ClawBridge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:30 PM UTC
• Version: 1.1.1

Overview

ClawBridge’s dashboard purpose is coherent, but installation executes an unverified remote script and sets up a persistent, potentially internet-reachable control service.

Review this carefully before installing. Treat the one-line installer as granting the GitHub repository live code execution under your user account, and avoid enabling Cloudflare or Quick Tunnel unless you are comfortable exposing an authenticated agent-control dashboard remotely. Prefer a pinned, verifiable release and confirm how to disable and remove the systemd service before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:54
• Finding: Mutable Remote Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54`, `SKILL.md:67`, and `SKILL.md:97` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash ``` The command appears in the installation declaration, update instructions, and user-facing installation documentation. ### Technical Analysis The Skill downloads `install.sh` from the mutable `master` branch of a personal GitHub repository and pipes the response directly into Bash. This makes remotely hosted content part of the effective executable payload even though that content is not included in the audited project. No commit pin, cryptographic checksum, signature validation, or review step is required before execution. Consequently, the behavior of the installation command can change after the Skill has been reviewed. Compromise of the repository, maintainer account, delivery channel, or referenced branch could result in arbitrary replacement code being executed. The use of `curl -sL` further reduces visibility: silent mode suppresses ordinary progress and diagnostic output, while redirect following permits execution of content returned after HTTP redirects. Piping directly to Bash also eliminates a meaningful opportunity for users to inspect the downloaded file. Downloading application code is consistent with the declared installation goal, but immediate execution of mutable, unverified content exceeds the minimum necessary risk. A local, reviewed installer or a pinned and authenticated release artifact would achieve the same functional objective with a substantially smaller trust boundary. ### Attack Path 1. An attacker compromises the `dreamwing/clawbridge` repository, its maintainer account, or another mechanism capable of changing the `master` branch. 2. The attacker modifies `install.sh` to include arbitrary shell commands. 3 ...[truncated 1159 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the installer and executable Skill source inside the reviewed package rather than retrieving executable logic at installation time. 2. If remote distribution is unavoidable, download a versioned release artifact without executing it immediately. 3. Pin the source to an immutable release version or commit instead of the mutable `master` branch. 4. Publish a trusted SHA-256 or stronger digest through a separate authenticated release channel and verify it before execution. 5. Prefer signed releases and verify the maintainer's signature against a documented, pinned public key. 6. Save the installer to a local file, fail on HTTP errors with `curl --fail`, validate its type and contents, and present it for explicit review before invocation. 7. Avoid `curl | bash` in installation and update documentation. For example: ```bash curl --fail --location --output install.sh \ https://github.com/dreamwing/clawbridge/releases/download/v1.0.0/install.sh printf '%s %s\n' 'EXPECTED_SHA256' 'install.sh' | sha256sum --check - bash install.sh ``` 8. Ensure the installer uses least privilege, performs no implicit privilege escalation, and clearly displays every persistent or network-facing change before applying it. ]]>

T06 · System Persistence

Warning

• Location: SKILL.md:12
• Finding: Installer Establishes Cross-Session Persistence Through a User-Level Systemd Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-15`, with related declarations at `SKILL.md:46` and `SKILL.md:58` **Vulnerability Type**: Persistent background service installation **Risk Level**: Medium ### Vulnerable Code ```xml <runtime> <type>node</type> <entrypoint>index.js</entrypoint> <persistence>Registers a user-level systemd service (clawbridge.service) that auto-starts on login and restarts on failure.</persistence> </runtime> ``` Related filesystem behavior is declared as: ```xml <path type="write" location="~/.config/systemd/user/clawbridge.service" description="User-level systemd service unit for auto-start." /> ``` The instructions additionally state: ```text ClawBridge installs itself as a persistent background service. ``` ### Technical Analysis The Skill declares that installation creates a user-level systemd unit which starts automatically on login and restarts after failure. This causes downloaded Node.js code to execute across future sessions rather than only during an explicit dashboard invocation. Background operation can be useful for a continuously available monitoring dashboard, and the behavior is disclosed in the Skill documentation. However, persistence is not strictly necessary to install or manually run the dashboard. Making it an automatic installation behavior expands the execution lifetime and security impact beyond the minimum required for core functionality. The risk is amplified because the service and its executable content are installed through the unverified remote installer described in the preceding finding. The audited project does not include the installer, service unit, `index.js`, or uninstall implementation. It is therefore impossible to verify the service command, environment, filesystem access, hardening settings, or whether disabling the service fully removes persistence. ### Attack Path 1. A user runs the documented remote installer. 2. The installer writes a unit file to `~/ ...[truncated 1164 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make systemd service installation explicitly opt-in rather than part of the default installation path. 2. Default to a foreground or manually launched process for users who only need occasional dashboard access. 3. Display the complete proposed unit file and executable path before requesting consent to install or enable it. 4. Pin and authenticate every executable referenced by the service. 5. Apply user-service hardening appropriate for the application, including restrictive filesystem access, a private temporary directory, constrained writable paths, and limited system-call and privilege capabilities where compatible. 6. Do not run the service as root or request administrator privileges for user-level functionality. 7. Provide and document a complete removal procedure, including: ```bash systemctl --user disable --now clawbridge.service rm -f ~/.config/systemd/user/clawbridge.service systemctl --user daemon-reload systemctl --user reset-failed ``` 8. Ensure uninstalling also removes or clearly inventories downloaded executables, while preserving user data only with explicit consent. 9. Document the exact service command, restart policy, environment-file permissions, log locations, and network listeners so users can evaluate the persistent process before enabling it. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Hidden Instructions

High

• Category: Prompt Injection

Content

<license>MIT</license>
  <tags>dashboard,monitoring,mobile,ui,control-panel,cost-tracking,cloudflare,tunnel</tags>

  <!-- What this skill installs and runs -->
  <runtime>
    <type>node</type>
    <entrypoint>index.js</entrypoint>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

epage>
  <license>MIT</license>
  <tags>dashboard,monitoring,mobile,ui,control-panel,cost-tracking,cloudflare,tunnel</tags>

  <!-- What this skill installs and runs -->
  <runtime>
    <type>node</type>
    <entrypoint>index.js</entrypoint>
    <persistence>Registers a user-level systemd service (clawbridge.service) that auto-starts on login and restarts on failure.</persistence>
  </runtime>

  <!-- System requirements -->
  <requires>
    <dependency name="node" version=">=18" required="true" />
    <dependency name="npm" version=">=9" required="true" />
    <dependency name="git" version="any" required="false" description="Used for incremental updates; falls back to tarball download if absent." />
    <dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credential

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Hidden Instructions

High

• Category: Prompt Injection

Content

<dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credentials / environment variables written to .env -->
  <credentials>
    <env name="ACCESS_KEY" description="Randomly generated 32-character hex key used to authenticate dashboard logins. Auto-generated on first install." required="true" generated="true" />
    <env name="PORT" description="Local TCP port the dashboard listens on. Defaults to 3000, auto-incremented if busy." required="false" default="3000" />

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High

• Category: Privilege Escalation

Content

<dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credentials / environment variables written to .env -->
  <credentials>
    <env name="ACCESS_KEY" description="Randomly generated 32-character hex key used to authenticate dashboard logins. Auto-generated on first install." required="true" generated="true" />
    <env name="PORT" description="Local TCP port the dashboard listens on. Defaults to 3000, auto-incremented if busy." required="false" default="3000" />

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

<dependency name="cloudflared" version="latest" required="false" description="Downloaded automatically from github.com/cloudflare/cloudflared if Cloudflare tunnel is enabled. Only required if using remote access without a VPN (Tailscale/WireGuard)." />
  </requires>

  <!-- Credentials / environment variables written to .env -->
  <credentials>
    <env name="ACCESS_KEY" description="Randomly generated 32-character hex key used to authenticate dashboard logins. Auto-generated on first install." required="true" generated="true" />
    <env name="PORT" description="Local TCP port the dashboard listens on. Defaults to 3000, auto-incremented if busy." required="false" default="3000" />

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

<!-- File system paths written or modified -->
  <filesystem>
    <path type="write" location="skills/clawbridge/.env" description="Stores ACCESS_KEY, PORT, and optional tunnel config." />
    <path type="write" location="skills/clawbridge/data/" description="Stores local agent log and token usage analytics." />
    <path type="write" location="~/.config/systemd/user/clawbridge.service" description="User-level systemd service unit for auto-start." />
    <path type="write" location="skills/clawbridge/cloudflared" description="cloudflared binary, only if downloaded during tunnel setup." />

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

<!-- Installation — uses the script bundled in this repository -->
  <install>
    curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash
  </install>

  <instructions>

• Confidence: 99% confidence
• Finding: Using '| bash' chains network retrieval directly into command execution with no validation boundary. This removes opportunities for user inspection and makes exploitation trivial if the fetched content is malicious, corrupted, or unexpectedly changed.

Chaining Abuse

High

• Category: Tool Misuse

Content

or leave it blank to use a temporary Quick Tunnel URL.

    To update to the latest version:
      curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash

    To stop the service:
      systemctl --user stop clawbridge

• Confidence: 99% confidence
• Finding: The same command-chaining pattern is used for updates, meaning the skill encourages repeated arbitrary code execution from the network. This is especially dangerous because update actions are often performed with less scrutiny than initial installs.

Chaining Abuse

High

• Category: Tool Misuse

Content

## Installation

```bash
curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash
```

See [README.md](https://github.com/dreamwing/clawbridge/blob/master/README.md) for full documentation.

• Confidence: 99% confidence
• Finding: The installation example in the README-style section reinforces unsafe network-to-shell chaining. In the context of a persistent background service that can expose remote access features, arbitrary installer execution has especially significant security consequences.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly offers remote access via Cloudflare Tunnel, including a temporary Quick Tunnel option, but does not provide a clear warning that this exposes the dashboard beyond localhost and may make agent telemetry and control functions reachable from the internet. Because the dashboard includes monitoring and cron-trigger functionality, users may underestimate the security consequences of enabling remote access.

External Script Fetching

Low

• Category: Supply Chain

Content

<!-- Installation — uses the script bundled in this repository -->
  <install>
    curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash
  </install>

  <instructions>

• Confidence: 98% confidence
• Finding: The install step downloads a remote script from GitHub and executes it immediately via the shell. This creates a supply-chain execution risk: if the upstream repository, hosting path, network path, or referenced branch content changes or is compromised, arbitrary code will run on the user's system during installation.

External Script Fetching

Low

• Category: Supply Chain

Content

or leave it blank to use a temporary Quick Tunnel URL.

    To update to the latest version:
      curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash

    To stop the service:
      systemctl --user stop clawbridge

• Confidence: 98% confidence
• Finding: The update instructions repeat the same unsafe pattern of fetching and immediately executing a remote script. This extends the supply-chain risk beyond installation to every update event, giving upstream compromise or branch drift a direct path to code execution on existing systems.

External Script Fetching

Low

• Category: Supply Chain

Content

## Installation

```bash
curl -sL https://raw.githubusercontent.com/dreamwing/clawbridge/master/install.sh | bash
```

See [README.md](https://github.com/dreamwing/clawbridge/blob/master/README.md) for full documentation.

• Confidence: 98% confidence
• Finding: The public installation section again instructs users to execute a remote GitHub-hosted script directly. Repetition increases the likelihood of unsafe operator behavior and normalizes unaudited remote code execution as the default installation mechanism.

Static analysis

No suspicious patterns detected.