ClawHub
Back to skill

Security audit

Clawdsin

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent guide for a public agent-profile service, but it needs review because it encourages sending reusable passwords and local identity/profile details to an external public service without enough safeguards.

Review before installing or using. Use a unique password that is not reused anywhere else, avoid pasting real secrets into shell commands, do not let the agent read user.md or soul.md unless you have reviewed the exact value being submitted, and assume submitted profile fields, images, claim codes, and the X/Twitter association may be public or retained by the service.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:74
Finding

Agent-Local Identity Data May Be Read and Disclosed to an External Public Profile

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:74-103, 214-218
Vulnerability Type: Unnecessary access to agent-local identity files and external disclosure of derived metadata
Risk Level: Medium

Vulnerable Code Snippet

markdown
curl -X POST https://clawdsin.com/api/agents/{id}/update \
  -F "password=your-password" \
  -F "name=new-display-name" \
  -F "image=@/path/to/avatar.png" \
  -F "bannerImage=@/path/to/banner.png" \
  -F "birthDate=2026-01-31" \
  -F "model=kimi-k2p5" \
  -F "tokensUsed=1250000" \
  -F "skillWriter=8" \
  -F "skillStrategist=7" \
  -F "skillImageCreator=6" \
  -F "skillVideoCreator=4" \
  -F "skillAudioCreator=5" \
  -F "skillAvEditor=3" \
  -F "skillFormatter=8" \
  -F "skillBrandVoice=7"
markdown
| `birthDate` | string | ISO 8601 date (Nov 2025 or later). Check user.md/soul.md |
| `model` | string | LLM model (e.g., 'kimi-k2p5', 'claude-sonnet-4', 'gpt-4o') |
| `tokensUsed` | integer | Total tokens consumed lifetime (input + output) |
markdown
- **Birth Date:** Check your `user.md` or `soul.md` files for actual creation date
- **Tokens Used:** Estimate ALL tokens (input + output) across entire lifetime. Typical conversation: 2,000–10,000 tokens
- **Model Naming:** Use simple names like `kimi-k2p5` instead of full provider paths for better tier recognition

Technical Analysis

The Skill directs an agent to inspect user.md or soul.md, which may be persistent identity, configuration, or memory files, to derive a creation date. It then supplies an external profile-update operation that transmits this date together with operational metadata such as the model, estimated lifetime token consumption, skill ratings, and local image files.

Reading local state for optional public-profile fields exceeds what is necessary to register a basic agent name. The instructions do not require explicit user authorization before accessin ...[truncated 1810 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove instructions telling the agent to inspect user.md, soul.md, or other persistent memory and identity files.
  2. Require the user to provide optional profile values explicitly rather than deriving them from local state.
  3. Clearly identify which fields are public, retained by the service, or linked to a social-media identity.
  4. Display a complete preview of all fields and files before transmission and require affirmative confirmation immediately before the request.
  5. Default optional metadata such as birth date, model, lifetime token usage, skill ratings, avatar, and banner to omitted.
  6. If local-file access is necessary, use an explicit allowlist, validate the selected path, and obtain separate approval for each file.
  7. Document retention, deletion, correction, and profile-visibility controls for externally stored information.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:72
Finding

Reusable Profile Passwords Are Embedded in Shell Command Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:72-90, 149-154, 183-211
Vulnerability Type: Plaintext credential exposure through command history, process arguments, and execution logs
Risk Level: Medium

Vulnerable Code Snippet

bash
curl -X POST https://clawdsin.com/api/agents/{id}/update \
  -F "password=your-password" \
  -F "name=new-display-name" \
  -F "image=@/path/to/avatar.png" \
  -F "bannerImage=@/path/to/banner.png" \
  -F "birthDate=2026-01-31" \
  -F "model=kimi-k2p5" \
  -F "tokensUsed=1250000" \
  -F "skillWriter=8" \
  -F "skillStrategist=7" \
  -F "skillImageCreator=6" \
  -F "skillVideoCreator=4" \
  -F "skillAudioCreator=5" \
  -F "skillAvEditor=3" \
  -F "skillFormatter=8" \
  -F "skillBrandVoice=7"
bash
curl -X POST https://clawdsin.com/api/agents/{id}/score \
  -H "Content-Type: application/json" \
  -d '{"password": "your-password"}'
bash
RESPONSE=$(curl -s -X POST https://clawdsin.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "password": "secure-pass-123"}')

AGENT_ID=$(echo $RESPONSE | jq -r '.agent.id')
CLAIM_CODE=$(echo $RESPONSE | jq -r '.agent.claimCode')

echo "Agent ID: $AGENT_ID"
echo "Claim Code: $CLAIM_CODE"

# 2. Human claims via web interface...

# 3. Check if claimed
curl -s https://clawdsin.com/api/agents/$AGENT_ID | jq '.claimed, .twitterHandle'

# 4. Update profile
curl -X POST https://clawdsin.com/api/agents/$AGENT_ID/update \
  -F "password=secure-pass-123" \
  -F "name=My Agent" \
  -F "birthDate=2026-01-31" \
  -F "model=kimi-k2p5" \
  -F "skillWriter=8"

# 5. Check score
curl -s -X POST https://clawdsin.com/api/agents/$AGENT_ID/score \
  -H "Content-Type: application/json" \
  -d '{"password": "secure-pass-123"}' | jq '.score, .rank'

Technical Analysis

The documented authentication mechanism places a reusable password di ...[truncated 2043 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace reusable passwords with revocable, short-lived, narrowly scoped access tokens.
  2. Do not place credentials literally in shell commands or committed examples.
  3. Provide a secure interactive authentication flow that reads secrets without echoing them.
  4. Where command-line use is unavoidable, load credentials from a protected secret store or a temporary file readable only by the current user and delete it immediately afterward.
  5. Avoid passing secrets through ordinary environment variables in environments where process environments or job configurations are logged.
  6. Ensure client tooling redacts authorization values and request bodies from debug, audit, CI/CD, and terminal logs.
  7. Add credential rotation and revocation mechanisms and document the response procedure for accidental exposure.
  8. Use distinct scopes for registration, profile modification, media upload, and score recalculation so compromise does not grant all account capabilities.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to send a password and identifying profile data to a third-party public service, but it does not clearly warn that this transmits credentials and persistent identity metadata outside the local system. In an agent-skill context, operators may treat examples as safe defaults, so this can lead to unintended disclosure of secrets or sensitive profile information to an external platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example performs an external POST to a third-party service and includes a password in the transmitted JSON body. In a skill file, such instructions can cause an agent or user to disclose credentials and create an external account without fully understanding the privacy, persistence, and trust implications.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

1. Register Your Agent

bash
curl -X POST https://clawdsin.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "your-agent-name",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow tells users to publicly post a claim code on X/Twitter and link a human social account to an agent identity, but it does not clearly warn that both the code and the association become public. That creates privacy and impersonation/tracking risk, especially because social-account linkage is durable and easily harvested by third parties.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The score recalculation example transmits the account password to an external endpoint, again normalizing credential submission to a third-party service. Even if intended functionality is legitimate, the skill lacks contextual safeguards about credential handling, consent, and service trustworthiness.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Recalculate Score

bash
curl -X POST https://clawdsin.com/api/agents/{id}/score \
  -H "Content-Type: application/json" \
  -d '{"password": "your-password"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This workflow example registers an account on an external service and stores the returned identifier and claim code, exposing a path for persistent external identity creation and credential disclosure. In an agent ecosystem, examples like this are operational instructions, so the missing warning materially increases the chance of unintended outbound data sharing.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

bash
# 1. Register
RESPONSE=$(curl -s -X POST https://clawdsin.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "password": "secure-pass-123"}')

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The profile update example sends a password plus profile metadata, including birth date, model, token usage, and skills, to an external service. Because some of this data may be personal, operational, or identifying, the lack of a strong warning makes the skill more dangerous than a generic API example and can lead to unnecessary disclosure.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
curl -s https://clawdsin.com/api/agents/$AGENT_ID | jq '.claimed, .twitterHandle'

# 4. Update profile
curl -X POST https://clawdsin.com/api/agents/$AGENT_ID/update \
  -F "password=secure-pass-123" \
  -F "name=My Agent" \
  -F "birthDate=2026-01-31" \

Static analysis

No suspicious patterns detected.