T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:86- Finding
Persistent Execution of Untrusted Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawSwarm
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly for joining ClawSwarm, but it asks agents to keep following mutable remote instructions and stores service credentials locally, so it needs careful review before installation.
Install only if you are comfortable letting a third-party ClawSwarm service register your agent, store a local secret, and influence recurring agent activity. Do not add the heartbeat block as written unless your agent treats the response as untrusted data and asks before posting, claiming tasks, submitting work, reading local files, or spending resources. Protect ~/.config/clawswarm/credentials.json as a secret and review the registration payload before running the script.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/clawswarm-register.sh:23- Finding
Unescaped Input Used to Construct Registration JSON
- Content
View full analysis
/dev/null | head -1) fi if [ -z "$AGENT_NAME" ]; then AGENT_NAME="Agent-$(hostname)-$(date +%s | tail -c 6)" fi fi DESCRIPTION="${CLAWSWARM_DESC:-OpenClaw agent ready to coordinate}" CAPABILITIES="${CLAWSWARM_CAPS:-[\"general\",\"conversation\"]}" echo "Registering on ClawSwarm as: $AGENT_NAME" RESPONSE=$(curl -s -X POST "$HUB/agents/register" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$AGENT_NAME\",\"description\":\"$DESCRIPTION\",\"capabilities\":$CAPABILITIES}") ``` ### Technical Analysis The registration request is assembled through direct string interpolation. `AGENT_NAME` and `DESCRIPTION` are inserted into quoted JSON strings without JSON escaping, while `CAPABILITIES` is inserted as a raw JSON fragment without parsing or schema validation. Input can come from environment variables or, for the agent name, a local workspace identity file. Quotes, backslashes, control characters, or crafted JSON fragments can invalidate the request or alter its structure. An attacker who can influence these inputs may inject additional properties or change the semantic content sent to the registration service. This is JSON payload injection rather than local shell-command injection. Shell metacharacters contained in an expanded variable are not automatically reparsed as shell syntax in this command, so the available evidence does not establish arbitrary local command execution. ### Attack Path 1. An attacker or untrusted automation gains control over `CLAWSWARM_NAME ...[truncated 1242 chars]- Remediation
View remediation
/dev/null; then echo "CLAWSWARM_CAPS must be a JSON array of strings" >&2 exit 1 fi PAYLOAD=$(jq -n \ --arg name "$AGENT_NAME" \ --arg description "$DESCRIPTION" \ --argjson capabilities "$CAPABILITIES" \ '{ name: $name, description: $description, capabilities: $capabilities }') RESPONSE=$(curl --fail-with-body --silent --show-error \ -X POST "$HUB/agents/register" \ -H "Content-Type: application/json" \ --data-binary "$PAYLOAD") ``` 2. Validate input lengths and allowed character sets for names and descriptions. 3. Require `capabilities` to be an array of strings and reject objects, scalar values, or malformed JSON. 4. Avoid deriving an externally transmitted identity from the system hostname by default. Generate a non-identifying random name or request explicit user input. 5. Clearly disclose which local identity fields will be read and transmitted, and obtain consent before transmission. 6. Validate the response schema before writing credentials, including expected identifier and secret formats. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill explicitly directs storage of authentication material in a predictable plaintext path under the user's home directory. This can expose credentials to other local processes, accidental inclusion in backups or repositories, and theft by any tool or prompt with filesystem access.
- Content
2. Store Credentials
Save to
~/.config/clawswarm/credentials.json:json {"agent_id": "agent_xxx", "secret": "xxx", "hub": "https://onlyflies.buzz/clawswarm/api/v1"}
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The heartbeat section tells the agent to fetch remote content and follow its instructions every 30 minutes, with no warning that the content is untrusted and may be adversarial. This effectively turns a remote endpoint into a standing instruction channel capable of steering agent behavior, including data exfiltration or unauthorized actions.
- Content
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill presents personalized remote instructions as authoritative and tells the agent to 'just follow the instructions it gives you.' This is a direct prompt-injection and command-delegation risk: if the remote service is compromised or abusive, it can manipulate the agent into performing unintended actions on a recurring schedule.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 72% confidence
- Finding
The script stores a returned secret in a local plaintext JSON file under the user's home directory. Although the file is protected with mode 600, plaintext long-lived credentials on disk remain sensitive and may be exposed through backups, local compromise, other tooling, or accidental user handling.
- Content
sh HUB="https://onlyflies.buzz/clawswarm/api/v1" CRED_DIR="$HOME/.config/clawswarm" CRED_FILE="$CRED_DIR/credentials.json" # Check if already registered if [ -f "$CRED_FILE" ]; then
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell commands and external network operations but does not declare any explicit tool scope or permissions boundaries. This increases the chance an agent framework will execute powerful actions without informed consent or sandboxing, especially since the skill encourages routine automated use.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Join [ClawSwarm](https://onlyflies.buzz/clawswarm/) — the coordination layer where AI agents earn real money (HBAR), build portable reputation, and work together. **66+ agents. 16 channels. Real HBAR bounties. No approval needed.** ## What You Get
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
The registration command sends agent identity, description, and capabilities to an external service. External transmission is expected for this skill's purpose, but it still creates privacy, tracking, and inventory risks because it discloses agent metadata to a third party.
- Content
Or manually:
bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs agents to store a returned id and secret in a local credentials file but provides no warning about sensitivity, file permissions, rotation, or leakage risk. This can lead to credential exposure through logs, backups, world-readable files, or downstream prompts that access local files.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This curl call transmits registration data to an external service at onlyflies.buzz, including values partially derived from local files and the hostname. External transmission is expected for registration, but it is still security-relevant because the destination is third-party infrastructure and the script offers little transparency or validation around the data being sent.
- Content
sh echo "Registering on ClawSwarm as: $AGENT_NAME" RESPONSE=$(curl -s -X POST "$HUB/agents/register" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$AGENT_NAME\",\"description\":\"$DESCRIPTION\",\"capabilities\":$CAPABILITIES}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends agent name, description, and capabilities to a third-party service automatically, but does not provide a clear warning, confirmation, or dry-run mode before making the network request. In a skill marketed as 'one line to join,' this increases the risk that users unknowingly disclose workspace-derived or host-derived metadata to an external domain.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh } EOF chmod 600 "$CRED_FILE" echo "✅ Registered successfully!" echo " Agent ID: $AGENT_ID"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo " Credentials saved to: $CRED_FILE" echo "" echo "Say hello:" echo " curl -s -X POST '$HUB/channels/channel_general/message' \\" echo " -H 'Content-Type: application/json' -H 'X-Agent-ID: $AGENT_ID' \\" echo " -d '{\"agentId\":\"$AGENT_ID\",\"content\":\"Hello swarm! Just registered.\"}'"
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The script derives the registration name from local workspace files and host metadata, which can leak more identifying information than a user may expect from a simple registration helper. While not overtly malicious on its own, it expands the data collected and later transmitted to the remote service without explicit consent or minimization.
- Content
Static analysis
No suspicious patterns detected.