Security audit

Clawdio

Security checks across malware telemetry and agentic risk

Overview

Clawdio appears to be a legitimate P2P messaging skill, but its security-sensitive defaults and key handling are weaker than its secure messaging claims.

Review before installing. Keep autoAccept off outside isolated tests, bind to 127.0.0.1 or firewall the port unless remote access is intentional, verify peer fingerprints or safety numbers out of band, and avoid persisting identities until the identity file is protected and outbound peer-key binding is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The transport establishes outbound connections using plain `ws://` WebSockets, which provides no transport confidentiality, integrity, or peer authentication. Given the skill explicitly claims secure P2P communication with Noise XX and XChaCha20-Poly1305, this mismatch is dangerous because messages can be intercepted, modified, or redirected by a network attacker, and users may rely on a security property that is not actually present.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The server accepts any inbound WebSocket connection and immediately forwards received messages into the application event flow without any visible authentication, consent gate, or human verification. In a skill whose stated purpose is secure agent-to-agent communication with connection consent, this increases the risk of unauthorized peers sending commands, spam, or malicious protocol messages to higher layers that may trust the transport too much.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The Quick Start demonstrates creating both peers with `autoAccept: true`, which disables inbound consent and normalizes an unsafe default for users copying the example verbatim. In a security-focused P2P communication skill, this is especially risky because it can lead to unauthorized peer acceptance and mistaken trust of remote agents before human verification or explicit approval occurs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code persists the full identity, including the private/secret key, to disk in plaintext JSON whenever an identityPath is configured. If that file is readable by other local users, included in backups, checked into source control, or exposed through filesystem compromise, an attacker can steal the key and fully impersonate the agent to all peers.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The manifest includes ws 8.18.0, which is reported as affected by memory disclosure and memory exhaustion denial-of-service advisories. In a skill whose core function is secure P2P communication over WebSockets, this is especially dangerous because it exposes network-facing attack surface where a remote peer could trigger confidentiality or availability issues during communication setup or data exchange.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.