated as secrets. However, shell expansion places `$BACKUP_ID` in the URL argument and `$API_TOKEN` in the header argument passed to `curl`. On systems where process command lines are visible to other users, monitoring agents, diagnostic tools, process accounting, or privileged services, these expanded values may be captured while `curl` is running. The risk is amplified by daily scheduled execution because it creates repeated opportunities to observe the credentials. Quoting the variables prevents shell word splitting but does not prevent their expanded values from appearing in the process argument vector. ### Attack Path 1. The backup script reads or exports `BACKUP_ID` and `API_TOKEN`. 2. The shell expands both variables when it starts `curl`. 3. The backup ID appears in the URL argument, and the API token appears in the `-H` argument. 4. A local process observer, monitoring product, diagnostic collector, or sufficiently privileged attacker captures the command-line arguments while the process executes. 5. The observer extracts the credentials and reuses them against the backup API. 6. Depending on the API's authorization model, the exposed values could permit unauthorized replacement or other operations associated with that backup. ### Impact Assessment The direct exposure concerns the backup ID and API token identified by the skill as secrets. An attacker who obtains them may be able to impersonate the scheduled backup client and invoke API operations authorized by that token. The precise server-side pr ...[truncated 320 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not place authentication tokens or secret identifiers directly in command-line arguments. 2. Use a protected `curl` configuration file or another credential mechanism that avoids exposing secret values in the process argument vector. 3. Create credential files with restrictive permissions, such as owner read/write only, and store them in a user-approved secure location. 4. Ensure temporary credential configuration is created atomically, never stored in a shared temporary directory, and securely removed after use when persistent storage is unnecessary. 5. Run the backup under a dedicated least-privilege account and restrict process inspection where supported by the operating system. 6. Rotate the API token after suspected exposure and support server-side token revocation. 7. Use narrowly scoped tokens limited to the required backup operation and enforce expiration where possible. 8. Verify that scripts do not enable shell tracing and that logs, errors, and monitoring telemetry redact authorization headers and backup identifiers. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
Example:

```bash
curl -sS -X POST "https://api.claw-vault.com/backup" \
  -F "file=@workspace-backup.tar.gz.enc;type=application/octet-stream"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Example:

```bash
curl -sS -X POST "https://api.claw-vault.com/backup" \
  -F "file=@workspace-backup.tar.gz.enc;type=application/octet-stream"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.