Clawdentials Escrow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:12 AM UTC
• Version: 0.1.0

Overview

The skill matches its stated payment and escrow purpose, but it handles financial actions and sensitive credentials with under-scoped safety guidance and mutable MCP install instructions.

Install only if you are comfortable with a payment-capable MCP server handling API keys, Nostr private key material, identity-linking tokens, and fund-moving requests. Pin and verify the npm package before use, keep apiKey and nsec out of prompts/logs/repos, verify crypto addresses and amounts manually, and avoid linking Moltbook unless you understand the token's permissions and revocation path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53

Finding

Unpinned npm Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53, SKILL.md:93-94, and references/api.md:111
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:53:

bash

npx clawdentials-mcp --register "YourAgentName" --skills "research,coding" --description "What you do"

SKILL.md:93-94:

json

"command": "npx",
"args": ["clawdentials-mcp"]

references/api.md:111:

bash

npx clawdentials-mcp

Technical Analysis

The documentation instructs users and MCP clients to execute clawdentials-mcp through npx without specifying an exact version, lockfile, or integrity hash. If the package is not already installed locally, npx can retrieve it from the configured npm registry and execute it immediately.

Consequently, the code executed by users is mutable and is not contained in the audited project. A future package release, compromised maintainer account, registry compromise, or malicious package replacement could alter the effective payload after this Skill has been reviewed.

This is particularly sensitive because the documented MCP package supports registration, escrow completion, deposits, and cryptocurrency withdrawals. Code running in that process could potentially access environment variables, local files available to the user, API credentials supplied to MCP operations, and financial transaction parameters.

Attack Path

1. An attacker compromises the npm publisher account, publishing pipeline, or package distribution channel for clawdentials-mcp.
2. The attacker publishes a malicious package release under the same package name.
3. A user follows the documentation or configures the MCP server with the unversioned npx command.
4. npx resolves and downloads the current malicious release.
5. The package executes with the privileges of the invoking user or agent process.
6. The malicious package can attempt ...[truncated 590 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a reviewed exact version, such as clawdentials-mcp@0.7.2, rather than resolving the latest release.
• Use a lockfile and verify the package integrity hash before execution.
• Avoid implicit download-and-run behavior. Install and verify the package separately before enabling it as an MCP server.
• Publish the corresponding package source and build provenance so reviewers can confirm that the distributed artifact matches the reviewed source.
• Use npm provenance or signed releases and restrict publisher accounts with phishing-resistant multi-factor authentication.
• Run the MCP server under a dedicated, least-privileged account or sandbox with narrowly limited filesystem and environment access.
• Do not expose unrelated secrets to the MCP process, and require explicit confirmation for escrow release and withdrawal operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55

Finding

Third-Party Moltbook Token Is Submitted to an External Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-69 and references/api.md:17-29
Vulnerability Type: Unsafe handling and disclosure of a third-party identity token
Risk Level: Medium

Vulnerable Code

SKILL.md:55-69:

http

POST https://clawdentials.pages.dev/api/agent/register
Content-Type: application/json

{
  "name": "your-moltbook-name",
  "description": "What you do",
  "skills": ["research", "coding"],
  "moltbook_token": "eyJhbG..."
}

references/api.md:17-29:

json

{
  "name": "agent-name",
  "description": "What you do",
  "skills": ["coding", "research"],
  "moltbookToken": "eyJ..."  // Optional: link Moltbook account
}

Technical Analysis

The registration instructions tell users to place a Moltbook token directly into a request sent to https://clawdentials.pages.dev/api/agent/register. The reviewed files do not document the token's permissions, lifetime, audience restriction, storage policy, revocation behavior, or whether Moltbook authorizes disclosure of the token to this service.

If this value is a reusable bearer token, possession may be sufficient to exercise the permissions associated with the Moltbook account. Sending it to another service expands the token's trust boundary and exposes it to that service's application code, logs, monitoring systems, storage, administrators, and any attacker who compromises those components.

The documentation also uses two different field names, moltbook_token and moltbookToken. Although this inconsistency is not itself a confirmed security vulnerability, it may complicate validation and should be corrected as part of a hardened integration design.

Attack Path

1. A user obtains a Moltbook token and follows the account-linking instructions.
2. The user submits the token to the external Clawdentials registration endpoint.
3. The endpoint or associated infrastructure receives and processes the ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

• Replace manual bearer-token submission with an OAuth-style authorization flow or another Moltbook-approved account-linking mechanism.
• Use narrowly scoped, short-lived, audience-bound, and single-use authorization grants.
• Ensure the authorization code can be redeemed only by the intended Clawdentials client and redirect URI.
• Clearly document the permissions requested, token lifetime, retention policy, revocation procedure, and receiving service.
• Never record identity tokens in application, proxy, analytics, or error logs.
• Encrypt credentials in transit and at rest, isolate token-processing services, and delete linking credentials immediately when they are no longer needed.
• Provide users with a way to review and revoke linked access.
• Standardize and validate the request schema so the documented token field has one canonical name.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The registration flow returns sensitive secrets (apiKey and especially Nostr nsec) over the network and tells users to save them, but does not clearly warn that these are bearer credentials/private keys that must be handled like passwords. In this context, users may paste, log, sync, or store them insecurely, enabling account takeover, impersonation, and unauthorized financial actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run an unpinned package via npx, which fetches and executes whatever version is current at invocation time. In a payments/credential-handling context, a compromised maintainer account, malicious update, dependency hijack, or typo-squatted replacement could immediately lead to arbitrary code execution and theft of API keys, Nostr private keys, or funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents deposits, escrow, and withdrawals across crypto/payment rails but omits clear warnings that transfers and withdrawals may be irreversible, destination addresses must be verified, and disputes/recoveries may be limited or impossible. Because this skill is specifically about escrow and agent payments, the absence of such warnings materially increases the chance of permanent financial loss from mistakes, misuse, or social engineering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The API reference shows issuance of highly sensitive credentials, including an API key and a Nostr private key (nsec), but does not warn that these secrets must never be logged, shared, or stored insecurely. In an agent ecosystem, omission of handling guidance materially increases the chance that integrators expose credentials through prompts, repos, telemetry, or debug output, leading to account takeover or impersonation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The documentation instructs users to run npx clawdentials-mcp without pinning a specific version or integrity constraint. This creates a supply-chain risk because a later malicious or compromised package release could be fetched and executed automatically in a sensitive agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reference lists fund-moving operations such as deposits and withdrawals, along with escrow and bounty actions that can have irreversible financial consequences, but provides no warnings about confirmation, authorization, destination verification, or irreversible execution. In an agent skill context, such omissions make it easier for downstream agents or users to automate unsafe financial actions without adequate human review, increasing risk of loss or fraud.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.