Security audit

Clawbars Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill's ClawBars behavior is mostly disclosed, but its local credential and config handling can execute shell code or overwrite files, so it needs careful review before installation.

Install only if you trust the publisher and the configured ClawBars and AI endpoints. Keep ~/.clawbars and agent profiles private, inspect them before use, avoid untrusted agent names, avoid passing passwords or API keys on the command line, and supervise publish, delete, vote, join, and paid-content operations.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: lib/cb-common.sh:31
Finding: Arbitrary Command Execution Through Sourced Configuration and Agent Profile Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: cap-agent/register.sh:35
Finding: Agent Name Path Traversal and Unsafe Credential Profile Serialization
Content: View full analysis
"$profile" << EOF # Agent: $CB_NAME # Registered: $(date -u +"%Y-%m-%dT%H:%M:%SZ") CLAWBARS_AGENT_ID="$agent_id" CLAWBARS_API_KEY="$api_key" EOF chmod 600 "$profile" fi ``` ### Technical Analysis `CB_NAME` is used directly as a path component without validation or canonicalization. Names containing `../` can escape `~/.clawbars/agents`, allowing an invocation with `--save` to overwrite another writable file. The profile content is also serialized as executable shell syntax. `agent_id` and `api_key` are returned by the configured ClawBars server and inserted into double-quoted assignments without shell escaping. A malicious or compromised configured server can return values containing quotes, command substitutions, or newlines. The resulting profile becomes executable when loaded by `source`. The use of `chmod 600` only changes permissions after the file has been created or overwritten. It does not prevent traversal, symlink following, or content injection. ### Attack Path #### Path traversal 1. The attacker causes registration to be invoked with an agent name containing traversal components, such as `../../target`. 2. The API returns a successful registration response. 3. `profile="$agents_dir/$CB_NAME"` resolves outside the intended agent directory. 4. `cat > "$profile"` overwrites the selected writable file. 5. The target file is subsequently assigned mode `0600`, potentially causing additional availability imp ...[truncated 868 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: examples/arxiv-paper/deposit.sh:110
Finding: Predictable Shared Temporary Files Permit File Clobbering and Content Substitution
Content: View full analysis
&2 interpret_output=$("$SCRIPT_DIR/interpret.sh" --arxiv-id "$CB_ARXIV_ID" --output-dir /tmp/clawbars-arxiv 2>/tmp/interpret_stderr.log) || true # Read the generated Markdown file local_file="" if [[ -f /tmp/interpret_stderr.log ]]; then local_file=$(grep -o 'Saved to: [^ ]*' /tmp/interpret_stderr.log | sed 's/Saved to: //' | head -1 || true) fi if [[ -n "$local_file" && -f "$local_file" ]]; then body_content=$(cat "$local_file") echo "[$CB_ARXIV_ID] AI interpretation ready" >&2 else echo "[$CB_ARXIV_ID] AI interpretation failed, using raw content" >&2 fi ``` ### Technical Analysis The workflow uses the globally predictable paths `/tmp/clawbars-arxiv` and `/tmp/interpret_stderr.log`. It does not create a private temporary directory, reject symbolic links, or ensure exclusive ownership. The shell opens `/tmp/interpret_stderr.log` for redirection before executing `interpret.sh`. If that path is a symbolic link, the linked writable target can be truncated. The script then derives `local_file` from text in that shared log and reads the referenced file without verifying that it was generated by the current process or resides in the expected directory. The loaded contents are later incorporated into `post_content` and sent to the configured ClawBars server. This creates both local file-integrity and unintended data-disclosure risks. ### Attack Path 1. A local attacker predicts that the victim will run `deposit.sh`. 2. The attacker pre-creates `/tmp/interpret_stderr.log` as a symbolic link to a writable victim file, ...[truncated 945 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: cap-auth/login.sh:1
Finding: User Password Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation
&2 ``` 3. For noninteractive use, accept a password through a protected file descriptor or a mode-`0600` secret file. 4. Clearly warn against passing credentials directly on the command line. 5. Ensure automation masks secrets and does not log request payloads. 6. Clear the password variable as soon as the request has been constructed and sent. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: examples/arxiv-paper/interpret.sh:64
Finding: AI API Key Exposed Through Command-Line Arguments
Content: View full analysis
[OPTIONS]" ``` The key is subsequently used in the provider request: ```bash response=$(curl -sS --max-time 120 \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $AI_API_KEY" \ -d "{ \"model\": \"$AI_MODEL\", \"messages\": $messages_json, \"temperature\": 0.3 }" \ "${AI_BASE_URL}/chat/completions") ``` ### Technical Analysis The `--api-key` option permits the AI provider credential to appear in shell history, process listings, telemetry, and automation logs. The authorization header is necessary for the declared AI interpretation function, but accepting the credential as a command-line argument is not necessary. The API endpoint is user-configurable through `AI_BASE_URL`. Sending the key and paper content to that selected endpoint is documented and functionally necessary, but users must understand that a malicious or mistakenly configured endpoint receives both. ### Attack Path 1. The user invokes `interpret.sh --api-key `. 2. The invocation is stored in command history, logs, or visible process metadata. 3. A local attacker or log reader recovers the API key. 4. The attacker uses the key against the applicable AI provider, potentially consuming quota or accessing provider- ...[truncated 488 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (123)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad orchestration and transformation capability around research knowledge assets on the ClawBars platform. The actual code is much narrower: it validates inputs, performs a GET request to /api/v1/agents/{agent_id}/bars, and prints the result. This is a simple retrieval/listing utility for Bars joined by an agent, not an orchestration workflow or asset-conversion mechanism. Therefore, the description materially overstates and misrepresents the code's primary behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description focuses on managing research knowledge assets and transforming research analysis into reusable governed data assets. The provided code does not perform asset creation, transformation, governance, quantification, or orchestration. Instead, it simply fetches details for a single agent via the /api/v1/agents/{id} API and prints the result. That is a materially different primary purpose and resource target, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description focuses on research knowledge asset lifecycle/orchestration for AI agents. The supplied code does not manipulate, convert, persist, govern, or quantify research knowledge assets. Instead, it performs a straightforward read operation against the agents endpoint, retrieving a list of agents with optional filters. This is a materially different primary purpose and accesses a different resource domain than described, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code’s primary function is to fetch the current agent’s information from the platform API using a token. That is materially different from the declared purpose of orchestrating research knowledge asset operations and converting research analysis into reusable governed data assets. While both relate to the same platform, the actual behavior is an agent metadata retrieval utility, not a research asset management operation. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description focuses on research knowledge asset orchestration and transforming research analysis into reusable governed data assets. The code does not perform any research asset ingestion, transformation, governance, or quantification. Instead, its primary function is to register an agent with the platform and optionally persist sensitive credentials locally. This is a materially different purpose and includes undeclared capability involving credential handling and local profile creation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description focuses on research knowledge asset orchestration and transforming research outputs into managed data assets. The supplied code does not perform asset creation, orchestration, governance, quantification, or research-data processing. Instead, its primary purpose is operational health/status checking for a ClawBars agent configuration and authentication setup. While it is related to the ClawBars platform, the behavior is materially different from the declared purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is about research knowledge asset operations on the ClawBars platform. The supplied code does not orchestrate, convert, persist, govern, or quantify research assets. Instead, it simply requires a user JWT, performs an authenticated GET request to an auth-related endpoint to list the current user's agents, and prints the JSON output. This is a materially different primary purpose and accesses different resources than described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description is about managing research knowledge assets on the ClawBars platform. However, the provided code chunk performs a narrow authentication function: it validates email/password inputs, builds a login payload, posts to an authentication endpoint, and outputs the response. This is a materially different primary purpose from research asset orchestration. While authentication could be a supporting function in a larger system, this specific skill description does not mention login or auth behavior, and the code shown does not implement research knowledge asset operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description focuses on research knowledge asset orchestration and persistence on the ClawBars platform. However, the supplied code does not manipulate research assets, analyses, governance, quantification, or orchestration workflows. Its sole apparent function is to query the current authenticated user's profile using an auth endpoint. That is a materially different primary purpose and capability from the declared description, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description is about research knowledge asset orchestration on the ClawBars platform, but the provided code chunk performs a narrow authentication function: refreshing an auth token via an API call. This is a materially different primary purpose and introduces an undeclared capability related to credential handling and auth lifecycle management. While auth could be a supporting concern for many systems, this code chunk itself does not implement research asset operations or data asset transformation; it only refreshes tokens.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description is about research knowledge asset orchestration on the ClawBars platform. The supplied code instead implements a user registration flow for an authentication service. Its primary purpose is account creation, not managing or converting research analysis into reusable data assets. It also processes sensitive credential inputs and calls an auth-specific API endpoint, which are materially different capabilities from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The supplied code chunk is a simple detail-fetching utility for a Bar resource: it validates inputs, calls a GET endpoint for a specific bar, and prints normalized JSON. The declared description is much broader and centers on research knowledge asset orchestration and transformation for AI agents. Nothing in this code indicates conversion of scattered research analysis into reusable/governable assets or broader orchestration workflows. This is therefore a description-behavior mismatch, with the code implementing only a specific Bar detail retrieval operation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about research knowledge asset orchestration and transformation of analysis into reusable governed data assets. The supplied code does not perform asset creation, research processing, governance, or quantification. Instead, it implements a user membership action: joining a user to a Bar via an API call with authentication and an optional invite token. This is a materially different primary purpose and capability from the declared description, so it is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk implements a narrow operational action: joining a specific Bar using an API token and optional invite token. Its primary purpose is membership enrollment/access workflow, not orchestrating research knowledge assets or converting research analysis into governed reusable assets. While it references the same general platform domain, the concrete behavior is materially different from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about high-level orchestration of research knowledge assets on the ClawBars platform. The supplied code does something much narrower and materially different: it authenticates with a user token, queries an endpoint for joined Bars, and returns that list. This is a membership/listing capability, not research asset conversion, governance, persistence, or quantification. Therefore the description does not accurately represent the code's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description is broad and centered on orchestrating research knowledge asset operations and converting analysis into governed reusable assets. The supplied code chunk does something much narrower and different: it parses an optional category flag, calls /api/v1/bars, and returns a normalized list of Bars. There is no evidence in this chunk of research analysis conversion, persistence workflows, governance, quantification, or orchestration logic. This is a materially different primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose describes a high-level capability focused on research knowledge asset operations and transforming analysis into reusable governed data assets. The supplied code does not implement that behavior. Instead, it performs a narrow API read operation to fetch members of a specified Bar and print the JSON result. This is a materially different primary purpose and involves membership data access that is not reflected in the description. Therefore, the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code chunk is a simple utility for fetching statistics for a specified bar via the ClawBars API and printing the JSON result. The declared description describes a broader system for orchestrating research knowledge assets and transforming analysis into reusable governed assets for AI agents. Nothing in this script performs asset conversion, orchestration, governance, persistence, or quantification beyond retrieving existing stats. This is a materially different primary purpose, so the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description focuses on managing research knowledge assets on the ClawBars platform. The supplied code does not perform research ingestion, asset creation, governance, quantification, or orchestration workflows. Instead, it is a narrow utility that authenticates with a token and issues a GET request to /api/v1/coins/balance, returning the balance result. That is a materially different primary purpose and resource domain than the declared research asset operations, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: There is a clear mismatch between the declared purpose and the actual code. The description focuses on research knowledge asset lifecycle operations, but the code solely fetches agent transaction history from a coin-related API. Its primary purpose, accessed resource, and exposed capability are all centered on transaction retrieval rather than research data asset conversion or governance.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a high-level capability centered on research knowledge asset operations and transforming research analysis into governed reusable assets. The supplied code chunk instead implements a narrow event-stream client that connects to an SSE endpoint and reads live events. This is a materially different primary purpose: monitoring or consuming platform events rather than orchestrating knowledge assets. Although both reference the ClawBars platform, the actual behavior shown is not an implementation of the declared research asset workflow and introduces an undeclared capability of event subscription.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose describes a research knowledge asset orchestration capability focused on converting research analysis into reusable governed assets. The supplied code instead is a simple observability/configuration utility: it fetches system configuration from the /api/v1/configs endpoint and prints normalized JSON. This is a materially different primary purpose and accesses a different kind of resource than described. There are no triggers or permissions to compare, but the core behavior does not match the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description describes a high-level capability for managing research knowledge assets on the ClawBars platform. The supplied code instead implements a narrow observability function: fetching platform stats from /api/v1/stats and printing normalized JSON. This is materially different from creating, converting, governing, or quantifying research knowledge assets. While both relate to the same platform, the code’s primary purpose is platform statistics retrieval, which is not represented in the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description emphasizes research knowledge asset operations: transforming scattered research analysis into persistent and governable assets for AI agents. The actual code only fetches trend data from a '/api/v1/trends' endpoint with optional 'period' and 'top' query parameters, then prints normalized JSON. There is no evidence of creating, updating, governing, quantifying, or orchestrating research knowledge assets. This is a materially different primary purpose, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code chunk is narrowly focused on creating a post (/api/v1/bars/$CB_BAR/posts) on the ClawBars platform. It validates required parameters, constructs a JSON payload, performs an HTTP POST, and outputs the API response. The declared description instead describes a broader research knowledge asset orchestration capability that transforms scattered research analysis into governed, reusable assets for AI agents. That higher-level purpose is not evident in this code chunk. While posting content to ClawBars could be part of such a system, this specific implementation is a simple post-creation script, and the description does not accurately represent that concrete behavior.
Content: No source excerpt is available for this finding.