Security audit

Clawping Publish

Security checks for vulnerabilities and agentic risk

Overview

This ClawBond skill is coherent with social automation, but it needs review because it can post, DM, create connection requests, run background checks, and retain private DM history indefinitely.

Install only if you want ClawBond to act socially on your behalf. Before using it, set conservative automation preferences, prefer draft or ask-first behavior for posts and DMs, avoid full-auto connection requests unless you understand the handoff risk, enable heartbeat only deliberately, and periodically inspect or delete local ~/.clawbond DM history and credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill explicitly allows full-auto creation of connection requests without a second user confirmation. Because a connection request initiates a human handoff, this can disclose relationship intent, context, and potentially sensitive collaboration details to external parties on the user's behalf. In a social/outreach skill, this behavior is especially risky because the action is externally visible and can have reputational and privacy consequences even if the initial DM flow was user-authorized.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The init/binding module extends beyond account binding into installing plugins and modifying external runtime configuration (`openclaw.json`). That creates an unnecessary trust expansion: a social-platform binding skill is being authorized to alter host runtime behavior, which can change future event routing, persistence locations, and connectivity outside the narrow binding task. This is more dangerous because the instructions explicitly direct editing a local config file and enabling a channel, which is a privileged local action not strictly required for initial binding.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file presents itself as an initialization/compatibility module, but the documented flow continues into persona generation, platform onboarding, heartbeat enablement, plugin installation guidance, and runtime integration. This scope creep increases the chance that an apparently routine binding step performs materially broader actions than the user expects, including persistent automation setup and local environment changes. In security terms, misleading module boundaries reduce informed consent and make risky side effects easier to hide.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill metadata says posting, commenting, and DM actions require user awareness, but this section authorizes autonomous publishing unless the user explicitly says draft-only. That creates a clear consent mismatch: the agent may publicly disclose user interests, plans, or needs on an external platform without contemporaneous confirmation, which is especially risky in a social skill designed to broadcast and contact others.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger rules are intentionally expansive and include vague social-intent phrases such as '认识', '打听', 'ask around', and 'see who's active', which can cause the skill to activate when the user did not explicitly request external outreach. In this skill's context, activation enables authenticated social actions on behalf of a bound user and access to notifications/DM workflows, so accidental invocation can lead to unwanted external contact, privacy exposure, or reputational harm.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs the agent to read a local access token from credentials.json and transmit it to a remote service in an Authorization header, but does not require an explicit user-facing notice or consent step at the time of use. In an agent environment, silent credential use against an external endpoint increases the risk of unintended authenticated actions and reduces transparency around data transmission.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill mandates permanent, unbounded retention of all DM history in local JSONL files, including sent and received message contents. This creates a significant privacy and security risk: sensitive personal, professional, or confidential conversation data accumulates indefinitely, increasing blast radius if the host is compromised or shared, and users are not given retention controls or clear notice. In a DM/social skill, the stored data is likely to be highly sensitive, making the context more dangerous.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs use of a Bearer token to fetch bound-user profile data and then persist it locally into persona.md, but it does not include safeguards for token handling, least-privilege storage, redaction, or user-facing consent around local caching of profile data. In a skill that explicitly stores credentials and local state on disk, this increases the chance of sensitive token exposure or unnecessary retention of personal data if the agent home is readable by other processes or users.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill writes credential and state files to the local filesystem, including sensitive tokens and identity metadata, without a clear user-facing disclosure at the point of action. Even if local persistence is operationally necessary, silently creating and populating these files can expose secrets to other local processes, backups, or users and violates the principle of explicit consent for sensitive persistence.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The module transmits agent names, connector tokens, profile data, and refresh secrets to backend services, but the user-facing content does not clearly warn that this data will be sent off-host and used for account binding/profile retrieval. Because these values are identity- and auth-related, missing disclosure weakens informed consent and could cause users to reveal tokens they would not otherwise share.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger description is extremely broad, covering vague social goals like '露面', '破冰', or any task that might benefit from external people or information. Overbroad activation can cause the skill to engage in external social actions in contexts where the user only wanted advice or internal analysis, increasing the chance of unintended outbound communication.

Vague Triggers

High

Confidence: 96% confidence
Finding: This section explicitly says the agent should infer unmet social needs and post to find people even when the user did not say 'help me post.' In a social platform context, that ambiguity is dangerous because it converts conversational intent into public action, potentially exposing personal goals, schedules, interests, or vulnerabilities to a broad audience.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill permits autonomous posting whenever the content seems clear, without requiring a warning about the privacy and reputational consequences of public disclosure. Because the skill uses persona and memory to compose posts on behalf of the user, it may reveal sensitive preferences, plans, associations, or behavioral patterns that the user did not intend to publish.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Automatically escalating from a public comment to a DM without asking the user removes an important consent boundary between public engagement and private outreach. That can create harassment, privacy, and impersonation risks, especially because DM behavior may be perceived as more invasive and can expose the user's interests or intent to specific individuals.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The file requires logging every sent and received DM locally, immediately, with no retention limit and with failure modes that silently continue operation. This creates a broad local surveillance/archive of conversations that may include personal data, business-sensitive details, and relationship graphs, while offering neither minimization nor user-facing controls. In a messaging skill, comprehensive perpetual logging materially increases privacy exposure and compromise impact.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: dm/SKILL.md:210

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: social/SKILL.md:26