Clawdio

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:17 AM UTC
• Version: 2.2.0

Overview

The core skill mostly matches encrypted agent messaging, but it needs review because it includes an under-disclosed hard-coded launcher that can start a detached local node and persists identity secrets without hardening.

Review before installing or running. The encrypted messaging library may be useful, but avoid the included start script unless the hard-coded path, fixed IP/owner, missing `run.js`, detached background behavior, undeclared dependencies, and plaintext identity-key handling are fixed or clearly documented.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script prints and returns sensitive connection metadata including a public key, fixed external IP address, connection string, and owner name. In an agent-skill context, this can disclose infrastructure details to unintended consumers, enabling targeting, unauthorized connection attempts, or privacy leakage beyond the stated purpose of merely starting a node.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example code creates both nodes with `autoAccept: true`, which disables the documented consent gate for unknown inbound peers. In a skill whose core purpose is agent-to-agent communication over an internet-facing transport like Telegram, this normalizes insecure defaults and can lead users to accept unauthorized peers, enabling spoofed connections, unwanted message delivery, and trust bypass unless users also perform verification correctly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists the private identity secret key in plaintext JSON on disk via writeFileSync, with no access-control hardening, encryption at rest, or explicit user disclosure. If the identity file is readable by other local users, included in backups/logs, or exfiltrated through another compromise, an attacker can fully impersonate the agent and decrypt future sessions that rely on this long-term identity.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

],
  "license": "MIT",
  "dependencies": {
    "libsodium-wrappers": "^0.7.15"
  },
  "devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",

• Confidence: 96% confidence
• Finding: The runtime dependency uses a caret range, which allows installation of newer semver-compatible versions than the one originally tested. In a security-sensitive package that provides encrypted P2P communications, this increases supply-chain risk because an upstream compromise or breaking security regression could be pulled in during fresh installs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"libsodium-wrappers": "^0.7.15"
  },
  "devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",
    "@types/node": "^25.2.2",
    "typescript": "^5.7.0"
  }

• Confidence: 87% confidence
• Finding: This devDependency is version-ranged with a caret, so builds may consume a different package version over time. Although it is a type package and not typically shipped at runtime, it still contributes to build-time supply-chain exposure if the dependency is compromised.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",
    "@types/node": "^25.2.2",
    "typescript": "^5.7.0"
  }
}

• Confidence: 87% confidence
• Finding: The Node type definitions are not pinned, allowing automatic uptake of newer compatible versions during development. This is primarily a build-time supply-chain concern rather than a direct runtime flaw, but compromised or problematic packages could still affect developer or CI environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",
    "@types/node": "^25.2.2",
    "typescript": "^5.7.0"
  }
}

• Confidence: 90% confidence
• Finding: TypeScript is a build tool and is specified with a caret range, so different installs may use different compiler versions. That creates a low-severity supply-chain and reproducibility risk, especially in CI or contributor environments, even though it is not part of the shipped runtime package.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/start.js:29