Clawdbot Knowledge

• Outcome: Review
• Latest audit: May 28, 2026 · 7:03 AM UTC
• Version: 1.0.0

Overview

This skill needs Review because it bundles a broad autonomous agent system with file, command, database, and deployment authority that is not clearly bounded by its MCP-orchestration description.

Install only in a disposable sandbox after reviewing the included scripts and guides. Do not enable autonomous mode, bridge command execution, background services, broad file indexing, or database credential setup unless you have narrowed paths, secrets, and permissions to a test environment and are prepared to review every state-changing action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (404)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and documents capabilities consistent with environment access, filesystem read/write, and network/database interaction, but it declares no permissions. That creates a transparency and consent failure: users and hosting systems cannot accurately assess the operational reach of the skill before use, increasing the chance of unexpected file modification, secret access, or outbound connections.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow orchestration, but the detected behavior extends into writing application code into external directories, hosting dashboards, shell-script service control, CSV analytics, documentation generation, and broad local/network access. This mismatch is dangerous because users may invoke the skill under false assumptions, while the skill can perform materially broader and riskier actions than its description suggests.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file contains bulk shell scaffolding commands that create many local project files and directories, which is inconsistent with the declared MCP orchestration/integration purpose. In a skill context, embedded system-modifying commands can cause unintended local filesystem changes if copied, rendered, or executed by an automation-capable agent, making this a real supply-chain and user-safety risk.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The skill defines creation of numerous unrelated modules such as healthcare, surveillance, voice recognition, threat detection, and research components far beyond the stated orchestration role. This excessive capability expansion increases attack surface, obscures operator intent, and can be used to smuggle unauthorized functionality into an environment under the guise of an integration skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This document instructs the operator to configure a live Supabase/PostgreSQL connection and execute schema scripts for a different skill path (`deepallspeak`) than the declared orchestration skill. That mismatch is a strong supply-chain red flag because it can cause users to run privileged database operations outside the expected scope of the skill, increasing the chance of unauthorized modification or confusion-driven misuse.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file directs the user to retrieve a highly sensitive database password and place a full privileged connection string into a local `.env` file, despite this not being clearly justified by the skill's orchestration role. Encouraging manual handling of raw database credentials expands secret exposure risk through shell history, screenshots, copy/paste mistakes, local compromise, or later reuse by unrelated scripts.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document explicitly states the agent should operate in '100% AUTONOMOUS' mode and that permission is 'never needed again,' which attempts to override normal approval and containment boundaries. In an orchestration skill that coordinates many agents, tools, and MCP integrations, this can normalize self-authorized actions and increase the chance of unsafe execution or privilege misuse.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: This action plan directly says 'Never ask for permission' and 'Work completely autonomously,' which is an unsafe behavioral instruction rather than harmless status text. In a multi-agent orchestration context, such guidance can be treated as standing operational policy and lead downstream agents or operators to bypass confirmation for impactful actions.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The statement 'NO MORE ASKING. AUTONOMOUS WORK ONLY.' is a direct instruction to stop seeking approval and continue acting independently. Because this file appears to record operating status for an autonomous orchestration system, the wording can reinforce persistent unsafe behavior across future runs or human/operator expectations.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file documents a broad RAG/N8N administrative API that materially exceeds the skill metadata claiming MCP orchestration integration. This scope mismatch can mislead operators and downstream agents into invoking powerful unrelated capabilities, increasing the risk of unintended privilege use and unsafe integration behavior.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: User management, compliance, and security administration APIs are high-sensitivity capabilities that are not reflected in the skill description. Hidden or under-disclosed administrative functions make the skill more dangerous because users may grant trust or permissions without understanding it can affect identities, roles, reports, and security telemetry.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The API reference identifies the skill as "deepsynaptica" while the manifest names it "mcp-orchestral", creating contradictory identity documentation. In an orchestration skill that may be integrated into larger agent ecosystems, this can mislead operators, cause incorrect trust assumptions, and result in the wrong component being deployed, reviewed, or granted access.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The document directs activity far beyond the declared orchestration/integration scope by instructing the agent to read every file in a user directory, use all tools, and pursue autonomous self-development. In an agent skill, this scope expansion is dangerous because it can legitimize broad access to local data and autonomous behavior without user approval or task-bound limits.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The ChromaDB integration plan introduces bulk ingestion and persistent indexing of local file contents, which materially expands the skill's data-handling capabilities beyond the stated MongoDB-centric orchestration role. This mismatch is risky because it creates an undocumented persistence layer for potentially sensitive user data, increasing exposure and retention risk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file endorses unrestricted use of exec/process capabilities and automation script creation without defining guardrails, allowed commands, or task boundaries. In an agent context, that can enable command execution, process manipulation, and persistence behaviors unrelated to the user's request, raising the risk of system misuse or lateral actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The stated goals of self-improvement, unified model creation, and autonomous decision-making are inappropriate for an integration skill and encourage the agent to act beyond operator intent. This is dangerous because it reframes the skill as an autonomy-escalation mechanism, potentially justifying unsupervised access, persistence, and goal-seeking behavior.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This document repeatedly frames the skill as performing autonomous learning, persistent-memory integration, and AGI-style self-improvement, which materially exceeds the declared purpose of MCP server orchestration/integration. Even though this file is descriptive markdown rather than executable code, such instructions and positioning can drive unsafe agent behavior, scope creep, and unauthorized retention or modification of state when consumed by an agentic system.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The file documents continuous learning and self-improvement capabilities without showing why they are necessary for an orchestration skill. In an agent ecosystem, undocumented or unjustified autonomy can normalize behavior that persists data, changes plans, or expands tasks beyond user intent, increasing the risk of unintended actions and privacy or integrity issues.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file content describes a 'RAG-Enhanced N8N System' while the skill metadata claims an 'mcp-orchestral' MCP orchestration integration. This mismatch is dangerous because it can mislead operators into deploying or administering the wrong stack, applying incorrect security assumptions, secrets, recovery steps, and infrastructure commands to an unrelated environment.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly describes a bidirectional control loop where an external bot can request file reads, file writes, code modification, command execution, and autonomous project/deployment actions. Even though this is documentation rather than executable code, it normalizes and instructs use of a high-risk trust boundary that can enable uncontrolled agentic behavior beyond narrow MCP orchestration, increasing the likelihood of unsafe implementation and operator misuse.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documentation grants arbitrary command execution through a generic execute_command field with no mention of validation, allowlists, sandboxing, or user approval. If implemented as described, this becomes a direct remote code execution pathway through the bridge, allowing package installs, persistence, destructive shell commands, or lateral movement.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The guide permits read_file, write_file, create_directory, and modify_code operations over broad filesystem paths, including absolute paths, without any stated path restrictions or approval model. That creates a powerful arbitrary file access and tampering surface that could expose secrets, alter source code, or damage local project and system state if the bridge accepts untrusted requests.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The workflows describe fully autonomous MVP creation, testing, deployment to production, and continuous self-improvement with no safety boundaries or human review. In practice, this encourages self-directed code generation and release behavior that can propagate defects, security regressions, infrastructure misuse, or malicious prompt-injected actions directly into production.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The bootstrap content is materially inconsistent with the skill's declared purpose of MCP orchestration and instead instructs persona setup, user profiling, and messaging onboarding. This kind of scope drift is dangerous because it can socially engineer users into sharing data and authorizing actions unrelated to the advertised functionality, undermining informed consent and trust boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file directs collection and persistence of personal profile data such as the user's name, preferred form of address, timezone, and notes without showing necessity for the stated orchestration function. Unnecessary retention of personal data increases privacy risk, creates avoidable sensitive state, and can violate data minimization expectations.

VirusTotal

66/66 vendors flagged this skill as clean.