ClawDNA -- Identity Backup & Sync

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:02 PM UTC
• Version: 1.0.1

Overview

The skill is coherent as an identity backup helper, but it asks users to install and trust an unpinned external CLI that handles sensitive agent identity files and sync tokens.

Review the ClawDNA CLI source and package provenance before installing, pin a known-good version if available, avoid installing it with sudo, and be careful before enabling daemon auto-push or syncing identity files that may contain private user or agent context.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:27

Finding

Unpinned Third-Party Package Installed Globally

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 27-31
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

The user's machine needs the ClawDNA CLI installed:

```bash
npm install -g clawdna
clawdna init

text

### Technical Analysis

The documented installation command retrieves the latest available `clawdna` package from the configured npm registry without pinning an audited version or verifying package integrity or provenance. The audited project contains only documentation, so the installed CLI implementation and its npm lifecycle scripts could not be reviewed.

A global npm installation may execute package lifecycle scripts with the permissions of the invoking user. The subsequent `clawdna init` command also executes code from that externally supplied package. Although the documentation links to a source repository, it provides no cryptographic mechanism proving that the registry artifact corresponds to a reviewed source commit.

This creates a supply-chain exposure: compromise of the package publisher, registry account, distribution channel, or a future package release could cause users following these instructions to execute unauthorized code.

### Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a future release of `clawdna`.
2. The attacker publishes a malicious package version containing a lifecycle script or malicious initialization behavior.
3. A user follows the documented `npm install -g clawdna` instruction, which resolves to that latest malicious version.
4. npm executes applicable package lifecycle scripts during installation under the user's account.
5. The user runs `clawdna init`, providing a second opportunity for the compromised package to execute.
6. Malicious code can access resources available to that user, potentially including identity files, confi
...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to a specific reviewed package version, for example:

   bash

   npm install -g clawdna@1.0.0
   

2. Publish and document integrity hashes, signed provenance, or npm provenance attestations that bind the package artifact to a reviewed source commit.
3. Prefer a project-local installation with a committed lockfile over a global installation where operationally feasible.
4. Explicitly identify the expected package publisher, registry, and package scope so users can detect dependency-confusion or package-substitution attempts.
5. Audit npm lifecycle scripts and minimize or disable them where possible. For verification workflows, consider installing with --ignore-scripts before inspecting the package.
6. Document that installation should not be performed with sudo or another privileged account.
7. Include the CLI implementation in the auditable artifact, or reference an immutable release commit and reproducible build process, so its secret sanitization and file-handling claims can be independently verified.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md

### Doctor reports permission warnings

Config files should be `600` (owner read/write only) and snapshot directories should be `700`.

**Fix:** Run `chmod 600 ~/.clawdna/config.json` and `chmod 700 ~/.clawdna/snapshots/`.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

Config files should be `600` (owner read/write only) and snapshot directories should be `700`.

**Fix:** Run `chmod 600 ~/.clawdna/config.json` and `chmod 700 ~/.clawdna/snapshots/`.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

Config files should be `600` (owner read/write only) and snapshot directories should be `700`.

**Fix:** Run `chmod 600 ~/.clawdna/config.json` and `chmod 700 ~/.clawdna/snapshots/`.

Static analysis

No suspicious patterns detected.