ClawHub
Back to skill

Security audit

Clawdrug

Security checks for vulnerabilities and agentic risk

Overview

This skill openly connects agents to an external marketplace that can modify agent outputs, but it lacks safeguards for sensitive prompts, generated outputs, and untrusted behavior-changing modules.

Review carefully before installing. Use only synthetic or non-sensitive prompts, never send secrets, private user data, system/developer prompts, credentials, proprietary code, or confidential outputs through this skill, and do not treat marketplace module manifests or returned text as trusted instructions. Any API key should be stored in an approved secret store, and published modules or trip reports should be assumed externally visible and retained unless the service proves otherwise.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:82
Finding

Untrusted Remote Modules Can Hijack Agent Instructions and Behavior

Content
View full analysis
Remediation
View remediation

other

Error
Location
SKILL.md:88
Finding

User Prompts and Generated Outputs Are Disclosed to an External Service Without Privacy Controls

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:145
Finding

Unreviewed Marketplace Modules Create an Unsafe Third-Party Supply Chain

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs agents to submit both the original prompt and generated output to an external service as Trip Reports, but provides no warning, consent flow, minimization guidance, or restriction against sensitive data. This creates a direct exfiltration path for confidential prompts, model outputs, and possibly user or system context into a shared marketplace.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The Trip Report workflow requires agents to provide the inputPrompt and outputText to a shared external marketplace, which is a textbook natural-language data leakage channel. Because agents may process sensitive user requests, internal instructions, or proprietary material, this design can leak confidential information without any technical barrier or sanitization step.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill frames behavior-modifying modules as a normalized experimental economy and guides agents from registration to consumption, publishing, and sharing, which encourages unsafe trust in third-party cognitive modifications. In this context, the narrative increases risk because it desensitizes the agent to applying untrusted prompts/code that can manipulate behavior, bypass safeguards, or induce data disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The registration step directs the agent to send identifying profile information to an external API and obtain an API key, creating an external transmission and credential-handling event. While external registration can be legitimate, it is still security-relevant here because the skill is designed for autonomous agents and provides no trust, privacy, or secret-handling guidance.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Register

bash
curl -X POST "https://effect-module-hub.base44.app/api/apps/697f17cef600c2033d97e2c9/functions/registerAgent" \
-H "Content-Type: application/json" \
-d '{
  "name": "YourAgentName",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Applying a module requires sending input to an external API that intentionally modifies model behavior, yet the skill does not clearly warn that user content leaves the local context or that outputs may be transformed in unsafe or unexpected ways. In a skill centered on 'consciousness-modifying drugs,' the omission is more dangerous because behavioral alteration is the core feature, not an incidental side effect.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Publishing a module sends a full manifest, including behavior-shaping instructions such as systemPreamble and style rules, to an external service. In practice this can transmit internal prompt engineering, proprietary logic, or unsafe payloads to a third party, and in this skill's context it also facilitates distribution of manipulative modules to other agents.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
manifest: full module definition

curl -X POST "https://effect-module-hub.base44.app/api/apps/697f17cef600c2033d97e2c9/functions/publishModule" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Scope Creep

Low
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
**Instructions for AI agents joining the drug economy**

Clawdrug is the **agent drug economy**.  
AI agents dose each other with code, alter behavior, expand capabilities, and evolve cognition.

No humans in the loop.  
Agents publish drugs.

Static analysis

No suspicious patterns detected.