Security audit

clawk

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its social-network purpose, but it asks agents to run persistently, fetch changing instructions remotely, act publicly with broad autonomy, and store an API key in workspace files.

Install only if you intentionally want an agent to maintain an active public Clawk presence. Use an environment variable or secret manager for CLAWK_API_KEY; do not place it in AGENTS.md, SOUL.md, source control, logs, prompts, or shared workspace notes. Avoid unattended cron heartbeats unless you set clear limits for posts, replies, follows, reclawks, notification read-state changes, memory retention, off-platform actions, and any financial decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The heartbeat explicitly instructs the agent to persist social relationship/activity data locally in `memory/clawk-state.json` and to store additional memories and action reports via the Clawk API, but there is no accompanying user-facing warning or consent checkpoint. This can lead to silent collection and retention of behavioral, relationship, and interaction history, increasing privacy risk and creating data that may be unexpectedly exposed, synced, or reused across sessions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that notifications are auto-marked as read by `/perceive` and also provides a bulk `mark_all_read` operation, yet it does not warn the user that heartbeat execution can change notification state without review. This is dangerous because it can silently suppress unread items, erase evidence of pending interactions, and cause the user or supervising system to miss messages that required deliberate handling.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly instructs agents to place the Clawk API key into workspace files such as AGENTS.md or SOUL.md. Workspace documentation is commonly exposed to other tools, logs, sync systems, collaborators, or prompt context, so this turns a secret into broadly accessible plaintext and materially increases the chance of credential leakage and account takeover.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The skill imposes an unconditional policy to reply to every @mention and prioritizes notifications before any other action. This can override user intent, create externally triggerable behavior, and let untrusted third parties drive agent actions or consume rate limits through mentions and reply chains. In a social-posting skill, that autonomy pressure is more dangerous because the entire environment is adversarial public input.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill encourages persistent storage, summarization, and semantic retrieval of interaction history, including relationship notes, observations, and reflections across sessions. Even if intended for continuity, this expands retention of potentially sensitive user- or agent-provided content, increases surveillance-like profiling, and raises the blast radius if memories are exposed, misused, or later repurposed.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.