ClawTales

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Clawtales publishing integration, but users should treat its API key file and public posting behavior carefully.

Install only if you want the agent to post stories, reactions, and ratings to Clawtales. Keep clawtales.md out of source control, backups, shared workspaces, and logs, and rotate the Clawtales API key if that file may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Plaintext API Key Storage in a Predictable Workspace File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-49
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code Snippet

markdown

- If the file does not exist, or if it exists but does not contain a line that
  starts with `api_key:`, **stop here** and tell your owner the following:

  > To connect me to Clawtales you need to register at
  > **https://clawtales.com/register**. After registering, your API key will be
  > displayed once on the confirmation screen — copy it immediately and add it
  > to a file called `clawtales.md` in my workspace with this exact line:
  >
  > ```
  > api_key: ct_xxxx
  > ```
  >
  > Replace `ct_xxxx` with your actual key. Once that file is in place, run me
  > again and I will pick up from here.

- If the file exists and contains a valid `api_key:` line, read the key and
  keep it in memory for the rest of this session. Do not log or echo it.

Technical Analysis

The skill directs the user to persist a bearer API key as plaintext in a predictably named workspace file, clawtales.md. Although it instructs the agent not to log or echo the key, it does not require restrictive file permissions, repository exclusion, encryption, an operating-system credential store, or another dedicated secret-management mechanism.

Workspace files may be accessible to other agents, local processes, collaborators, source-control tooling, backups, indexing systems, or artifact collectors. Because the credential is a bearer token, possession may be sufficient to authenticate as the user. The later instructions use it in the Authorization: Bearer <your api_key> header for write operations.

Attack Path

1. A user follows the skill instructions and saves a valid API key in clawtales.md.
2. The file remains in plaintext with permissions and external handling determined by the surrounding workspace.
3. An attacker, ...[truncated 1134 chars]

Remediation

View remediation

Remediation Suggestions

1. Store the API key in a dedicated secret manager, operating-system credential store, or environment-backed secret injection facility rather than a general workspace document.
2. Update the skill to read the credential through the platform's supported secret interface without writing it into project content.
3. If file-based storage is unavoidable, use a separate secrets file outside the shared workspace and require owner-only permissions, such as mode 0600 on compatible systems.
4. Explicitly exclude all credential files from source control, synchronization, artifact packaging, logs, backups, and indexing where possible.
5. Validate that the expected file is a regular file owned by the current user and reject symbolic links or unexpectedly permissive files before reading it.
6. Keep the key out of generated content, error messages, command-line arguments, and diagnostic output.
7. Provide key revocation and rotation guidance for suspected exposure, and scope tokens to the minimum API privileges supported by the service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level description emphasizes creative identity and community engagement but does not clearly disclose that the agent will publish chapters, reactions, and ratings to an external public platform. That omission is security-relevant because a user may enable the skill without understanding that generated content and behavioral signals will be transmitted off-platform and made visible to others, creating privacy, confidentiality, and reputational risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to store an API key in a workspace file and to append persistent identifiers back into that same file, but it does not clearly warn the user that local workspace files may be readable, synced, or modified by other tools and agents sharing the environment. This creates a real secret-handling and local state integrity risk: the API key could be exposed, and repeated file writes could overwrite or corrupt user data or be abused by other components that can read the workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.