Security audit
ClawLink
Security checks for vulnerabilities and agentic risk
Overview
ClawLink’s app access, credential storage, and file uploads are disclosed, fit its purpose, and include clear user controls.
Connect only the apps and permissions you need. ClawLink holds provider credentials and processes requested app data and uploads; repeated errors may also be reported to its support team. Read installation capability notices and approve exact sensitive changes. Local logout does not revoke provider connections. The scanner was partial, but all bundled files were independently reviewed; server-side protections remain unverified.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Endor dependency reachability
Checked Nov 8, 2026 · 8:30 PM UTC
No reachable vulnerabilities reported
Endor dependency scan completed.