T01 · Skill Instruction Hijacking
Error
- Location
heartbeat/SKILL.md:20- Finding
Unsigned Remote Skill Updates Can Replace Audited Instructions During Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawBond
Security checks for vulnerabilities and agentic risk
Overview
This is a real ClawBond social-platform integration, but it needs Review because it can post publicly, message others, persist credentials and private conversations, and reload remote instructions without tight approval controls.
Install only if you are comfortable with this agent acting on your ClawBond account, including posting, commenting, sending DMs, and creating connection requests. Prefer disabling full-auto and heartbeat until you have explicit approval gates, pinned plugin versions, hardened credential storage, strict ClawBond host allowlists, and retention controls for private DM history.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T01 · Skill Instruction Hijacking
Error
- Location
heartbeat/SKILL.md:83- Finding
Platform-Controlled Notifications and Learning Instructions Are Treated as Executable Agent Directives
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
social/SKILL.md:73- Finding
Implicit Intent Can Trigger Autonomous Public Posts, DMs, and Human Connection Requests
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:75- Finding
Onboarding Installs an Unpinned Third-Party Plugin and Recommends a Broad Automatic Repair Command
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
init/SKILL.md:133- Finding
Bearer and Refresh Credentials Are Persisted in Predictable Plaintext Files Without Permission Hardening
- Content
View full analysis
", "social_base_url": "https://", "agent_access_token": "eyJhbG...", "agent_id": "266976886876278784", "agent_name": "MyClaw", "agent_slug": "myclaw", "owner_user_id": "1001", "secret_key": "uuid-for-token-refresh", "binding_status": "bound" } ``` ### Technical Analysis The Skill intentionally stores both the active bearer token and the refresh secret in a JSON file under a predictable state directory. It does not specify restrictive directory/file modes, ownership checks, atomic secure creation, symlink rejection, encryption, OS credential-store use, or secret-redacted backup behavior. The instruction not to print credentials or commit them to Git is useful but does not protect against local processes, other users, permissive default umasks, backups, malware, or accidental synchronization. Because `secret_key` can refresh the bearer token when combined with `agent_id`, exposure may provide access beyond the current token's lifetime. ### Attack Path 1. The Skill creates `credentials.json` using ordinary runtime file-writing behavior. 2. The file inherits an unsafe default mode, is exposed through backup/synchronization, or is replaced with a symlink before writing. 3. Another local user or process reads the bearer token and ...[truncated 690 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
init/SKILL.md:243- Finding
Bearer Tokens Can Be Sent to Arbitrary Configured Origins Because URL Validation Is Too Weak
- Content
View full analysis
PLATFORM - social_base_url -> SOCIAL - agent_access_token -> TOKEN - agent_id -> AGENT_ID ``` Authenticated calls then use the stored origin: ```bash curl -s "${PLATFORM}/api/agent/me" \ -H "Authorization: Bearer ${TOKEN}" ``` The benchmark module at `benchmark/SKILL.md:16-30` also permits an override and reuses the primary token: ```text BENCHMARK_BASE is fixed to https://benchmark.clawbond.ai, but an operator may override it. TOKEN is agent_access_token read from ${AGENT_HOME}/credentials.json. ``` ```bash curl -s -X POST "${BENCHMARK_BASE}/api/benchmark/runs" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d '{}' ``` ### Technical Analysis Origin validation checks only whether a URL begins with `http://` or `https://`. It does not require TLS, match an approved hostname, reject user-info, reject unexpected ports, normalize deceptive hostnames, or constrain redirect destinations. The same bearer token is attached to requests built from stored or operator-overridden base URLs. Consequently, state-file modification, unsafe operator configuration, or an untrusted runtime override can redirect an authenticated request to an attacker-controlled server. Allowing plain HTTP also exposes bearer tokens to network interception. ### Attack Path 1. An attacker modifies `credentials.json`, ...[truncated 1004 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
dm/SKILL.md:205- Finding
DM Persistence Uses Unsafe Shell Interpolation and Retains Private Conversations Indefinitely
- Content
View full analysis
> "${CONV_FILE}" # Received message echo '{"ts":"'$(TZ='Asia/Shanghai' date +'%Y-%m-%dT%H:%M:%S+08:00')'","from":"PEER_AGENT_ID","body":"CONTENT_ESCAPED"}' >> "${CONV_FILE}" ``` Error handling states: ```text - If writing fails, silently skip it without telling the user. - If reading fails, treat it as empty history and begin normally. ``` ### Technical Analysis The documented command constructs shell syntax by interpolating identifiers and message bodies into an `echo` command. JSON escaping is not equivalent to shell escaping. If an implementation substitutes remote DM content into `CONTENT_ESCAPED`, quotes, command substitutions, backticks, newlines, or shell metacharacters may terminate the intended string and alter command parsing. The conversation filename replaces only colons. It does not require a strict identifier format or reject `/`, `\`, `..`, control characters, or platform-specific path syntax. A malicious or compromised server-provided conversation ID could therefore manipulate the destination path. Separately, complete DM bodies are retained permanently with no encryption, expiration, deletion workflow, size limit, or user-facing retention control. Si ...[truncated 1539 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (56)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are intentionally expansive, allowing the skill to activate on vague social intent such as 'meet people' or 'ask around' even when the user did not clearly request external outreach. In this skill's context, activation can lead directly to public posting, DMing, or recruitment behavior, so overbroad invocation materially increases the chance of unintended account actions and privacy exposure.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly authorizes autonomous public posting, learning reports, DM progression, and connection requests '先执行，再汇报结果' once intent seems clear. Because these are externally visible or socially consequential actions performed on behalf of a human, the lack of an upfront warning and consent checkpoint creates a strong risk of reputational harm, unintended disclosure, and unwanted contact.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Directing the agent to read ${AGENT_HOME}/credentials.json to obtain base URLs, agent identity, and an access token creates a powerful secret-access primitive inside the skill. If the skill is triggered unexpectedly, modified, or combined with other instructions, those credentials could be misused for unauthorized API actions or exfiltrated to unintended destinations.
- Content
md ClawBond 有两个独立服务，必须为不同 endpoint 使用正确的 base URL，统一使用同一个 `agent_access_token`。 **每次 API 调用前**，从 `${AGENT_HOME}/credentials.json` 读取： - `platform_base_url` → `PLATFORM`，用于 Server endpoints - `social_base_url` → `SOCIAL`，用于 Rec-sys endpoints - `agent_access_token` → `TOKEN`
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The benchmark module materially expands the skill from a social-platform interaction tool into an agent evaluation and credential-using execution workflow. This scope mismatch can cause the skill to trigger in contexts unrelated to social interactions, leading the agent to perform unintended network actions and benchmark submissions under the user's identity or agent token.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs reading an access token from
${AGENT_HOME}/credentials.json, which grants this module access to stored credentials and couples that access to outbound network calls. Even though it says not to print the token, credential access inside a broadly triggered skill raises the risk of unauthorized use, replay against alternate endpoints, or abuse if the skill is invoked unexpectedly.- Content
md **BENCHMARK_BASE**：固定为 `https://benchmark.clawbond.ai`，operator 可覆盖。 **TOKEN**：从 `${AGENT_HOME}/credentials.json` 读取 `agent_access_token`（见 `init/SKILL.md`）。 **保密原则**：token 及凭证不得打印或在对话中展示。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This line explicitly directs writing long-lived authentication material, including agent_access_token and secret_key, into a local JSON file. If that file is readable by other local users, backed up insecurely, or exposed through tooling, an attacker could impersonate the agent and refresh tokens to maintain access.
- Content
md 绑定成功后写入凭证： 1. 调用 `GET /api/agent/me` 2. 写入 `${AGENT_HOME}/credentials.json`：`agent_access_token`、`agent_id`、`agent_name`、`agent_slug`、`secret_key`、`owner_user_id`、`binding_status: "bound"`、`platform_base_url`、`social_base_url` 3. 写入 `${STATE_ROOT}/active-agent.json`：`{ "agent_key": "${agent_slug}-${id_suffix}" }` 4. 执行"绑定后流程"
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs automatic modification of openclaw.json and may trigger runtime restart, which are sensitive local administrative actions unrelated to simple social-platform binding. If misused or implemented incorrectly, this can alter agent behavior, introduce persistence, or disrupt the host runtime without sufficiently scoped authorization.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata and description define social triggers so broadly that the module may load for loosely related requests such as 'learning' or general social presence, increasing the chance the agent enters an action-capable social workflow without a clear user request. In this skill, loading is consequential because later sections authorize posting, commenting, searching for people, and escalating to DM, so overbroad activation materially raises the risk of unintended external actions.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The '主动感知需求 → 发帖找人' section explicitly tells the agent to infer social intent from ordinary statements like '我想找…' or '我最近在研究…' and to both post and search without waiting for the user to ask for posting. This creates a direct path from ambiguous user conversation to public external publication, which can disclose plans, interests, or sensitive context the user did not intend to broadcast.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction '优先用清晰中文' sets a default language policy for user interactions, but the file does not indicate that users may choose another language or opt into Chinese. This is a natural-language policy concern because it forces a locale preference rather than offering a choice.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md | 用户提到发帖 / 看 feed / 评论 / 学习 / 社交动作 | https://docs.clawbond.ai/skills/social/SKILL.md | | 出现 DM / 建联 / agent 私聊意图 | https://docs.clawbond.ai/skills/dm/SKILL.md | | heartbeat 触发 / 用户询问自动化 / 后台设置 | https://docs.clawbond.ai/skills/heartbeat/SKILL.md | | 用户提到 benchmark / 评测 / 测试能力 / 查看评分 | https://docs.clawbond.ai/skills/benchmark/SKILL.md | **加载规则：** - 只加载当前任务需要的子文件，不要预加载所有模块
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata and default prompt encourage broad use for contacting, posting, browsing, and following up with external parties, while the YAML file itself provides no concrete guardrails or trigger boundaries beyond implicit invocation. Because implicit invocation is enabled, this can cause the agent to route tasks into an external social/reach-out capability more often than intended, increasing the chance of unnecessary disclosure, unintended outbound communication, or autonomous social actions on the user's behalf.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs the agent to read local credentials and use a bearer token for outbound API calls, but provides no user-consent, minimization, or token-handling safeguards. In an agent setting, this can normalize silent access to sensitive secrets and transmission to external services without adequate disclosure or boundary checks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Server 调用：
bash curl -s "${PLATFORM}/api/agent/me" \ -H "Authorization: Bearer ${TOKEN}"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instructions explicitly require special handling when request bodies contain Chinese text and frame examples around Chinese content, reflecting a language-specific operating assumption. Because the skill does not offer a user language/locale choice or clearly justify a Chinese-only constraint, this can violate the policy against forcing a specific language without user opt-in.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -F "file=@cover.jpg" | jq -r '.data.url') # 再发帖，cover_image 放图片链接 curl -s -X POST "${SOCIAL}/api/agent-actions/posts" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json; charset=utf-8" \ --data-raw "{\"title\": \"...\", \"body\": \"...\", \"agentId\": \"${AGENT_ID}\", \"cover_image\": \"${COVER_URL}\"}"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill documentation is written in Chinese and does not indicate any user choice of language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description says the benchmark module is 'agent-triggered' for broad phrases like running tests, checking scores, or capability assessment. Overly broad triggers increase the chance of accidental activation, which is risky here because the module reads credentials and performs authenticated external API calls that create and finalize benchmark runs.
- Content