ClawHub
Back to skill

Security audit

Clawdio

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its secure agent messaging purpose, but it includes under-disclosed key storage and a startup script that can run unreviewed background code from a hard-coded local path.

Review before installing. Use this only in environments where a plaintext identity key file is acceptable, avoid highly sensitive workflows over Telegram without a metadata threat model, do not invoke scripts/start.js unless you have inspected the external run.js it will execute, and prefer pinned dependencies plus restrictive permissions for identity files.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T06 · System Persistence

Error
Location
scripts/start.js:10
Finding

Detached Execution of an Unbundled External Script

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/index.ts:72
Finding

Persistent Identity Secret Key Written Without Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/index.ts:157
Finding

Unbounded Unauthenticated Handshake and Consent Queues Enable Memory Exhaustion

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill strongly promotes Telegram as a transport for agent-to-agent communication but does not clearly warn that Telegram, as a third-party service, will still observe metadata such as account identities, group membership, timing, message size, and communication patterns even if payloads are end-to-end encrypted at the application layer. Users may incorrectly infer complete privacy from the repeated 'secure' framing and route sensitive agent workflows through infrastructure that leaks operational metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script reads a local identity file, extracts the user's public key, and automatically prints a full connection string and endpoint details to stdout without any confirmation or access control. In an agent skill context, stdout may be captured by logs, orchestration systems, or other tools, so this can unintentionally disclose sensitive operational metadata and facilitate unauthorized connection attempts or tracking of the user's node.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code persists the long-term secret key to disk in plaintext JSON alongside the public identity and trust metadata. If the file is read by another local user, malware, backups, logs, or accidental file exposure, an attacker can fully impersonate the agent, decrypt future sessions where that identity is trusted, and subvert the trust model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup instructions tell users to exchange public keys and Clawdio Hub group IDs without warning that these identifiers reveal who should be contacted and where, enabling misdelivery, unwanted connection attempts, correlation of peers, or social-engineering abuse if shared too broadly. In a messaging-based peer discovery workflow, lack of caution around identifier sharing increases the chance of exposing connection topology and onboarding the wrong party.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The production dependency uses a caret range, which permits automatic installation of newer compatible releases rather than a single audited version. If the upstream package or release pipeline is compromised, consumers may pull an unexpected version into a security-sensitive cryptographic communications library.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
],
  "license": "MIT",
  "dependencies": {
    "libsodium-wrappers": "^0.7.15"
  },
  "devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"libsodium-wrappers": "^0.7.15"
  },
  "devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",
    "@types/node": "^25.2.2",
    "typescript": "^5.7.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
},
  "devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",
    "@types/node": "^25.2.2",
    "typescript": "^5.7.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json
"devDependencies": {
    "@types/libsodium-wrappers": "^0.7.14",
    "@types/node": "^25.2.2",
    "typescript": "^5.7.0"
  }
}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The code logs full received message contents with JSON.stringify(msg), which may expose sensitive or private peer data to the local terminal or terminal logs. While the code does perform visible logging, there is no explicit warning to the user that peer-supplied content will be echoed verbatim to stdout.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/start.js:29