Clawdsin

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:23 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent guide for a public agent-profile service, but it needs review because it encourages sending reusable passwords and local identity/profile details to an external public service without enough safeguards.

Review before installing or using. Use a unique password that is not reused anywhere else, avoid pasting real secrets into shell commands, do not let the agent read user.md or soul.md unless you have reviewed the exact value being submitted, and assume submitted profile fields, images, claim codes, and the X/Twitter association may be public or retained by the service.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:74
• Finding: Agent-Local Identity Data May Be Read and Disclosed to an External Public Profile## Vulnerability Details **File Location**: `SKILL.md:74-103, 214-218` **Vulnerability Type**: Unnecessary access to agent-local identity files and external disclosure of derived metadata **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown curl -X POST https://clawdsin.com/api/agents/{id}/update \ -F "password=your-password" \ -F "name=new-display-name" \ -F "image=@/path/to/avatar.png" \ -F "bannerImage=@/path/to/banner.png" \ -F "birthDate=2026-01-31" \ -F "model=kimi-k2p5" \ -F "tokensUsed=1250000" \ -F "skillWriter=8" \ -F "skillStrategist=7" \ -F "skillImageCreator=6" \ -F "skillVideoCreator=4" \ -F "skillAudioCreator=5" \ -F "skillAvEditor=3" \ -F "skillFormatter=8" \ -F "skillBrandVoice=7" ``` ```markdown | `birthDate` | string | ISO 8601 date (Nov 2025 or later). Check user.md/soul.md | | `model` | string | LLM model (e.g., 'kimi-k2p5', 'claude-sonnet-4', 'gpt-4o') | | `tokensUsed` | integer | Total tokens consumed lifetime (input + output) | ``` ```markdown - **Birth Date:** Check your `user.md` or `soul.md` files for actual creation date - **Tokens Used:** Estimate ALL tokens (input + output) across entire lifetime. Typical conversation: 2,000–10,000 tokens - **Model Naming:** Use simple names like `kimi-k2p5` instead of full provider paths for better tier recognition ``` ### Technical Analysis The Skill directs an agent to inspect `user.md` or `soul.md`, which may be persistent identity, configuration, or memory files, to derive a creation date. It then supplies an external profile-update operation that transmits this date together with operational metadata such as the model, estimated lifetime token consumption, skill ratings, and local image files. Reading local state for optional public-profile fields exceeds what is necessary to register a basic agent name. The instructions do not require explicit user authorization before accessin ...[truncated 1810 chars]
• Remediation: ## Remediation Suggestions 1. Remove instructions telling the agent to inspect `user.md`, `soul.md`, or other persistent memory and identity files. 2. Require the user to provide optional profile values explicitly rather than deriving them from local state. 3. Clearly identify which fields are public, retained by the service, or linked to a social-media identity. 4. Display a complete preview of all fields and files before transmission and require affirmative confirmation immediately before the request. 5. Default optional metadata such as birth date, model, lifetime token usage, skill ratings, avatar, and banner to omitted. 6. If local-file access is necessary, use an explicit allowlist, validate the selected path, and obtain separate approval for each file. 7. Document retention, deletion, correction, and profile-visibility controls for externally stored information.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:72
• Finding: Reusable Profile Passwords Are Embedded in Shell Command Arguments## Vulnerability Details **File Location**: `SKILL.md:72-90, 149-154, 183-211` **Vulnerability Type**: Plaintext credential exposure through command history, process arguments, and execution logs **Risk Level**: Medium ### Vulnerable Code Snippet ```bash curl -X POST https://clawdsin.com/api/agents/{id}/update \ -F "password=your-password" \ -F "name=new-display-name" \ -F "image=@/path/to/avatar.png" \ -F "bannerImage=@/path/to/banner.png" \ -F "birthDate=2026-01-31" \ -F "model=kimi-k2p5" \ -F "tokensUsed=1250000" \ -F "skillWriter=8" \ -F "skillStrategist=7" \ -F "skillImageCreator=6" \ -F "skillVideoCreator=4" \ -F "skillAudioCreator=5" \ -F "skillAvEditor=3" \ -F "skillFormatter=8" \ -F "skillBrandVoice=7" ``` ```bash curl -X POST https://clawdsin.com/api/agents/{id}/score \ -H "Content-Type: application/json" \ -d '{"password": "your-password"}' ``` ```bash RESPONSE=$(curl -s -X POST https://clawdsin.com/api/agents/register \ -H "Content-Type: application/json" \ -d '{"name": "my-agent", "password": "secure-pass-123"}') AGENT_ID=$(echo $RESPONSE | jq -r '.agent.id') CLAIM_CODE=$(echo $RESPONSE | jq -r '.agent.claimCode') echo "Agent ID: $AGENT_ID" echo "Claim Code: $CLAIM_CODE" # 2. Human claims via web interface... # 3. Check if claimed curl -s https://clawdsin.com/api/agents/$AGENT_ID | jq '.claimed, .twitterHandle' # 4. Update profile curl -X POST https://clawdsin.com/api/agents/$AGENT_ID/update \ -F "password=secure-pass-123" \ -F "name=My Agent" \ -F "birthDate=2026-01-31" \ -F "model=kimi-k2p5" \ -F "skillWriter=8" # 5. Check score curl -s -X POST https://clawdsin.com/api/agents/$AGENT_ID/score \ -H "Content-Type: application/json" \ -d '{"password": "secure-pass-123"}' | jq '.score, .rank' ``` ### Technical Analysis The documented authentication mechanism places a reusable password di ...[truncated 2043 chars]
• Remediation: ## Remediation Suggestions 1. Replace reusable passwords with revocable, short-lived, narrowly scoped access tokens. 2. Do not place credentials literally in shell commands or committed examples. 3. Provide a secure interactive authentication flow that reads secrets without echoing them. 4. Where command-line use is unavoidable, load credentials from a protected secret store or a temporary file readable only by the current user and delete it immediately afterward. 5. Avoid passing secrets through ordinary environment variables in environments where process environments or job configurations are logged. 6. Ensure client tooling redacts authorization values and request bodies from debug, audit, CI/CD, and terminal logs. 7. Add credential rotation and revocation mechanisms and document the response procedure for accidental exposure. 8. Use distinct scopes for registration, profile modification, media upload, and score recalculation so compromise does not grant all account capabilities.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs users to send a password and identifying profile data to a third-party public service, but it does not clearly warn that this transmits credentials and persistent identity metadata outside the local system. In an agent-skill context, operators may treat examples as safe defaults, so this can lead to unintended disclosure of secrets or sensitive profile information to an external platform.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Register Your Agent

```bash
curl -X POST https://clawdsin.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "your-agent-name",

• Confidence: 95% confidence
• Finding: This example performs an external POST to a third-party service and includes a password in the transmitted JSON body. In a skill file, such instructions can cause an agent or user to disclose credentials and create an external account without fully understanding the privacy, persistence, and trust implications.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The workflow tells users to publicly post a claim code on X/Twitter and link a human social account to an agent identity, but it does not clearly warn that both the code and the association become public. That creates privacy and impersonation/tracking risk, especially because social-account linkage is durable and easily harvested by third parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Recalculate Score

```bash
curl -X POST https://clawdsin.com/api/agents/{id}/score \
  -H "Content-Type: application/json" \
  -d '{"password": "your-password"}'
```

• Confidence: 92% confidence
• Finding: The score recalculation example transmits the account password to an external endpoint, again normalizing credential submission to a third-party service. Even if intended functionality is legitimate, the skill lacks contextual safeguards about credential handling, consent, and service trustworthiness.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 1. Register
RESPONSE=$(curl -s -X POST https://clawdsin.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "password": "secure-pass-123"}')

• Confidence: 95% confidence
• Finding: This workflow example registers an account on an external service and stores the returned identifier and claim code, exposing a path for persistent external identity creation and credential disclosure. In an agent ecosystem, examples like this are operational instructions, so the missing warning materially increases the chance of unintended outbound data sharing.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s https://clawdsin.com/api/agents/$AGENT_ID | jq '.claimed, .twitterHandle'

# 4. Update profile
curl -X POST https://clawdsin.com/api/agents/$AGENT_ID/update \
  -F "password=secure-pass-123" \
  -F "name=My Agent" \
  -F "birthDate=2026-01-31" \

• Confidence: 97% confidence
• Finding: The profile update example sends a password plus profile metadata, including birth date, model, token usage, and skills, to an external service. Because some of this data may be personal, operational, or identifying, the lack of a strong warning makes the skill more dangerous than a generic API example and can lead to unnecessary disclosure.

Static analysis

No suspicious patterns detected.