Smartclaws Reader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:11 AM UTC
• Version: 1.0.1

Overview

The skill appears purpose-aligned for reading SmartClaws sensor data, but its install instructions ask users to run an unverified, mutable downloaded binary from a trusted executable path.

Review the install step carefully before using this skill. Prefer installing SmartClaws from a pinned release in a user-local path and verify checksums or signatures before running it, especially before placing it in /usr/local/bin. The runtime reading commands are otherwise scoped to SmartClaws channel or device data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:29

Finding

Unverified Mutable Binary Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–32
Vulnerability Type: Remote payload retrieval without version pinning or integrity verification
Risk Level: Medium

bash

PLATFORM="$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed 's/aarch64/arm64/')"
curl -fL -o /usr/local/bin/smartclaws \
  "https://github.com/skalenetwork/smartclaws/releases/latest/download/smartclaws-${PLATFORM}"
chmod +x /usr/local/bin/smartclaws

Technical Analysis

The installation instructions download a precompiled executable from a mutable releases/latest URL and mark it executable without verifying a cryptographic checksum, digital signature, or provenance attestation. Because latest can resolve to a different artifact after the skill has been reviewed, the code ultimately executed by users is not fixed by the audited project contents.

The URL points to the declared SmartClaws GitHub repository, and there is no evidence in the audited file that the current upstream artifact is malicious. Nevertheless, compromise of the upstream repository, its release workflow, a maintainer account, or the published release artifacts could cause these instructions to install attacker-controlled code.

Attack Path

1. An attacker compromises the upstream repository, release workflow, maintainer credentials, or release artifact publication process.
2. The attacker publishes or replaces the platform-specific binary referenced by the mutable latest release URL.
3. A user or agent follows the documented installation procedure.
4. curl writes the unverified payload to /usr/local/bin/smartclaws.
5. The payload is granted executable permissions.
6. The binary executes when subsequent documented commands such as smartclaws init, smartclaws wallet info, or smartclaws read are invoked.

Impact Assessment

A substituted binary could execute arbitrary code with the privileges of the user invoking it. This ...[truncated 554 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to a specific reviewed release version rather than using releases/latest.
2. Publish SHA-256 or stronger checksums through a separately protected release channel and verify the selected platform artifact before making it executable.
3. Prefer signed releases and validate the signature against a pinned, documented maintainer or project public key.
4. Use provenance attestations, such as Sigstore verification, to confirm that the binary was produced by the expected repository and build workflow.
5. Download to a temporary file, fail closed on any verification error, and move the file into the destination only after successful validation.
6. Avoid elevated installation where possible. Install into a user-controlled executable directory with restrictive permissions unless system-wide installation is explicitly required.
7. Document the expected version and digest so reviewers can confirm that the installed executable corresponds to the audited artifact.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The skill instructs downloading an executable from the internet and placing it in a trusted executable path, then marking it executable. Even though it uses GitHub releases over HTTPS, this is still a supply-chain risk because the binary is not pinned to a specific version or verified with a checksum/signature before execution.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

PLATFORM="$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed 's/aarch64/arm64/')" curl -fL -o /usr/local/bin/smartclaws
"https://github.com/skalenetwork/smartclaws/releases/latest/download/smartclaws-${PLATFORM}" chmod +x /usr/local/bin/smartclaws

text

If `/usr/local/bin` requires root, use `~/.local/bin/smartclaws` instead and ensure it's on PATH.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill for broad intents like "querying sensor readings" and "analyzing trends," which can overlap with many generic data-analysis requests. It does not provide negative examples or clear constraints that the request must specifically concern SmartClaws or SKALE on-chain IoT data, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.