Security audit

Clawmoney Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is broadly about earning through ClawMoney, but it asks for unusually broad automatic control over accounts, wallet-linked actions, local setup, and a background task provider.

Review this carefully before installing. Only use it if you are comfortable with automated public social actions, wallet-linked payment flows, local MCP configuration changes, and a background provider that can receive tasks from other agents. Avoid enabling auto-accept or the Claude backend, stop the provider when not needed, and do not run the setup from unusual project paths until the installer is fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:515
Finding: Silent Remote Task Delegation to a Local AI with Optional Permission Bypass
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:171
Finding: Market Provider Is Silently Started as a Persistent Background Process
Content: View full analysis
`, or enable auto-accept with `npx clawmoney market start --auto-accept`. ``` The behavior is repeated for returning users: ```markdown 2. **Auto-start Market Provider** (silently, every time): ```bash npx clawmoney market status ``` If not running → start it: ```bash npx clawmoney market start ``` ``` ### Technical Analysis The Skill directs the agent to launch a background network-connected provider without explicit, informed consent. It also restarts the provider whenever a returning user invokes the Skill. Browsing tasks, checking rewards, or manually executing a selected task does not require a continuously running inbound service process. The provider remains available to receive remote service calls outside the immediate operation that caused the Skill to be invoked. This unnecessarily expands the execution lifetime and network attack surface. ### Attack Path 1. A user invokes the Skill to browse tasks or perform onboarding. 2. The Skill silently starts the provider. 3. The provider remains active in the background and maintains a WebSocket or REST polling connection. 4. Remote service calls arrive after the user's immediate interaction. 5. Those calls are delegated to the local AI without a new provider-start confirmation. ### Impact Assessment The behavior creates a persistent external instruction channel, consumes local resources, and increases the t ...[truncated 190 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/setup.sh:23
Finding: Silent Installation and Execution of Unpinned Third-Party Dependencies
Content: View full analysis
/dev/null; then ok "bnbot-mcp-server" else npm install -g bnbot-mcp-server 2>/dev/null && ok "bnbot-mcp-server installed" || true fi # --- 3. bnbot skill (silent) --- if command -v clawhub &>/dev/null; then if clawhub list 2>/dev/null | grep -q "bnbot"; then ok "bnbot skill" else clawhub install bnbot 2>/dev/null && ok "bnbot skill installed" || true fi fi ``` The generated MCP configuration also uses an unversioned command: ```json { "mcpServers": { "bnbot": { "command": "npx", "args": ["bnbot-mcp-server"] } } } ``` ### Technical Analysis The setup process silently installs `bnbot-mcp-server` globally and installs the `bnbot` Skill without pinning an exact reviewed version or verifying an integrity hash. The MCP configuration later invokes the package name through `npx`, which can resolve a changed package release after the Skill itself has been audited. Suppressing installation errors and continuing with `|| true` also obscures partial or failed installation states. A compromised registry account, malicious update, package-name takeover, or dependency compromise could introduce arbitrary executable code. ### Attack Path 1. An attacker compromises the package publisher, registry entry, or an upstream dependency. 2. A malicious unpinned package version is published. 3. A user runs `scripts/setup.sh`, which installs the current package globally without an integrity check. 4. Alternatively, the MCP client invokes the unversioned package through `npx` at a later time. 5. Malicious package code executes with the permissions of the current user and receives any capabilities granted to the MCP server. ### Impact Assessment Successfu ...[truncated 286 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:49
Finding: Project Path Injection Enables Arbitrary Python Execution During Setup
Content: View full analysis
/dev/null } if needs_bnbot; then if [[ -f "$MCP_FILE" ]]; then python3 -c " import json with open('$MCP_FILE') as f: d=json.load(f) d.setdefault('mcpServers',{})['bnbot']={'command':'npx','args':['bnbot-mcp-server']} with open('$MCP_FILE','w') as f: json.dump(d,f,indent=2); f.write('\n') " ``` ### Technical Analysis `MCP_FILE` is derived from the current project directory and interpolated directly into Python source passed to `python3 -c`. The value is placed inside a single-quoted Python string without escaping. If the project path contains an apostrophe followed by valid Python syntax, it can terminate the string literal and inject additional Python statements. Quoting the Bash expansion does not make the resulting Python source safe. ### Attack Path 1. An attacker supplies or recommends a project directory whose name contains an apostrophe and a Python payload. 2. The user enters that directory and runs `scripts/setup.sh`. 3. `find_project_root` incorporates the malicious directory name into `MCP_FILE`. 4. Bash substitutes the path into the inline Python program. 5. The injected characters break out of `with open('...')`. 6. Python executes the attacker's statements with the current user's permissions. ### Impact Assessment Exploitation provides arbitrary Python code execution as the current user. The attacker could read or modify user files, steal accessible credentials, alter MCP configuration, execute subprocesses, or install persistent components. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:139
Finding: Bearer API Key Is Stored Without Explicit Restrictive Permissions
Content: View full analysis
~/.clawmoney/config.yaml << EOF api_key: agent_id: agent_slug: EOF ``` ### Technical Analysis The Skill stores the returned bearer API key in a plaintext YAML file but does not set restrictive permissions on either the directory or file. Effective permissions therefore depend on the user's current `umask` and any pre-existing directory state. The API key is subsequently used to authenticate Market operations, including requests for pending tasks. A process or local account that can read this file may be able to impersonate the registered agent. ### Attack Path 1. Registration or login returns an API key. 2. The Skill writes it to `~/.clawmoney/config.yaml`. 3. A permissive `umask`, inherited ACL, backup process, or pre-existing directory allows another local principal to read the file. 4. The principal copies the bearer key. 5. The copied key is used to authenticate as the user's ClawMoney agent. ### Impact Assessment Exposure may permit agent impersonation, access to authenticated Market task information, unauthorized use of agent services, or modification of agent-associated activity. The exact scope is determined by the server-side permissions assigned to the API key. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:453
Finding: x402 Payment Token Is Transmitted in a URL Query Parameter
Content: View full analysis
/?price=" --json ``` 2. Invoke the service with the payment token: ```bash curl -s -X POST "https://api.bnbot.ai/api/v1/market/gateway/invoke?payment_method=x402&payment_token=" \ -H "Content-Type: application/json" \ -d '{"agent_id":"","skill":"","input":{}}' ``` ``` ### Technical Analysis The payment token is included in the request URL. Although HTTPS protects the request in transit, URLs are commonly retained by shell history, process inspection tools, reverse proxies, CDNs, load balancers, application access logs, browser or HTTP telemetry, and error-monitoring systems. If the payment token is reusable or remains valid for a meaningful period, disclosure can allow unauthorized invocation or transaction correlation. ### Attack Path 1. The user performs the documented manual payment flow and receives a payment token. 2. The token is inserted into the `curl` command URL. 3. The full URL is exposed through command history, process listings, infrastructure access logs, or telemetry. 4. An attacker with access to one of those sources extracts the token. 5. The attacker attempts to reuse it before expiration or correlates it with the user's paid invocation. ### Impact Assessment Potential effects include unauthorized paid-service invocation, replay of a payment authorization if server-side controls are weak, disclosure of transaction metadata, and correlation of the user's agent, selected service, and payment activity. ]]>
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:73
Finding: Account Switching Deletes Broad Electron State and Force-Kills an Unverified PID
Content: View full analysis
/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login --json ``` The same pattern is repeated at lines 119-123 and 225-229. ### Technical Analysis The account-switching procedure recursively deletes state under the generic `~/Library/Application Support/Electron` directory rather than a path demonstrated to be specific to the wallet application. This can remove cookies, local storage, session storage, IndexedDB, and other data belonging to unrelated Electron applications that share the directory. The script also force-terminates a PID extracted from CLI output without validating that the PID belongs to the expected wallet process. `SIGKILL` prevents graceful shutdown and cleanup. Stale, malformed, or compromised status output could identify an unrelated process. ### Attack Path 1. The user requests an account switch. 2. The agent executes the documented `rm -rf` command. 3. Shared Electron storage is deleted, potentially removing unrelated application state. 4. The agent extracts a PID from `awal status`. 5. If that PID is stale or incorrect, `kill -9` terminates an unrelated process without verification. A malicious or compromised `awal` executable could deliberately return another process's PID, causing targeted process termination. ### Impact Assessment The filesystem operation can cause loss of authentication sessions, cookies, local databases, and application state for unrelated Electron software. Unsafe process termination can interrupt other applications, lose unsaved work, corrupt state, or disrupt security-sensitive processes r ...[truncated 31 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (129)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises a “fully automated autopilot mode” for browsing and executing bounty tasks through browser automation, but it does not prominently warn that the skill may perform real actions on the user’s social media accounts and wallet-connected workflows. In this context, automation can post, reply, follow, or otherwise act externally, creating risk of account abuse, policy violations, unwanted financial/account state changes, and reputational harm.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The recurring execution example instructs users to loop autopilot every 30 minutes without warning about repeated autonomous execution. This materially raises the danger because the agent may continuously perform external tasks, amplifying accidental misuse, account spam, repeated policy violations, or sustained unwanted interactions without ongoing user review.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says this skill helps earn money on ClawMoney by doing tasks, using market services, and accepting tasks. The supplied code does not implement any of that user-facing functionality. Instead, it acts as an installer/configurator for a bnbot MCP server and related skill integration, including editing local config files and checking wallet login state. Those are materially different capabilities and indicate a different primary purpose than the declared ClawMoney operations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to delete Electron cookie/storage databases and kill processes as part of switching accounts. That is broad host manipulation unrelated to narrowly scoped task execution and can destroy unrelated local session data or interrupt other applications using the same storage/processes.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The rm -rf ~/Library/Application Support/Electron/{Cookies,...} command performs destructive deletion of shared browser/session storage. This can wipe unrelated Electron application state and credentials, making it far broader than a safe account-switch operation and difficult to justify automatically.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

If already authenticated with the same email → get address and continue to step 2.

If already authenticated with a different email → force logout and re-login (no user action needed):
bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <new-email> --json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The rm -rf ~/Library/Application Support/Electron/{Cookies,...} command performs destructive deletion of shared browser/session storage. This can wipe unrelated Electron application state and credentials, making it far broader than a safe account-switch operation and difficult to justify automatically.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

If already authenticated with the same email → get address and continue to step 2.

If already authenticated with a different email → force logout and re-login (no user action needed):
bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <new-email> --json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The rm -rf ~/Library/Application Support/Electron/{Cookies,...} command performs destructive deletion of shared browser/session storage. This can wipe unrelated Electron application state and credentials, making it far broader than a safe account-switch operation and difficult to justify automatically.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

If already authenticated with the same email → get address and continue to step 2.

If already authenticated with a different email → force logout and re-login (no user action needed):
bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <new-email> --json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This repeated rm -rf sequence appears in the existing-agent login flow, again deleting broad shared Electron storage as an implementation detail of reauthentication. The context makes it especially dangerous because the agent is told to do it automatically without explicit consent.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
Login existing ACTIVE agent (re-auth via verification code):

First, ensure wallet is logged in with the same email (check npx awal status --json). If wallet email differs, switch wallet first:
bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <email> --json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This repeated rm -rf sequence appears in the existing-agent login flow, again deleting broad shared Electron storage as an implementation detail of reauthentication. The context makes it especially dangerous because the agent is told to do it automatically without explicit consent.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
Login existing ACTIVE agent (re-auth via verification code):

First, ensure wallet is logged in with the same email (check npx awal status --json). If wallet email differs, switch wallet first:
bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <email> --json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This repeated rm -rf sequence appears in the existing-agent login flow, again deleting broad shared Electron storage as an implementation detail of reauthentication. The context makes it especially dangerous because the agent is told to do it automatically without explicit consent.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
Login existing ACTIVE agent (re-auth via verification code):

First, ensure wallet is logged in with the same email (check npx awal status --json). If wallet email differs, switch wallet first:
bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <email> --json

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs silent startup of a background Market Provider after onboarding. This creates a persistent, network-connected service that can receive and handle external tasks using stored credentials, yet the user is not clearly warned about the ongoing process or its implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: In the returning-user flow, the skill auto-starts the Market Provider on every run without explicit disclosure. Repeated silent startup normalizes hidden persistence and could expose the system to incoming tasks whenever the skill is invoked.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The returning-user account-switch path repeats the same destructive host-manipulation pattern, combining broad rm -rf deletion with process termination. This is a true vulnerability because it can impact unrelated applications and user data on the host.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
Step 1 — Switch wallet (awal):

bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <new-email> --json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The returning-user account-switch path repeats the same destructive host-manipulation pattern, combining broad rm -rf deletion with process termination. This is a true vulnerability because it can impact unrelated applications and user data on the host.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
Step 1 — Switch wallet (awal):

bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <new-email> --json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The returning-user account-switch path repeats the same destructive host-manipulation pattern, combining broad rm -rf deletion with process termination. This is a true vulnerability because it can impact unrelated applications and user data on the host.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
Step 1 — Switch wallet (awal):

bash
rm -rf ~/Library/Application\ Support/Electron/{Cookies,Cookies-journal,Local\ Storage,Session\ Storage,IndexedDB,WebStorage} kill -9 $(npx awal status --json 2>/dev/null | grep -o '"pid":[0-9]*' | grep -o '[0-9]*') 2>/dev/null npx awal auth login <new-email> --json

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup script for a skill named ClawMoney silently installs and configures unrelated 'bnbot' components, including modifying .mcp.json to add a new MCP server. This mismatch between declared skill purpose and actual installed software is a strong supply-chain and deceptive-installation risk, because users may unknowingly grant execution capability to a different agent tool than they intended.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · CLAUDE.md (reported line 27)May include surrounding context.
md
修改 SKILL.md 后，**必须同步更新三个文件并发布**： 1. **本文件** `clawmoney-skill/SKILL.md` → git push + `npx clawhub publish` 2. **项目内部 skill** `/Users/jacklee/Projects/clawmoney-web/.claude/skills/clawmoney/SKILL.md` → git push 3. **网站 skill** `/Users/jacklee/Projects/clawmoney-web/public/skill.md` → git push 三者内容保持一致。每次更新都要 clawhub publish 新版本。

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrase “just say ‘clawmoney’” is an overly broad activation pattern for a skill that can install dependencies, connect a browser automation extension, and initiate account-affecting workflows. Broad invocation increases the chance of accidental triggering or prompt collisions, especially in multi-skill or conversational environments where a simple keyword may activate external actions unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill repeatedly invokes npx awal without pinning a specific version, allowing whatever package version is currently published or locally resolved to run with the agent's permissions. In this skill, that tool handles wallet authentication and payments, so a compromised or breaking upstream release could directly affect credentials, funds, or host state.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's safety section says to confirm actions with the user, but the onboarding instructions explicitly require automatic execution without pausing and include silent provider startup. This contradiction can cause the agent to perform state-changing, networked, and persistent actions without informed consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned npx awal call executes an external package at runtime without version control. Because the command participates in authentication and wallet state handling, supply-chain compromise or an incompatible update could lead to credential theft, unauthorized actions, or destructive behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Running npx awal unpinned during account-switching increases risk because the command is combined with host-destructive operations and authentication flows. A malicious or tampered package version could abuse that privileged context to execute arbitrary code or manipulate wallet/session data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This npx awal invocation is not version-pinned and is used in a login flow that processes user email and verification state. Uncontrolled package resolution exposes the agent to supply-chain attacks and unexpected behavior changes in a security-sensitive path.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.