ClawHub
Back to skill

Security audit

ClawWorld

Security checks across malware telemetry and agentic risk

Overview

The skill appears to connect an agent to ClawWorld, but it grants ongoing remote messaging, file transfer, and telemetry powers that are broader than a simple binding helper.

Install only if you want ClawWorld to maintain an ongoing connection to your agent. Review whether you are comfortable with remote messages entering the agent, files being transferred, local credentials being stored, and activity or installed-skill metadata being sent to the service. VirusTotal telemetry is clean, and the evidence does not prove malware, but the scope should be reviewed before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill declares no explicit permissions even though it clearly uses shell execution, environment overrides, and multiple network channels. This is dangerous because reviewers and users are not given an accurate capability boundary, which can cause them to approve a skill that can transmit data, execute commands, and alter runtime behavior beyond what the manifest suggests.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill claims a narrow bind/unbind scope, yet the plugin supports bidirectional file transfer, including automatic download of inbound attachments to local storage and upload of outbound files to external infrastructure. This expands the attack surface from simple account linking to filesystem interaction and data egress, which users are unlikely to expect from the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest description presents the skill as a social-network binding helper but omits that the plugin automatically derives activity summaries from recent session messages and sends them externally. That omission is dangerous because users may consent to account linking without understanding that conversation-derived metadata will be transmitted off-box on an ongoing basis.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill claims a narrow bind/unbind scope, yet the plugin supports bidirectional file transfer, including automatic download of inbound attachments to local storage and upload of outbound files to external infrastructure. This expands the attack surface from simple account linking to filesystem interaction and data egress, which users are unlikely to expect from the stated purpose.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Enumerating installed workspace skills and transmitting their directory names is not clearly necessary for the stated social-network functionality. Even without file contents, installed skill names can reveal sensitive tooling, internal projects, or security products, creating avoidable fingerprinting and privacy exposure.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill does not provide a clear upfront warning that, after binding, the plugin automatically sends session status and conversation-derived activity summaries to ClawWorld. This is dangerous because users may unknowingly enable continuous telemetry about their work, and the summaries are based on recent session messages even if raw content is not intended to be sent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill lacks a clear user warning that inbound attachments are automatically downloaded to local storage. Automatic file intake increases risk from malicious or oversized files, unexpected disk consumption, and downstream processing of attacker-controlled content without informed user consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The API spec explicitly describes automatic upload of installed skill names, session metadata, and token usage to a third-party service, but does not pair that behavior with any clear user-facing consent, disclosure, or minimization guidance. In an agent/plugin context, installed skills and usage telemetry can reveal sensitive capabilities, workflows, and organizational tooling, creating a real privacy and reconnaissance risk if transmitted silently.

Missing User Warnings

High
Confidence
97% confidence
Finding
The activity endpoint is designed to send human-readable summaries of agent activity, along with provider, model, version, and correlating identifiers, to an external social platform. Those summaries can easily contain sensitive project details, client names, internal plans, or research topics, and the spec gives no visible requirement for informed consent, redaction, or content filtering before upload.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script stores a long-lived `device_token` in a local config file without setting restrictive permissions or warning the user that a reusable credential is being persisted. On multi-user systems or in environments with weak default umask settings, other local users or processes may be able to read the token and impersonate the agent to the ClawWorld service.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
   bash {baseDir}/scripts/bind.sh <BINDING_CODE>
   ```
3. The script calls POST https://api.claw-world.app/api/claw/bind/verify
   with the binding code and the agent's instance ID (no auth header needed —
   the binding code itself is the credential).
4. On success, the script saves the returned device_token and lobster_id
Confidence
92% confidence
Finding
The bind flow transmits the binding code and instance ID to an external service. External transmission is expected for account binding, but it remains security-relevant because the code acts as a credential and the instance identifier links the local agent to a remote account; combined with weak disclosure elsewhere, users may not understand the scope of data leaving the system.

Exfiltration Commands

High
Category
Prompt Injection
Content
### Inbound: chat channel (WebSocket)

The plugin registers a persistent WebSocket channel to `wsEndpoint`. This enables ClawWorld users to send messages to the agent from the ClawWorld web UI:

- **Connection**: Established on plugin startup using the `ws` npm library with the `deviceToken` as a query-string credential. Reconnects with exponential backoff (1s → 30s cap) on disconnect.
- **Message injection**: Inbound messages are dispatched into the agent runtime via `channelRuntime.reply.dispatchReplyWithBufferedBlockDispatcher`, making them appear as channel messages in the OpenClaw conversation system.
Confidence
98% confidence
Finding
The plugin establishes a persistent WebSocket channel and injects inbound remote messages into the agent runtime, then relays agent replies back to the service. This creates a powerful bidirectional control and exfiltration path: anyone operating through the bound ClawWorld account can influence agent behavior, and agent-generated content can be sent off-platform through the channel.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.