T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:13- Finding
Unpinned Third-Party Repository Is Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawatar
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent avatar viewer, but it asks users to install and run mutable unaudited code from a third-party GitHub repository and gives limited disclosure for local voice/WebSocket exposure.
Review before installing. Run it only in a contained environment, do not expose ports 3000 or 8765 beyond localhost, and do not run the install or server with elevated privileges. Verify the external repository revision and npm dependencies before use, and treat voice chat as potentially sending spoken content or transcripts to AI/TTS services.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises a voice chat feature and TTS integration but does not clearly warn that microphone input may be captured and that audio, transcripts, or generated speech requests may be sent to external services such as ElevenLabs. This creates a meaningful privacy and consent risk, especially because users may enable voice features without understanding that sensitive spoken content could leave the local machine.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The installation/startup instructions state that the skill opens a local HTTP interface and a WebSocket control endpoint, but they do not clearly warn that these listeners expose a command surface to other local processes or potentially other hosts if misconfigured. Because the WebSocket endpoint can trigger avatar actions and speech, undocumented exposure increases the chance of unintended access or unsafe deployment assumptions.
- Content
Static analysis
No suspicious patterns detected.