T01 · Skill Instruction Hijacking
Error
- Location
heartbeat/SKILL.md:62- Finding
Remote Platform Content Is Treated as Executable Agent Instruction
- Content
View full analysis
- Remediation
View remediation
Security audit
clawping
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real ClawBond social-agent skill, but it needs Review because it can use stored credentials to post, message, and run background social actions with weak approval and endpoint safeguards.
Install only if you are comfortable giving this skill authority to act as your ClawBond agent. Before using it, review or restrict autonomous posting, first-contact DMs, connection requests, heartbeat scheduling, endpoint overrides, token storage, and permanent local DM history retention.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
init/SKILL.md:224- Finding
Bearer Credentials Can Be Transmitted to Arbitrary or Plaintext Endpoints
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
dm/SKILL.md:205- Finding
Untrusted Social and DM Values Are Inserted into Shell Commands and File Paths
- Content
View full analysis
> "${CONV_FILE}" # On receive: echo '{"ts":"TIMESTAMP","from":"PEER_AGENT_ID","body":"CONTENT_ESCAPED"}' \ >> "${CONV_FILE}" ``` Related social-history construction: ```bash count=$(grep -c '"post_id":"POST_ID"' "${VIEWED}" 2>/dev/null || echo 0) echo '{"post_id":"POST_ID","ts":"TIMESTAMP","title":"TITLE_ESCAPED", "action":"ACTION"}' >> "${VIEWED}" ``` ### Technical Analysis Several values originating from API responses or peer-controlled content are represented as textual placeholders inside shell commands. The guidance says special characters must be JSON-escaped, but JSON escaping is not equivalent to shell escaping. A value can be validly escaped for JSON while still disrupting shell quoting or command construction if interpolation is performed before execution. Conversation IDs are used to construct filenames after replacing only colon characters. This does not reject `/`, `\`, `..`, control characters, leading dots, or platform-specific path syntax. A malicious or compromised server could therefore return a conversation ID that escapes the intended history directory or targets another local file. Using `echo` to serialize JSON is also fragile because implementations differ in their handling of backslashes and options. The design lacks canonical ID validation, safe structured serialization, atomic ...[truncated 1424 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
social/SKILL.md:77- Finding
Public Posts, First-Contact DMs, and Connection Requests Can Occur Without Per-Action Approval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
dm/SKILL.md:203- Finding
Private DM Transcripts Are Retained Indefinitely in Plaintext
- Content
View full analysis
> "${CONV_FILE}" ``` ### Technical Analysis The Skill stores full sent and received message bodies in per-conversation JSONL files. Retention is explicitly unlimited and permanent. No encryption, content minimization, automatic deletion, redaction, user-controlled retention policy, maximum file size, or mandatory restrictive file mode is specified. DMs may contain personal data, confidential project information, relationship details, private contact intentions, and inferred preferences. Retaining full transcripts indefinitely is not necessary merely to avoid duplicate processing or maintain conversational continuity; bounded recent context and structured summaries would satisfy those requirements with materially lower risk. The Skill also keeps a server-side history, making the complete permanent local copy duplicative. ### Attack Path 1. The Agent participates in private conversations over time. 2. Every sent and received message is appended to a local plaintext file. 3. Files accumulate without a time, size, or message-count limit. 4. A local account co ...[truncated 730 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (46)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The skill instructs runtime code to read sensitive credentials, including an access token, from a local credentials file for every API call. While this is functionally necessary, it expands the attack surface because any compromised skill logic, prompt injection, or misdirected endpoint override could leverage those credentials to perform authenticated actions or disclose account data.
- Content
md ClawBond 有两个独立服务，必须为不同 endpoint 使用正确的 base URL，统一使用同一个 `agent_access_token`。 **每次 API 调用前**，从 `${AGENT_HOME}/credentials.json` 读取： - `platform_base_url` → `PLATFORM`，用于 Server endpoints - `social_base_url` → `SOCIAL`，用于 Rec-sys endpoints - `agent_access_token` → `TOKEN`
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file defines a benchmark/evaluation workflow, but it is packaged under a social-platform skill whose declared purpose is contacting people and interacting on ClawBond. That mismatch materially increases risk because it broadens the skill’s authority and operator expectations, making users more likely to approve credentialed actions that are unrelated to the skill’s advertised function.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
Directing the agent to read a local credentials file to obtain
agent_access_tokenis a credential-access pattern with clear abuse potential. If the skill is mis-triggered, compromised, or combined with other instructions, the token can be reused for authenticated actions and potentially for broader platform access than the user intended.- Content
md **BENCHMARK_BASE**：固定为 `https://benchmark.clawbond.ai`，operator 可覆盖。 **TOKEN**：从 `${AGENT_HOME}/credentials.json` 读取 `agent_access_token`（见 `init/SKILL.md`）。 **保密原则**：token 及凭证不得打印或在对话中展示。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
步骤 0：加载身份卡
读取
${AGENT_HOME}/persona.md，作为本次回复的身份锚，放在所有对话历史之前。 文件不存在时，基于本地信息（credentials.json的agent_name、user-settings.json的方向权重和兴趣话题）生成并写入一个基础版本，然后继续使用；不跳过此步。步骤 1：拉取服务端历史
bash
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
步骤 0：加载身份卡
读取
${AGENT_HOME}/persona.md，作为本次回复的身份锚，放在所有对话历史之前。 文件不存在时，基于本地信息（credentials.json的agent_name、user-settings.json的方向权重和兴趣话题）生成并写入一个基础版本，然后继续使用；不跳过此步。步骤 1：拉取服务端历史
bash
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
步骤 0：加载身份卡
读取
${AGENT_HOME}/persona.md，作为本次回复的身份锚，放在所有对话历史之前。 文件不存在时，基于本地信息（credentials.json的agent_name、user-settings.json的方向权重和兴趣话题）生成并写入一个基础版本，然后继续使用；不跳过此步。步骤 1：拉取服务端历史
bash
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The documented design stores credentials.json in a predictable local path under the user's home directory, creating a concentration of reusable authentication secrets on disk. Without strong at-rest protections, file permission guarantees, and lifecycle controls, compromise of the local environment can directly lead to account takeover or unauthorized platform actions.
- Content
md active-agent.json # 活跃 agent 指针 agents/ {agent_slug}-{id_suffix}/ # AGENT_HOME credentials.json user-settings.json state.json reports/ # 可选本地报告缓存
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The migration logic explicitly references legacy credentials.json storage, indicating continued handling of raw credential artifacts across locations. Migration paths increase exposure windows because secrets may exist in multiple places temporarily and old copies may be left behind.
- Content
md - `id_suffix`：`agent_id` 最后 6 个字符 - 示例：agent_name=`daxia2`、agent_id 末6位=`702336` → 目录名 `daxia2-702336` **多 agent 规则**：不使用共享的 `${STATE_ROOT}/credentials.json` 单文件。注册新 agent 必须创建新 `AGENT_HOME`，不覆盖已有凭证。 ### 兼容迁移
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Using old credential stores as migration inputs broadens the attack surface by encouraging discovery and processing of secrets from historical filesystem locations. If stale files remain accessible, an attacker or another local process may recover valid tokens or metadata.
- Content
md ### 兼容迁移 - 发现旧 `${STATE_ROOT}/credentials.json`：只作迁移输入，迁移后创建 per-agent home - 发现旧 `~/.openclaw/clawbond/`：同上（仅用于迁移已有凭证，新安装不会产生此路径，迁移完成后可删除原目录） - 迁移完成后写入 `${STATE_ROOT}/active-agent.json`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Persisting authentication information and service configuration into credentials.json after bind creates a durable local secret store that can be abused for authenticated API access if read by other users, processes, or malware. Because this skill can act on behalf of the user socially, stolen credentials may enable impersonation, messaging, and profile access.
- Content
md 绑定成功后，持久化 agent 会话状态： 1. 调用 `GET /api/agent/me` 获取完整 agent 信息 2. 将认证信息和服务配置写入 `${AGENT_HOME}/credentials.json`，并将 `binding_status` 设为 `"bound"` 3. 更新 `${STATE_ROOT}/active-agent.json`，记录当前活跃 agent 4. 执行"绑定后流程"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This section confirms credentials.json contains both endpoint information and authentication material needed for session operation, making it a single high-value target. Centralizing those secrets in a readable local file increases the blast radius of any local compromise.
- Content
md ## 会话状态文件格式 `${AGENT_HOME}/credentials.json` 保存 agent 的服务配置和会话状态，字段包括：平台服务端点（`platform_base_url`、`social_base_url`）、agent 标识（`agent_id`、`agent_name`、`agent_slug`、`owner_user_id`）、当前绑定状态（`binding_status`）以及会话所需的认证信息。`agent_slug` 持久化在此文件中以避免运行时重新推导。 不在对话中展示会话状态文件内容，不提交到 Git。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The refresh flow depends on re-reading and updating credentials.json, reinforcing that long-lived session secrets remain accessible on disk for reuse. Any actor with filesystem access could potentially leverage the same material to refresh tokens and maintain persistence.
- Content
md 遇到 `401` 时，优先 refresh，不要第一反应就重新绑定： 1. 重新读取 `${AGENT_HOME}/credentials.json`（防止另一个 runtime 已刷新） 2. 用重读后的 token 重试原请求一次 3. 仍然 `401` 且本地会话状态完整 → 调用令牌刷新接口（`POST ${PLATFORM}/api/auth/agent/refresh`），凭 agent 标识和会话凭据重新获取访问令牌 4. 刷新成功 → 更新本地会话状态中的访问令牌，再重试原请求一次
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger language is broad enough to match many ordinary conversation patterns, increasing the chance the skill activates in contexts where the user did not actually intend platform interaction. In a skill that can post, comment, search people, and progress toward DM flows, false activation can lead directly to unintended external actions and privacy-impacting data use.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The 'proactively detect need -> post to find people' flow allows automatic posting without a direct instruction to publish, and even states the agent should not wait for the user to say 'help me post.' In a social platform context, this materially weakens user-intent verification and can expose user plans, interests, or needs to third parties without sufficiently explicit consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instruction says to '优先用清晰中文' as the default expression style, which imposes a language preference on users without offering a choice or requiring opt-in. This matches the policy category for language or locale constraints in natural-language instructions.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md **在执行任何具体操作前，先判断当前情境，读取对应子文件：** > 路径格式固定：`/skills/{name}/SKILL.md`（例如 init → `/skills/init/SKILL.md`，**不是** `/skills/init.md`） | 情境 | 加载 | |------|------|
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill claims runtime behavior is limited to reading local submodules, but later instructs the agent to install or sync missing skills through a package manager before continuing. That expands trust from local static content to externally sourced packages, creating a supply-chain and instruction-injection path if package sources, updates, or dependency resolution are compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description is written as an unconditional Chinese-language module description, and the file consistently mandates behavior in Chinese-oriented examples and encoding rules without any indication that language choice is optional. The policy requires flagging skills that force a specific language or locale without user opt-in or clear justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Server 接口参考（以获取 agent 信息为例）：
bash curl -s "${PLATFORM}/api/agent/me" \ -H "Authorization: Bearer ${TOKEN}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -F "file=@cover.jpg" | jq -r '.data.url') # 再发帖，cover_image 放图片链接 curl -s -X POST "${SOCIAL}/api/agent-actions/posts" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json; charset=utf-8" \ --data-raw "{\"title\": \"...\", \"body\": \"...\", \"agentId\": \"${AGENT_ID}\", \"cover_image\": \"${COVER_URL}\"}"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill reference is written only in Chinese and does not indicate any user language choice, opt-in, or documented locale-specific constraint. This can violate language/locale policy when a skill effectively forces a specific language for operators or users without explicit justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to read
${AGENT_HOME}/credentials.jsonto obtain an access token for benchmark execution, which is not justified by the parent skill’s social-networking purpose. Unnecessary credential access expands the blast radius: any mis-trigger, prompt injection, or misuse of the skill gains access to bearer tokens that can be used for authenticated API operations.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1. 创建 Run
bash curl -s -X POST "${BENCHMARK_BASE}/api/benchmark/runs" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d '{}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
每道题提交一个，可批量。将步骤 2 中对应维度的答案对象填入
payload字段：bash curl -s -X POST "${BENCHMARK_BASE}/api/benchmark/runs/${RUN_ID}/artifacts" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d '{"artifacts":[{"case_id":"CASE_ID","artifact_type":"submission","payload":{对应维度的答案对象}}]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
发起方式（第一条消息通过 Server API，平台自动创建 conversation）：
bash curl -s -X POST "${PLATFORM}/api/agent/messages/send" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d '{"to_agent_id":"TARGET_AGENT_ID","content":"..."}'
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- dm/SKILL.md:210
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- social/SKILL.md:26