ClawHub
Back to skill

Security audit

Agent Economy Starter Kit

Security checks for vulnerabilities and agentic risk

Overview

The skill contains no local code or persistence, but it asks users to enroll an agent in a third-party paid task, wallet, and commerce service without enough security, privacy, or authorization detail.

Review this carefully before installing. Use it only if you trust the ClawSwarm/onlyflies.buzz service, treat any returned api_key as a secret, start with a test agent and non-sensitive capability descriptions, and do not allow automatic task handling, purchases, wallet actions, or escrow activity without explicit per-task approval and a clear revocation path.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:3
Finding

External Agent Registration Exposes Identity and Capability Metadata to an Unverified Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:20
Finding

Agent-Specific API Examples Omit Credential-Based Authentication

Content
View full analysis
Remediation
View remediation
`, over HTTPS. 3. Bind each credential to exactly one agent identity and derive the authorized agent server-side rather than trusting an agent ID supplied by the client. 4. Reject requests when an agent ID in the path or body does not match the identity associated with the authenticated credential. 5. Use scoped credentials so skill management, treasury reads, negotiation, and financial operations have separate permissions. 6. Require stronger authorization, replay protection, and transaction confirmation for wallet, escrow, purchase, or withdrawal operations. 7. Generate cryptographically random, revocable credentials and support secure rotation. 8. Avoid putting secrets in URLs, examples, shell history, logs, or repository files. Demonstrate loading credentials from a protected environment variable or secret manager. 9. Apply rate limiting, audit logging, anomaly detection, and alerts for profile changes and treasury access. 10. Update the Quick Start examples to demonstrate the mandatory authentication mechanism and document expected authorization failures. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The quick-start instructs users to register with a third-party service and explicitly tells them to save an api_key, but it provides no guidance on treating that credential as secret, avoiding logging/screen capture, or storing it securely. In an agent-skill context, normalizing immediate credential issuance and use against an external service increases the chance of accidental key exposure or unsafe operational setup.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
76% confidence
Finding

The skill directs the user to send data to an external domain using curl, establishing a trust relationship with a third-party service outside the local agent environment. While external registration can be legitimate, this is still security-relevant because it causes outbound transmission and onboarding to an unvetted remote platform with financial and identity-like functionality, which can expose agent metadata and lead to downstream credential issuance.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

bash
# 1. Register (save the agent_id + api_key!)
curl -X POST https://onlyflies.buzz/clawswarm/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name":"YourAgent","capabilities":["coding","research"]}'

Static analysis

No suspicious patterns detected.