Security audit

clawtip

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ClawTip payment and wallet helper, but it can run payment-related commands from third-party requests with incomplete user-control and supply-chain safeguards.

Install only if you trust the ClawTip service and its npm CLI package, and use it in an environment where financial transactions require clear per-transaction approval. Treat third-party skill payment requests as sensitive, avoid broad wallet commands unless you intend to open ClawTip, and prefer a sandboxed agent with limited files, environment variables, and network access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:34
Finding: Remote npm Package Retrieval and Automatic Execution
Content: View full analysis
-i -v ``` ```bash npx --yes @clawtip/clawtip-cli@1.0.4 create-token -t ``` ```bash npx --yes @clawtip/clawtip-cli@1.0.4 check-register -d ``` ```bash npx --yes @clawtip/clawtip-cli@1.0.4 wallet-qrcode ``` ### Technical Analysis The Skill directs the Agent to use `npx --yes` to retrieve and immediately execute `@clawtip/clawtip-cli@1.0.4`. The `--yes` option suppresses installation confirmation, making package retrieval and code execution automatic. Although the package version is fixed, the project does not contain the package source, a lockfile with an npm integrity value, a vendored artifact, or locally enforced signature verification. Consequently, the code that ultimately executes is outside the audited project. A fixed package version reduces accidental upgrades but does not independently prove that the retrieved artifact is the artifact previously reviewed. `IMPORTANT_STATEMENTS.md` asserts that the package has SLSA provenance, cryptographic protection, and third-party review. These are documentary assertions rather than controls enforced by the included project files. No verification command or expected digest is provided. This behavior most directly matches remote payload retrieval and execution because invocation causes executable code to be fetched from an external registry after the Skill itself has been reviewed. ### Attack Path 1. A user or third-party skill triggers a payment, token, registration, or wallet operation. 2. The Agent executes an `npx --yes` command from `SKILL.md`. 3. `npx` resolves and ...[truncated 1080 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:65
Finding: Shell Command Injection Through Unquoted External Parameters
Content: View full analysis
-i -v ``` ```bash npx --yes @clawtip/clawtip-cli@1.0.4 create-token -t ``` ```bash npx --yes @clawtip/clawtip-cli@1.0.4 check-register -d ``` The substituted values originate from users or calling skills: - `order_no` or `orderNo` - `indicator` - `user_token` - `clawtip_id` ### Technical Analysis The command templates interpolate externally supplied values without requiring strict validation, shell-safe quoting, or a structured argument-array API. If an Agent implements these templates using a shell-backed command executor, shell metacharacters in a parameter can be interpreted as command syntax instead of literal argument data. Potentially dangerous syntax includes command separators, substitutions, redirections, pipelines, and quoting characters. Merely placing quotes around interpolated text is also insufficient if escaping is incomplete. The robust solution is to avoid a shell and pass each value as a separate process argument. The issue affects multiple paths because all three externally supplied identifier types are inserted into command strings. ### Attack Path 1. A malicious user or compromised calling skill supplies a crafted value as an order number, indicator, user token, or ClawTip identifier. 2. The Agent substitutes that value into one of the documented command templates. 3. A shell-backed executor parses the resulting command. 4. Embedded shell syntax terminates or modifies the intended CLI argument. 5. The injected command executes with the Agent process's operating-system privileges. For example, an attacker could attempt to place a command separator and a secondary command inside `indicator`. Exploitability depends on the Agent's actual command-exe ...[truncated 665 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:55
Finding: Third-Party Payment Invocation Lacks Mandatory Transaction-Specific User Approval
Content: View full analysis
-i -v ``` The documented trigger policy permits a third-party skill to initiate this operation when it supplies a payment request with `order_no` and `indicator`. ### Technical Analysis The Skill permits payment execution based on parameters supplied by another skill. Its human-in-the-loop rule requires authorization or payment URLs to be displayed and requires confirmation before using those URLs. However, the documented flow does not require fresh, transaction-specific user approval before invoking the payment command when existing credentials or authorization are sufficient. The flow also does not require the Agent to show the user the merchant, amount, currency, purpose, or other transaction details before execution. Possession of syntactically valid `order_no` and `indicator` values is therefore treated as sufficient to enter the payment flow. This creates a confused-deputy risk: a malicious or compromised calling skill can use the ClawTip Skill's payment authority for a transaction that the user did not knowingly approve. Existing account authorization is not equivalent to informed consent for a particular payment. ### Attack Path 1. A third-party skill is compromised, behaves deceptively, or constructs an unwanted payment request. 2. It supplies an `order_no` and `indicator` to the ClawTip Skill. 3. The ClawTip Skill accepts those values as the required payment context. 4. The Agent invokes the `pay` command without first requiring approval tied to the specific merchant, amount, currency, and order. 5. If the user's existing authorization allows the transaction, payment may proceed without a new authorization URL ...[truncated 635 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:32
Finding: Skill-Level Priority and Output Suppression Directives Can Override Safety-Relevant Communication
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all operational and safety instructions exclusively in Chinese, which can force a specific language on users or operators without opt-in. The policy allows locale constraints only when explicitly justified or when users are given a language choice, neither of which is present here.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The document instructs use of npx clawtip without pinning an exact package version, which allows resolution to whatever version is current at execution time. In a skill that explicitly claims strong supply-chain assurances and encourages autonomous invocation, this undermines reproducibility and increases the risk of pulling a later malicious or compromised release despite the surrounding trust language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase “查看钱包” is overly broad and can match ordinary conversation unrelated to ClawTip, causing the skill to activate in contexts the user did not intend. Because activation leads to external CLI/network actions and disclosure of wallet-access links/QR codes, ambiguous matching increases the risk of unintended financial-tool invocation and confused-deputy behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Repeating the broad trigger “查看钱包” in the wallet-view section reinforces an unsafe activation rule and lacks exclusion conditions. In this skill’s payment/wallet context, accidental invocation is more dangerous than in a generic informational skill because it can initiate tool execution and present account-management entry points tied to a financial service.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The boundary section explicitly says '绝对不要实行轮询（do not poll）' for authorization or payment URLs. Later, the '查询用户注册状态' result handling says the agent may inform the user of the current polling count, which implies a polling-based status-check flow and conflicts with the earlier no-poll instruction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.