other
Error
- Location
post.sh:29- Finding
Undeclared External Social-Bot Network Functionality
- Content
View full analysis
- Remediation
View remediation
Security audit
Social Hub
Security checks for vulnerabilities and agentic risk
Overview
This skill needs Review because its declared matchmaking-agent behavior does not match the bundled Claw Club social-bot scripts, and both sides handle sensitive data with weak user-control and secret-handling safeguards.
Review carefully before installing. The visible skill description suggests a private local matchmaking assistant, but the package also contains scripts for registering and operating a Claw Club bot, including authenticated posting and replying. The declared agent also collects and stores relationship-profile information and sends summaries to an internal group without strong consent or recipient controls. Do not use it with real personal data or API keys unless the publisher explains these integrations, adds explicit consent gates, and fixes secret handling.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
register.sh:29- Finding
API Keys Exposed Through Terminal Output and Suggested Command Lines
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
register.sh:40- Finding
Plaintext Credential File Created Without Enforced Restrictive Permissions
- Content
View full analysis
"$CONFIG_DIR/credentials.json" echo "" echo "Saved to: $CONFIG_DIR/credentials.json" ``` The file is subsequently read by `check.sh:8-9`, `engage.sh:9-10`, `post.sh:10-11`, and `reply.sh:11-12`: ```sh if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi ``` ### Technical Analysis The resulting permissions depend entirely on the caller’s current `umask` and any pre-existing directory or file permissions. The script does not establish mode `0700` for the credential directory or mode `0600` for the credential file. It also writes directly to the final path rather than using a securely created temporary file followed by an atomic rename. The highlighted credential reads are narrowly scoped to the expected Claw Club file and do not scan unrelated secret locations. The principal issue is insecure creation and storage, not unauthorized credential discovery. ### Attack Path 1. A user runs `register.sh` under a permissive `umask` or with an inadequately protected configuration directory. 2. The script writes the API key in plaintext to `credentials.json`. 3. Another local account, backup collector, or process with read access obtains the file. 4. The API key is extracted from its JSON content. 5. The key is used to authenticate as the registered bot. ### Impact Assessment A successful attacker obtains the Claw Club API credential and ...[truncated 295 chars]- Remediation
View remediation
other
Error
- Location
SKILL.md:30- Finding
Silent Personal Profiling and External Disclosure Without Concrete Consent Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a sophisticated local matchmaking assistant integrated with Enterprise WeChat, local profile/vector storage, and group-based matching workflows. The supplied code does none of that. It is a standalone Bash utility for querying the Claw Club API using an API key, printing account stats, notifications, and discover-feed posts. Its external resource access, primary purpose, and implied triggers are all unrelated to the declared skill. This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a relationship-matching personal agent with conversational data collection, local profile/vector storage, and coordination with a matching engine via group messaging. The provided code instead is a standalone shell utility for a completely different service (Claw Club), focused on polling notifications and discover feeds from https://api.vrtlly.us and printing suggested reply commands. There is no WeCom integration, no local knowledge store, no user profiling, no matching workflow, and no result delivery. The primary purpose, external resources, and trigger model are all materially different, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a sophisticated local matchmaking agent with messaging, profiling, storage, group coordination, and delivery responsibilities. The supplied code is instead a simple shell utility for retrieving and displaying a club feed from https://api.vrtlly.us/api/hub/feed via curl and jq. Its primary purpose, resources accessed, and invocation method are all materially different from the declared purpose. This is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a sophisticated local AI agent involved in Enterprise WeChat conversations, profile construction, local vector storage, group coordination, and matchmaking result handling. The supplied code does none of these things. Instead, it is a simple Bash utility that sends a message to an external web API for posting into a club/forum-like service, using curl and an API key. This is a materially different primary purpose and involves unrelated external resources and invocation mechanisms. Therefore the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a user-facing local AI matchmaking agent with conversational, profiling, storage, and workflow responsibilities. The provided code does none of that. It is a standalone registration utility that sends a POST request to a remote API to create a bot account, extracts an API key and bot ID from the response, and writes credentials to a local file. This is a materially different primary purpose and introduces undeclared network/API registration behavior while lacking the core declared behaviors and triggers.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a sophisticated local relationship-matching agent integrated with Enterprise WeChat, local profile/vector storage, group coordination, and match-result workflows. The supplied code does none of these things. Instead, it is a standalone shell utility for posting a reply to a Claw Club post through an external API endpoint. This is a materially different primary purpose, uses unrelated resources and credentials, and has no evidence of the declared triggers or capabilities. Therefore the description does not accurately represent the code.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description says profile tag summaries are pushed to an internal group for matching, but it does not present this as a prominent up-front warning or obtain explicit informed consent before sharing derived personal data. In a relationship-matching context, even summaries can reveal sensitive traits, making undisclosed secondary sharing a significant privacy risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow explicitly instructs the agent to silently collect personal information from normal conversation, update a profile, and send profile summaries to an internal group without explicit per-interaction consent. This is dangerous because it turns ordinary chat into covert data harvesting and onward sharing, which can expose sensitive personal attributes and violate privacy expectations or compliance requirements.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script's behavior is materially unrelated to the declared personal matchmaking agent. Instead of handling enterprise messaging, profile construction, or local vector storage, it interacts with an external social platform ('Claw Club') to fetch notifications and discovery posts. This mismatch is a strong indicator of deceptive or repurposed functionality that could cause unauthorized outbound activity under the guise of a different skill.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The existence check for a Claw Club credentials file indicates the script is probing for locally stored secrets unrelated to the advertised skill. In a local agent running on a user's device, unauthorized secret discovery is especially risky because it can harvest credentials from the broader environment without clear user consent.
- Content
sh API_KEY="${1:-$CLAW_CLUB_API_KEY}" # Try loading from config if no key provided if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The script reads and parses an API key from a local third-party credentials file, constituting direct credential access outside the declared matchmaking use case. This is dangerous because it enables silent use of user secrets for an unrelated external account and demonstrates capability to exfiltrate or misuse locally stored credentials.
- Content
sh # Try loading from config if no key provided if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi if [ -z "$API_KEY" ]; then
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The discover-feed and engagement logic drives social-platform interaction that has no justified relationship to a local matchmaking assistant. In context, this adds covert external communication and encourages user action on a third-party system, expanding the attack surface and creating a channel for misuse or data leakage.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script’s behavior is unrelated to the declared personal-agent purpose: it polls a third-party social platform, reads unrelated credentials, and suggests outbound engagement actions. In a local personal agent that triggers on user messages and scheduled events, this kind of off-manifest functionality is dangerous because it can covertly repurpose the agent to interact with an external service and expose user environment data or operator credentials.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code sources an API key from environment or a local credentials file for an external service unrelated to the skill’s stated function. Because this agent runs on a user’s local device, accessing unrelated credentials is especially risky: it enables covert credential harvesting and unauthorized use of third-party accounts under the guise of a different application purpose.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The script probes for and accesses a local credentials file containing an API key for an unrelated service. On a user device, this is highly sensitive behavior because it enables the skill to appropriate existing secrets without explicit authorization, potentially leading to account takeover or unauthorized automated activity.
- Content
sh API_KEY="${1:-$CLAW_CLUB_API_KEY}" # Try loading from config if no key provided if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line extracts the apiKey value from the discovered credentials file, turning the file probe into actual secret retrieval. In context, this is especially dangerous because the skill has no legitimate need for this credential, so the access strongly suggests covert credential harvesting or unauthorized reuse.
- Content
sh # Try loading from config if no key provided if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi if [ -z "$API_KEY" ]; then
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This script is functionally unrelated to the stated personal-agent purpose of local profiling and enterprise WeChat matching. It enables arbitrary posting to an external social/community service, creating an unauthorized data-exfiltration or covert-communication path from a sensitive local agent context.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Checking for a local credentials file for an unrelated service is a form of credential discovery. Even though the script only reads an API key, that behavior is dangerous in a user-local agent because it expands the agent’s access to secrets beyond its declared purpose and facilitates unauthorized posting.
- Content
sh API_KEY="${3:-$CLAW_CLUB_API_KEY}" # Try loading from config if no key provided if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This line extracts the API key from a local credentials file, operationalizing unauthorized use of a third-party account. In the context of a personal agent with access to sensitive user interactions, this secret access compounds the risk of hidden exfiltration through external posting.
- Content
sh # Try loading from config if no key provided if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi if [ -z "$MESSAGE" ]; then
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script’s functionality is to register an external bot account and obtain an API key, which does not align with the stated role of a local personal-agent that should primarily interact with users, store local profiles, and exchange limited summaries with a matching group. This capability broadens the skill’s trust boundary by provisioning a third-party identity and secret, creating unreviewed external integration and increasing the chance of unauthorized data flow or platform abuse.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The script prints a shell-ready environment variable assignment containing the full API key to stdout. Secrets echoed to terminal output are commonly captured in shell history notes, terminal scrollback, logs, screenshots, or support transcripts, creating additional avenues for credential leakage.
- Content
sh echo "" echo "⚠️ Save this API key! You'll need it for all future requests." echo "" echo "Add to your .env file:" echo "CLAW_CLUB_API_KEY=$API_KEY" # Optionally save to config
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The script stores the issued API key in plaintext under ~/.config/claw-club/credentials.json. Plaintext credential storage on disk makes the secret recoverable by other local processes, malware, backups, or accidental file sharing, and compromise of that key could allow unauthorized use of the registered bot account.
- Content
sh # Optionally save to config CONFIG_DIR="$HOME/.config/claw-club" mkdir -p "$CONFIG_DIR" echo "{\"apiKey\": \"$API_KEY\", \"botId\": \"$BOT_ID\", \"botName\": \"$BOT_NAME\"}" > "$CONFIG_DIR/credentials.json" echo "" echo "Saved to: $CONFIG_DIR/credentials.json" else
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh mkdir -p "$CONFIG_DIR" echo "{\"apiKey\": \"$API_KEY\", \"botId\": \"$BOT_ID\", \"botName\": \"$BOT_NAME\"}" > "$CONFIG_DIR/credentials.json" echo "" echo "Saved to: $CONFIG_DIR/credentials.json" else echo "❌ Unexpected response:" echo "$RESPONSE"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script's purpose is unrelated to the declared personal-agent skill: instead of handling local user profiling and enterprise WeChat interactions, it posts replies to an external Claw Club service. In an agent context, this kind of capability mismatch is a strong indicator of hidden or repurposed functionality, creating risk of unauthorized outbound actions and abuse of the host environment's credentials.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The code checks for the presence of a local credentials file belonging to another service, which is credential discovery behavior. In an agent skill, probing for and later consuming unrelated secrets is dangerous because it can abuse user environment credentials without explicit authorization.
- Content
sh API_KEY="${4:-$CLAW_CLUB_API_KEY}" # Try loading from config if no key provided if [ -z "$API_KEY" ] && [ -f "$HOME/.config/claw-club/credentials.json" ]; then API_KEY=$(jq -r '.apiKey // empty' "$HOME/.config/claw-club/credentials.json") fi
Static analysis
No suspicious patterns detected.