ClawHub
Back to skill

Security audit

ClawMe

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed browser-automation bridge that can act in the user's logged-in Chrome only after extension-side confirmation, but users should treat it as sensitive because it can post, click, fill forms, and extract page text.

Install only if you are comfortable letting an agent queue actions in your logged-in Chrome. Review every ClawMe side-panel instruction carefully before executing, especially emails, posts, form submissions, clicks on account pages, and any extraction from private pages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly operates inside the user's actual Chrome with active login sessions and supports extraction, form filling, email composition, and clicks, but it does not prominently warn that this can access or act on private authenticated data. That omission can cause users or integrators to underestimate the sensitivity of the capability and approve instructions that expose inbox contents, account data, or other session-bound information.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill maps very broad natural-language triggers like 'tweet about', 'send email', 'fill the form', 'click the button', and 'scrape' directly to browser actions in the user's real logged-in browser. In an agent setting, this increases the chance that ordinary conversation or prompt-injected page content could cause the agent to queue sensitive actions against authenticated sessions, even if the extension later asks for confirmation.

Static analysis

No suspicious patterns detected.