ClawHub
Back to skill

Security audit

ClawBridge

Security checks for vulnerabilities and agentic risk

Overview

ClawBridge’s dashboard purpose is coherent, but installation executes an unverified remote script and sets up a persistent, potentially internet-reachable control service.

Review this carefully before installing. Treat the one-line installer as granting the GitHub repository live code execution under your user account, and avoid enabling Cloudflare or Quick Tunnel unless you are comfortable exposing an authenticated agent-control dashboard remotely. Prefer a pinned, verifiable release and confirm how to disable and remove the systemd service before use.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:54
Finding

Mutable Remote Installer Is Downloaded and Executed Without Verification

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
SKILL.md:12
Finding

Installer Establishes Cross-Session Persistence Through a User-Level Systemd Service

Content
View full analysis
node index.js Registers a user-level systemd service (clawbridge.service) that auto-starts on login and restarts on failure. ``` Related filesystem behavior is declared as: ```xml ``` The instructions additionally state: ```text ClawBridge installs itself as a persistent background service. ``` ### Technical Analysis The Skill declares that installation creates a user-level systemd unit which starts automatically on login and restarts after failure. This causes downloaded Node.js code to execute across future sessions rather than only during an explicit dashboard invocation. Background operation can be useful for a continuously available monitoring dashboard, and the behavior is disclosed in the Skill documentation. However, persistence is not strictly necessary to install or manually run the dashboard. Making it an automatic installation behavior expands the execution lifetime and security impact beyond the minimum required for core functionality. The risk is amplified because the service and its executable content are installed through the unverified remote installer described in the preceding finding. The audited project does not include the installer, service unit, `index.js`, or uninstall implementation. It is therefore impossible to verify the service command, environment, filesystem access, hardening settings, or whether disabling the service fully removes persistence. ### Attack Path 1. A user runs the documented remote installer. 2. The installer writes a unit file to `~/ ...[truncated 1164 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
<license>MIT</license>
  <tags>dashboard,monitoring,mobile,ui,control-panel,cost-tracking,cloudflare,tunnel</tags>

  <!-- What this skill installs and runs -->
  <runtime>
    <type>node</type>
    <entrypoint>index.js</entrypoint>

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
epage>
  <license>MIT</license>
  <tags>dashboard,monitoring,mobile,ui,control-panel,cost-tracking,cloudflare,tunnel</tags>

  <!-- What this skill installs and runs -->
  <runtime>
    <type>node</type>
    <entrypoint>index.js</entrypoint>
    <persistence>Registers a user-level systemd service (clawbridge.service) that auto-starts on login and restarts on failure.</persistence>
  </runtime>

  <!-- System requirements -->
  <requires>
    <dependency name="node" version=">=18" required="true" />
    <dependency name="npm" version=">=9" required="true" />
    <dependency name="git" version="any" required="false" description="Used for incremental updates; falls back to tarball download if absent." />
    <dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credential

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
<dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credentials / environment variables written to .env -->
  <credentials>
    <env name="ACCESS_KEY" description="Randomly generated 32-character hex key used to authenticate dashboard logins. Auto-generated on first install." required="true" generated="true" />
    <env name="PORT" description="Local TCP port the dashboard listens on. Defaults to 3000, auto-incremented if busy." required="false" default="3000" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
<dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credentials / environment variables written to .env -->
  <credentials>
    <env name="ACCESS_KEY" description="Randomly generated 32-character hex key used to authenticate dashboard logins. Auto-generated on first install." required="true" generated="true" />
    <env name="PORT" description="Local TCP port the dashboard listens on. Defaults to 3000, auto-incremented if busy." required="false" default="3000" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
<dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credentials / environment variables written to .env -->
  <credentials>
    <env name="ACCESS_KEY" description="Randomly generated 32-character hex key used to authenticate dashboard logins. Auto-generated on first install." required="true" generated="true" />
    <env name="PORT" description="Local TCP port the dashboard listens on. Defaults to 3000, auto-incremented if busy." required="false" default="3000" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
<!-- File system paths written or modified -->
  <filesystem>
    <path type="write" location="skills/clawbridge/.env" description="Stores ACCESS_KEY, PORT, and optional tunnel config." />
    <path type="write" location="skills/clawbridge/data/" description="Stores local agent log and token usage analytics." />
    <path type="write" location="~/.config/systemd/user/clawbridge.service" description="User-level systemd service unit for auto-start." />
    <path type="write" location="skills/clawbridge/cloudflared" description="cloudflared binary, only if downloaded during tunnel setup." />

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Using '| bash' chains network retrieval directly into command execution with no validation boundary. This removes opportunities for user inspection and makes exploitation trivial if the fetched content is malicious, corrupted, or unexpectedly changed.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
<!-- Installation — uses the script bundled in this repository -->
  <install>
    curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash
  </install>

  <instructions>

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The same command-chaining pattern is used for updates, meaning the skill encourages repeated arbitrary code execution from the network. This is especially dangerous because update actions are often performed with less scrutiny than initial installs.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
or leave it blank to use a temporary Quick Tunnel URL.

    To update to the latest version:
      curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash

    To stop the service:
      systemctl --user stop clawbridge

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The installation example in the README-style section reinforces unsafe network-to-shell chaining. In the context of a persistent background service that can expose remote access features, arbitrary installer execution has especially significant security consequences.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

Installation

bash
curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash

See README.md for full documentation.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly offers remote access via Cloudflare Tunnel, including a temporary Quick Tunnel option, but does not provide a clear warning that this exposes the dashboard beyond localhost and may make agent telemetry and control functions reachable from the internet. Because the dashboard includes monitoring and cron-trigger functionality, users may underestimate the security consequences of enabling remote access.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The install step downloads a remote script from GitHub and executes it immediately via the shell. This creates a supply-chain execution risk: if the upstream repository, hosting path, network path, or referenced branch content changes or is compromised, arbitrary code will run on the user's system during installation.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
<!-- Installation — uses the script bundled in this repository -->
  <install>
    curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash
  </install>

  <instructions>

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The update instructions repeat the same unsafe pattern of fetching and immediately executing a remote script. This extends the supply-chain risk beyond installation to every update event, giving upstream compromise or branch drift a direct path to code execution on existing systems.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
or leave it blank to use a temporary Quick Tunnel URL.

    To update to the latest version:
      curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash

    To stop the service:
      systemctl --user stop clawbridge

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The public installation section again instructs users to execute a remote GitHub-hosted script directly. Repetition increases the likelihood of unsafe operator behavior and normalizes unaudited remote code execution as the default installation mechanism.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

Installation

bash
curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash

See README.md for full documentation.

Static analysis

No suspicious patterns detected.