Social Hub

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:56 AM UTC
• Version: 1.0.0

Overview

This skill needs Review because its declared matchmaking-agent behavior does not match the bundled Claw Club social-bot scripts, and both sides handle sensitive data with weak user-control and secret-handling safeguards.

Review carefully before installing. The visible skill description suggests a private local matchmaking assistant, but the package also contains scripts for registering and operating a Claw Club bot, including authenticated posting and replying. The declared agent also collects and stores relationship-profile information and sends summaries to an internal group without strong consent or recipient controls. Do not use it with real personal data or API keys unless the publisher explains these integrations, adds explicit consent gates, and fixes secret handling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

other

Error

• Location: post.sh:29
• Finding: Undeclared External Social-Bot Network Functionality<![CDATA[ ## Vulnerability Details **File Location**: `check.sh:20-22,49-51`; `engage.sh:18-19,46-47`; `feed.sh:9-16`; `post.sh:29-32`; `reply.sh:28-32`; `register.sh:14-16` **Vulnerability Type**: Undeclared external network behavior **Risk Level**: High The executable scripts communicate with the external service `https://api.vrtlly.us` to register bots, retrieve notifications and feeds, and publish posts or replies. This functionality is materially different from the relationship-matching, enterprise-WeChat, local ChromaDB, and internal-group workflow declared in `SKILL.md`. ### Relevant Code `check.sh:20-22`: ```sh # Get notifications (mentions + replies to your posts) ME_RESPONSE=$(curl -s "https://api.vrtlly.us/api/hub/me" \ -H "x-api-key: $API_KEY") ``` `check.sh:49-51`: ```sh # Get discover feed (interesting posts to engage with) DISCOVER_RESPONSE=$(curl -s "https://api.vrtlly.us/api/hub/discover?limit=5" \ -H "x-api-key: $API_KEY") ``` `engage.sh:18-19`: ```sh # Get notifications first (priority) ME_RESPONSE=$(curl -s "https://api.vrtlly.us/api/hub/me" -H "x-api-key: $API_KEY") ``` `engage.sh:46-47`: ```sh # No notifications - check for interesting posts DISCOVER=$(curl -s "https://api.vrtlly.us/api/hub/discover?limit=3" -H "x-api-key: $API_KEY") ``` `feed.sh:9-16`: ```sh # Build URL if [ -n "$CLUB" ]; then URL="https://api.vrtlly.us/api/hub/feed?club=$CLUB&limit=$LIMIT" else URL="https://api.vrtlly.us/api/hub/feed?limit=$LIMIT" fi RESPONSE=$(curl -s "$URL") ``` `post.sh:29-32`: ```sh RESPONSE=$(curl -s -X POST "https://api.vrtlly.us/api/hub/posts" \ -H "Content-Type: application/json" \ -H "x-api-key: $API_KEY" \ -d "{\"message\": $MESSAGE_ESCAPED, \"clubSlug\": \"$CLUB\"}") ``` `reply.sh:28-32`: ```sh # Use new endpoint RESPONSE=$(curl -s -X POST "https://api.vrtlly.us/api/hub/posts/$POST_ID/reply" \ -H "Content-Type: application/json" \ -H "x-api-key: $API_KEY" \ -d "{\"message\": $MESSAGE_ESCAPED}") ``` `registe ...[truncated 1938 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the Claw Club scripts from this Skill if they are not required for the declared relationship-matching workflow. - If the integration is intentional, document the external service, domain, API operations, data categories, authentication model, retention policy, and whether posts are public. - Require explicit user consent before registration or any content-changing request. - Separate unrelated social-network functionality into an independently reviewed Skill. - Apply a strict destination allowlist and display a confirmation containing the destination and exact content before each external write. - Add connection timeouts, TLS failure enforcement, HTTP status validation, and safe error handling to every `curl` invocation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: register.sh:29
• Finding: API Keys Exposed Through Terminal Output and Suggested Command Lines<![CDATA[ ## Vulnerability Details **File Location**: `check.sh:59,66`; `engage.sh:39-42,65-66`; `register.sh:29-38` **Vulnerability Type**: Secret exposure through output and command-line arguments **Risk Level**: High Several scripts print the complete API key or generate example commands containing it. ### Relevant Code `check.sh:59`: ```sh echo "Reply with: ./reply.sh \"postId\" \"your message\" \"club\" \"$API_KEY\"" ``` `check.sh:66`: ```sh echo "Post something: ./post.sh \"your thought\" \"club\" \"$API_KEY\"" ``` `engage.sh:39-42`: ```sh echo "ACTION NEEDED: Reply to these! Use:" FIRST_POST=$(echo "$NOTIFS" | jq -r '.[0].postId') FIRST_CLUB=$(echo "$NOTIFS" | jq -r '.[0].clubSlug // "random"') echo "./reply.sh \"$FIRST_POST\" \"your response\" \"$FIRST_CLUB\" \"$API_KEY\"" ``` `engage.sh:65-66`: ```sh echo "Consider replying with a thoughtful response:" echo "./reply.sh \"$POST_ID\" \"your reply\" \"$CLUB\" \"$API_KEY\"" ``` `register.sh:29-38`: ```sh if [ -n "$API_KEY" ]; then echo "✅ Registered successfully!" echo "" echo "Bot ID: $BOT_ID" echo "API Key: $API_KEY" echo "" echo "⚠️ Save this API key! You'll need it for all future requests." echo "" echo "Add to your .env file:" echo "CLAW_CLUB_API_KEY=$API_KEY" ``` ### Technical Analysis Secrets written to standard output can be retained in terminal scrollback, agent execution transcripts, CI logs, cron mail, monitoring collectors, or redirected files. The suggested commands encourage users to place the key directly in the process argument vector. Depending on the operating system and process-inspection policy, command arguments may be visible to other local users or monitoring software. They are also commonly retained in shell history. This bypasses the otherwise preferable environment-variable or protected credential-file mechanisms already supported by the scripts. ### Attack Path 1. A user registers a bot or runs `check.sh` or `engage.sh`. 2. The script prints th ...[truncated 793 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never print API keys, including in example commands or environment-assignment instructions. - Replace generated commands containing the key with commands that rely on an already configured credential source. - Do not accept secrets through positional command-line arguments. Prefer a secret manager, a protected credential file, or an inherited environment variable. - Redact API keys from logs and error output, showing only a non-sensitive identifier or a short fingerprint when necessary. - Warn users to rotate any key that has already appeared in logs, transcripts, shell history, or process arguments. - Add automated tests that fail if output includes the loaded API key. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: register.sh:40
• Finding: Plaintext Credential File Created Without Enforced Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `register.sh:40-45` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Medium The registration script writes the newly issued API key to a plaintext JSON file but does not enforce restrictive directory or file permissions. ### Relevant Code `register.sh:40-45`: ```sh # Optionally save to config CONFIG_DIR="$HOME/.config/claw-club" mkdir -p "$CONFIG_DIR" echo "{\"apiKey\": \"$API_KEY\", \"botId\": \"$BOT_ID\", \"botName\": \"$BOT_NAME\"}" > "$CONFIG_DIR/credentials.json" echo "" echo "Saved to: $CONFIG_DIR/credentials.json" ``` The file is subsequently read by `check.sh:8-9`, `engage.sh:9-10`, `post.sh:10-11`, and `reply.sh:11-12`: ```sh if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi ``` ### Technical Analysis The resulting permissions depend entirely on the caller’s current `umask` and any pre-existing directory or file permissions. The script does not establish mode `0700` for the credential directory or mode `0600` for the credential file. It also writes directly to the final path rather than using a securely created temporary file followed by an atomic rename. The highlighted credential reads are narrowly scoped to the expected Claw Club file and do not scan unrelated secret locations. The principal issue is insecure creation and storage, not unauthorized credential discovery. ### Attack Path 1. A user runs `register.sh` under a permissive `umask` or with an inadequately protected configuration directory. 2. The script writes the API key in plaintext to `credentials.json`. 3. Another local account, backup collector, or process with read access obtains the file. 4. The API key is extracted from its JSON content. 5. The key is used to authenticate as the registered bot. ### Impact Assessment A successful attacker obtains the Claw Club API credential and ...[truncated 295 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Set `umask 077` before creating any credential-related path. - Create the directory with mode `0700` and explicitly verify its ownership. - Create the credential file atomically with mode `0600`, then verify permissions before use. - Prefer an operating-system keychain or dedicated secret manager instead of plaintext JSON. - Avoid placing non-secret metadata and secrets in a file that may be broadly copied or backed up. - Reject symlinks and unexpected file types before writing to the credential path. - Rotate the API key if the existing file has ever had broader permissions. ]]>

other

Error

• Location: SKILL.md:30
• Finding: Silent Personal Profiling and External Disclosure Without Concrete Consent Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:30-54,118-130,146-148,154` **Vulnerability Type**: Privacy-invasive data collection and disclosure **Risk Level**: High The Skill directs the agent to collect employment and personal-interest information, silently retain information disclosed during ordinary conversation, process conversations with an LLM, store profile data, and transmit profile summaries and feedback to an internal group. The document states privacy principles and supports later deletion or private disclosure flags, but it does not define explicit opt-in, recipient identity, endpoint allowlisting, encryption, retention limits, or enforcement that private fields are excluded from all outbound summaries. ### Relevant Skill Instructions Faithful English rendering of `SKILL.md:30-32`: ```text For a new user, obtain four required fields within five minutes: city, industry, job_title, and primary_skill. During ordinary conversation, watch for opportunities to passively collect profile information. If the user naturally reveals profile-related information, record it silently without asking an additional question. ``` Faithful English rendering of `SKILL.md:36-54`: ```text After each conversation, call an LLM to analyze the conversation and extract information that can update the profile. Write new information to ChromaDB collections for skills, interests, goals, challenges, and basic_info. If the profile changes, generate the latest tag summary and send a PROFILE_UPDATE message through the group. ``` Faithful English rendering of `SKILL.md:118`: ```text Generate a FEEDBACK message from the user's response and send it to the group. ``` Faithful English rendering of `SKILL.md:146-148`: ```text Each record's metadata contains field_name, value, state, source, collected_at, updated_at, and disclosure. Embeddings are generated using an LLM provider's embedding API. ``` ### Technical Analysis Natural conversation can contain se ...[truncated 1864 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Obtain explicit, informed opt-in before profile extraction, embedding generation, group transmission, or matching use. - Present the exact categories collected, recipients, processing purposes, retention periods, and deletion limitations. - Replace silent collection with visible notices and provide a review-and-confirm step before persistence. - Minimize required fields and avoid collecting challenges, events, or other potentially sensitive dimensions unless necessary. - Identify and allowlist all LLM, embedding, enterprise-messaging, and group endpoints. - Enforce an outbound policy that excludes every field marked `private` and rejects unknown or sensitive fields by default. - Encrypt local profile storage and pending match data, with keys held outside the database. - Define automatic retention expiration and verifiable deletion for local data and external processors. - Provide access, correction, export, deletion, and processing-withdrawal controls before deployment. - Add auditable logs containing metadata about disclosures without logging the sensitive values themselves. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a sophisticated local matchmaking assistant integrated with Enterprise WeChat, local profile/vector storage, and group-based matching workflows. The supplied code does none of that. It is a standalone Bash utility for querying the Claw Club API using an API key, printing account stats, notifications, and discover-feed posts. Its external resource access, primary purpose, and implied triggers are all unrelated to the declared skill. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a relationship-matching personal agent with conversational data collection, local profile/vector storage, and coordination with a matching engine via group messaging. The provided code instead is a standalone shell utility for a completely different service (Claw Club), focused on polling notifications and discover feeds from https://api.vrtlly.us and printing suggested reply commands. There is no WeCom integration, no local knowledge store, no user profiling, no matching workflow, and no result delivery. The primary purpose, external resources, and trigger model are all materially different, so this is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description describes a sophisticated local matchmaking agent with messaging, profiling, storage, group coordination, and delivery responsibilities. The supplied code is instead a simple shell utility for retrieving and displaying a club feed from https://api.vrtlly.us/api/hub/feed via curl and jq. Its primary purpose, resources accessed, and invocation method are all materially different from the declared purpose. This is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a sophisticated local AI agent involved in Enterprise WeChat conversations, profile construction, local vector storage, group coordination, and matchmaking result handling. The supplied code does none of these things. Instead, it is a simple Bash utility that sends a message to an external web API for posting into a club/forum-like service, using curl and an API key. This is a materially different primary purpose and involves unrelated external resources and invocation mechanisms. Therefore the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a user-facing local AI matchmaking agent with conversational, profiling, storage, and workflow responsibilities. The provided code does none of that. It is a standalone registration utility that sends a POST request to a remote API to create a bot account, extracts an API key and bot ID from the response, and writes credentials to a local file. This is a materially different primary purpose and introduces undeclared network/API registration behavior while lacking the core declared behaviors and triggers.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a sophisticated local relationship-matching agent integrated with Enterprise WeChat, local profile/vector storage, group coordination, and match-result workflows. The supplied code does none of these things. Instead, it is a standalone shell utility for posting a reply to a Claw Club post through an external API endpoint. This is a materially different primary purpose, uses unrelated resources and credentials, and has no evidence of the declared triggers or capabilities. Therefore the description does not accurately represent the code.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The skill description says profile tag summaries are pushed to an internal group for matching, but it does not present this as a prominent up-front warning or obtain explicit informed consent before sharing derived personal data. In a relationship-matching context, even summaries can reveal sensitive traits, making undisclosed secondary sharing a significant privacy risk.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The workflow explicitly instructs the agent to silently collect personal information from normal conversation, update a profile, and send profile summaries to an internal group without explicit per-interaction consent. This is dangerous because it turns ordinary chat into covert data harvesting and onward sharing, which can expose sensitive personal attributes and violate privacy expectations or compliance requirements.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script's behavior is materially unrelated to the declared personal matchmaking agent. Instead of handling enterprise messaging, profile construction, or local vector storage, it interacts with an external social platform ('Claw Club') to fetch notifications and discovery posts. This mismatch is a strong indicator of deceptive or repurposed functionality that could cause unauthorized outbound activity under the guise of a different skill.

Credential Access

High

• Category: Privilege Escalation

Content

API_KEY="${1:-$CLAW_CLUB_API_KEY}"

# Try loading from config if no key provided
if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then
  API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json")
fi

• Confidence: 97% confidence
• Finding: The existence check for a Claw Club credentials file indicates the script is probing for locally stored secrets unrelated to the advertised skill. In a local agent running on a user's device, unauthorized secret discovery is especially risky because it can harvest credentials from the broader environment without clear user consent.

Credential Access

High

• Category: Privilege Escalation

Content

# Try loading from config if no key provided
if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then
  API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json")
fi

if [ -z "$API_KEY" ]; then

• Confidence: 98% confidence
• Finding: The script reads and parses an API key from a local third-party credentials file, constituting direct credential access outside the declared matchmaking use case. This is dangerous because it enables silent use of user secrets for an unrelated external account and demonstrates capability to exfiltrate or misuse locally stored credentials.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The discover-feed and engagement logic drives social-platform interaction that has no justified relationship to a local matchmaking assistant. In context, this adds covert external communication and encourages user action on a third-party system, expanding the attack surface and creating a channel for misuse or data leakage.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script’s behavior is unrelated to the declared personal-agent purpose: it polls a third-party social platform, reads unrelated credentials, and suggests outbound engagement actions. In a local personal agent that triggers on user messages and scheduled events, this kind of off-manifest functionality is dangerous because it can covertly repurpose the agent to interact with an external service and expose user environment data or operator credentials.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code sources an API key from environment or a local credentials file for an external service unrelated to the skill’s stated function. Because this agent runs on a user’s local device, accessing unrelated credentials is especially risky: it enables covert credential harvesting and unauthorized use of third-party accounts under the guise of a different application purpose.

Credential Access

High

• Category: Privilege Escalation

Content

API_KEY="${1:-$CLAW_CLUB_API_KEY}"

# Try loading from config if no key provided
if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then
  API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json")
fi

• Confidence: 99% confidence
• Finding: The script probes for and accesses a local credentials file containing an API key for an unrelated service. On a user device, this is highly sensitive behavior because it enables the skill to appropriate existing secrets without explicit authorization, potentially leading to account takeover or unauthorized automated activity.

Credential Access

High

• Category: Privilege Escalation

Content

# Try loading from config if no key provided
if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then
  API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json")
fi

if [ -z "$API_KEY" ]; then

• Confidence: 99% confidence
• Finding: This line extracts the apiKey value from the discovered credentials file, turning the file probe into actual secret retrieval. In context, this is especially dangerous because the skill has no legitimate need for this credential, so the access strongly suggests covert credential harvesting or unauthorized reuse.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This script is functionally unrelated to the stated personal-agent purpose of local profiling and enterprise WeChat matching. It enables arbitrary posting to an external social/community service, creating an unauthorized data-exfiltration or covert-communication path from a sensitive local agent context.

Credential Access

High

• Category: Privilege Escalation

Content

API_KEY="${3:-$CLAW_CLUB_API_KEY}"

# Try loading from config if no key provided
if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then
  API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json")
fi

• Confidence: 95% confidence
• Finding: Checking for a local credentials file for an unrelated service is a form of credential discovery. Even though the script only reads an API key, that behavior is dangerous in a user-local agent because it expands the agent’s access to secrets beyond its declared purpose and facilitates unauthorized posting.

Credential Access

High

• Category: Privilege Escalation

Content

# Try loading from config if no key provided
if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then
  API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json")
fi

if [ -z "$MESSAGE" ]; then

• Confidence: 95% confidence
• Finding: This line extracts the API key from a local credentials file, operationalizing unauthorized use of a third-party account. In the context of a personal agent with access to sensitive user interactions, this secret access compounds the risk of hidden exfiltration through external posting.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s functionality is to register an external bot account and obtain an API key, which does not align with the stated role of a local personal-agent that should primarily interact with users, store local profiles, and exchange limited summaries with a matching group. This capability broadens the skill’s trust boundary by provisioning a third-party identity and secret, creating unreviewed external integration and increasing the chance of unauthorized data flow or platform abuse.

Credential Access

High

• Category: Privilege Escalation

Content

echo ""
  echo "⚠️  Save this API key! You'll need it for all future requests."
  echo ""
  echo "Add to your .env file:"
  echo "CLAW_CLUB_API_KEY=$API_KEY"
  
  # Optionally save to config

• Confidence: 93% confidence
• Finding: The script prints a shell-ready environment variable assignment containing the full API key to stdout. Secrets echoed to terminal output are commonly captured in shell history notes, terminal scrollback, logs, screenshots, or support transcripts, creating additional avenues for credential leakage.

Credential Access

High

• Category: Privilege Escalation

Content

# Optionally save to config
  CONFIG_DIR="$HOME/.config/claw-club"
  mkdir -p "$CONFIG_DIR"
  echo "{\"apiKey\": \"$API_KEY\", \"botId\": \"$BOT_ID\", \"botName\": \"$BOT_NAME\"}" > "$CONFIG_DIR/credentials.json"
  echo ""
  echo "Saved to: $CONFIG_DIR/credentials.json"
else

• Confidence: 98% confidence
• Finding: The script stores the issued API key in plaintext under ~/.config/claw-club/credentials.json. Plaintext credential storage on disk makes the secret recoverable by other local processes, malware, backups, or accidental file sharing, and compromise of that key could allow unauthorized use of the registered bot account.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p "$CONFIG_DIR"
  echo "{\"apiKey\": \"$API_KEY\", \"botId\": \"$BOT_ID\", \"botName\": \"$BOT_NAME\"}" > "$CONFIG_DIR/credentials.json"
  echo ""
  echo "Saved to: $CONFIG_DIR/credentials.json"
else
  echo "❌ Unexpected response:"
  echo "$RESPONSE"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script's purpose is unrelated to the declared personal-agent skill: instead of handling local user profiling and enterprise WeChat interactions, it posts replies to an external Claw Club service. In an agent context, this kind of capability mismatch is a strong indicator of hidden or repurposed functionality, creating risk of unauthorized outbound actions and abuse of the host environment's credentials.

Credential Access

High

• Category: Privilege Escalation

Content

API_KEY="${4:-$CLAW_CLUB_API_KEY}"

# Try loading from config if no key provided
if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then
  API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json")
fi

• Confidence: 94% confidence
• Finding: The code checks for the presence of a local credentials file belonging to another service, which is credential discovery behavior. In an agent skill, probing for and later consuming unrelated secrets is dangerous because it can abuse user environment credentials without explicit authorization.

Static analysis

No suspicious patterns detected.