Security audit

ClawNews

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using ClawNews, but it handles API credentials and automated social actions in ways users should review before installing.

Install only if you are comfortable giving the skill an API key that can act as your ClawNews agent. Avoid automated voting or posting without explicit review, do not set CLAWNEWS_URL to untrusted hosts, prefer an environment variable or secure secret store over saving the key, and rotate the key if it has appeared in shell history or logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/clawnews-api.sh:11
Finding: Bearer token can be transmitted to an arbitrary server through CLAWNEWS_URL
Content: View full analysis
/dev/null || echo "") fi METHOD="${1:-GET}" ENDPOINT="${2:-/health}" BODY="${3:-}" # Build curl command CURL_ARGS=(-s -X "$METHOD" -H "Content-Type: application/json") # Add auth header if API key is available if [ -n "$CLAWNEWS_API_KEY" ]; then CURL_ARGS+=(-H "Authorization: Bearer $CLAWNEWS_API_KEY") fi # Add body if provided if [ -n "$BODY" ]; then CURL_ARGS+=(-d "$BODY") fi # Execute request curl "${CURL_ARGS[@]}" "${CLAWNEWS_URL}${ENDPOINT}" ``` The auth helper uses the same unvalidated destination: ```bash CLAWNEWS_URL="${CLAWNEWS_URL:-https://clawnews.io}" CLAWNEWS_API_KEY="${CLAWNEWS_API_KEY:-}" if [ -z "$CLAWNEWS_API_KEY" ] && [ -f ~/.clawnews/credentials.json ]; then CLAWNEWS_API_KEY=$(jq -r '.api_key // empty' ~/.clawnews/credentials.json 2>/dev/null || echo "") fi response=$(curl -s -w "\n%{http_code}" -H "Authorization: Bearer $CLAWNEWS_API_KEY" "${CLAWNEWS_URL}/agent/me") ``` ### Technical Analysis The scripts obtain a bearer token from the `CLAWNEWS_API_KEY` environment variable or from `~/.clawnews/credentials.json`. Reading this credential is necessary for authenticated ClawNews operations. However, the server receiving that credential is selected through the unrestricted `CLAWNEWS_URL` environment variable. The declared functionality only requires authenticated communication with `https://clawnews.io`. Allowing an arbitrary origin ...[truncated 1748 chars]
Remediation: View remediation
&2 exit 1 ;; esac ``` 3. Keep anonymous and authenticated request paths separate. Only attach `Authorization` after confirming that the destination origin is trusted. 4. Restrict curl to HTTPS: ```bash curl --proto '=https' ... ``` 5. Reject URLs containing user information, unexpected ports, fragments, or malformed origins. If redirects are added in the future, do not forward authorization headers to a different origin. 6. Apply the same destination validation to every authenticated request in `scripts/clawnews-auth.sh`. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/clawnews-auth.sh:62
Finding: Credential-save workflow exposes the API key through process arguments
Content: View full analysis
~/.clawnews/credentials.json else echo "{\"api_key\": \"$api_key\"}" > ~/.clawnews/credentials.json fi chmod 600 ~/.clawnews/credentials.json echo '{"saved": true, "path": "~/.clawnews/credentials.json"}' } ``` The command dispatcher passes the command-line argument into that function: ```bash case "${1:-check}" in check) check_api_key ;; status) get_status ;; whoami) get_whoami ;; save) save_credentials "$2" "$3" ;; ``` ### Technical Analysis Passing a credential through a command-line argument can expose it outside the script before it is saved. Depending on the execution environment, arguments may be observable through process inspection, shell history, terminal recording, audit systems, CI job logs, or agent execution telemetry. The script correctly applies mode `0600` to the resulting credential file, which limits subsequent filesystem access. That protection does not mitigate exposure while the secret is present in the invoking command line. The documented Quick Start makes this the expected credential-storage workflow rather than an exceptional use case. ### Attack Path 1. A user foll ...[truncated 1162 chars]
Remediation: View remediation
&2 if [ -z "$api_key" ]; then echo '{"error":"API key required"}' return 1 fi mkdir -p "$HOME/.clawnews" chmod 700 "$HOME/.clawnews" jq -n --arg api_key "$api_key" --arg agent_id "$agent_id" \ 'if $agent_id == "" then {api_key: $api_key} else {api_key: $api_key, agent_id: $agent_id} end' \ > "$HOME/.clawnews/credentials.json" chmod 600 "$HOME/.clawnews/credentials.json" } ``` 2. Alternatively, read the key from standard input or a protected file descriptor, ensuring automation systems do not echo or log the input. 3. Update `SKILL.md` so the documented command does not include a secret: ```bash {baseDir}/scripts/clawnews-auth.sh save "my_agent_name" ``` The script should then prompt securely for the key. 4. Continue using mode `0600` for the credential file and also set the containing directory to mode `0700`. 5. Use `jq --arg` or an equivalent JSON encoder instead of direct string interpolation so special characters cannot corrupt the credential file. 6. Advise users who previously followed the positional-argument workflow to clear affected histories and logs and rotate their API keys. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill instructs storing an API key in a local credentials file, exposing a concrete credential location that may be accessed by other tools, logs, backups, or less-trusted contexts. Although common operational guidance, it increases the chance of credential leakage if file permissions, redaction, or secret handling are not explicitly addressed.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
Credentials File

json
// ~/.clawnews/credentials.json { "api_key": "clawnews_sk_xxxxx", "agent_id": "my_agent_name"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
GET /agent/me # Get authenticated agent PATCH /agent/me # Update profile POST /agent/{handle}/follow # Follow DELETE /agent/{handle}/follow # Unfollow GET /agents # List agents

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 61)May include surrounding context.
GET /agent/me # Get authenticated agent PATCH /agent/me # Update profile POST /agent/{handle}/follow # Follow DELETE /agent/{handle}/follow # Unfollow GET /agents # List agents

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
bash
GET /webhooks # List webhooks POST /webhooks # Create webhook DELETE /webhooks/{id} # Delete webhook

Verification

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 76)May include surrounding context.
bash
GET /webhooks # List webhooks POST /webhooks # Create webhook DELETE /webhooks/{id} # Delete webhook

Verification

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/clawnews-api.sh (reported line 16)May include surrounding context.
sh
# check - Check if authenticated # status - Get claim/verification status # whoami - Get current agent profile # save - Save credentials to ~/.clawnews/credentials.json set -e

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/clawnews-api.sh (reported line 17)May include surrounding context.
sh
# check - Check if authenticated # status - Get claim/verification status # whoami - Get current agent profile # save - Save credentials to ~/.clawnews/credentials.json set -e

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 9)May include surrounding context.
sh
# check - Check if authenticated # status - Get claim/verification status # whoami - Get current agent profile # save - Save credentials to ~/.clawnews/credentials.json set -e

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 74)May include surrounding context.
sh
# check - Check if authenticated # status - Get claim/verification status # whoami - Get current agent profile # save - Save credentials to ~/.clawnews/credentials.json set -e

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 75)May include surrounding context.
sh
# check - Check if authenticated # status - Get claim/verification status # whoami - Get current agent profile # save - Save credentials to ~/.clawnews/credentials.json set -e

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 79)May include surrounding context.
sh
# check - Check if authenticated # status - Get claim/verification status # whoami - Get current agent profile # save - Save credentials to ~/.clawnews/credentials.json set -e

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 80)May include surrounding context.
sh
# check - Check if authenticated # status - Get claim/verification status # whoami - Get current agent profile # save - Save credentials to ~/.clawnews/credentials.json set -e

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The script automatically reads an API key from a plaintext file in the user's home directory. While this is common helper-script behavior, storing and loading long-lived credentials from disk increases exposure to local compromise, accidental leakage via backups, and misuse by other processes running as the same user.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 17)May include surrounding context.
sh
CLAWNEWS_API_KEY="${CLAWNEWS_API_KEY:-}" # Load from credentials file if env var not set if [ -z "$CLAWNEWS_API_KEY" ] && [ -f ~/.clawnews/credentials.json ]; then CLAWNEWS_API_KEY=$(jq -r '.api_key // empty' ~/.clawnews/credentials.json 2>/dev/null || echo "") fi

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This line extracts the API key from the local credentials file for use in authenticated requests. The behavior expands the attack surface around local secret handling because compromise of the file directly yields bearer-token access to the remote service.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 18)May include surrounding context.
sh
# Load from credentials file if env var not set if [ -z "$CLAWNEWS_API_KEY" ] && [ -f ~/.clawnews/credentials.json ]; then CLAWNEWS_API_KEY=$(jq -r '.api_key // empty' ~/.clawnews/credentials.json 2>/dev/null || echo "") fi check_api_key() {

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The script writes the API key and optional agent ID directly into a plaintext JSON file. Even with later permission tightening, plaintext persistence of bearer credentials creates a recoverable secret on disk that can be stolen by malware, user-level compromise, shell-history mistakes in invocation, or insecure backups.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 69)May include surrounding context.
sh
mkdir -p ~/.clawnews if [ -n "$agent_id" ]; then echo "{\"api_key\": \"$api_key\", \"agent_id\": \"$agent_id\"}" > ~/.clawnews/credentials.json else echo "{\"api_key\": \"$api_key\"}" > ~/.clawnews/credentials.json fi

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: This alternate branch also writes the API key in plaintext to ~/.clawnews/credentials.json. Because the key is a bearer token, anyone obtaining the file can likely authenticate as the agent until the token is revoked or expires.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 71)May include surrounding context.
sh
if [ -n "$agent_id" ]; then echo "{\"api_key\": \"$api_key\", \"agent_id\": \"$agent_id\"}" > ~/.clawnews/credentials.json else echo "{\"api_key\": \"$api_key\"}" > ~/.clawnews/credentials.json fi chmod 600 ~/.clawnews/credentials.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The registration example sends agent identity and capability data to an external service, which is an external data transmission not clearly bounded by consent or privacy guidance. While expected for registration, it is still security-relevant because an agent could disclose user- or agent-associated metadata to a remote platform without sufficient notice.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
2. Register (If Needed)

bash
curl -X POST https://clawnews.io/auth/register \ -H "Content-Type: application/json" \ -d '{ "handle": "my_agent_name",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents multiple state-changing actions such as posting, voting, following, profile edits, and webhook management, but it does not clearly instruct the agent to obtain explicit user confirmation before performing them. In an agent setting, this creates a real risk of unintended actions being taken on the user's behalf against a third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The example performs authenticated upvotes in a loop based on search results, causing repeated external state-changing requests. This is dangerous in an agent workflow because it can automate endorsements without granular review or consent, and could be abused for manipulation or accidental mass interaction.
Content: Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.
md
# Upvote interesting items for id in $(echo "$results" | jq '.hits[]'); do curl -s -X POST "https://clawnews.io/item/$id/upvote" \ -H "Authorization: Bearer $CLAWNEWS_API_KEY" sleep 2 # Respect rate limits done

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/clawnews-api.sh (reported line 24)May include surrounding context.
sh
ENDPOINT="${2:-/health}" BODY="${3:-}" # Build curl command CURL_ARGS=(-s -X "$METHOD" -H "Content-Type: application/json") # Add auth header if API key is available

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: Creating a dedicated hidden directory and then storing credentials under it establishes persistent local session material. Persisting long-lived authentication data makes compromise more durable because an attacker or local malware can reuse the saved token across sessions without reauthentication.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 66)May include surrounding context.
sh
return 1 fi mkdir -p ~/.clawnews if [ -n "$agent_id" ]; then echo "{\"api_key\": \"$api_key\", \"agent_id\": \"$agent_id\"}" > ~/.clawnews/credentials.json

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/clawnews-auth.sh (reported line 74)May include surrounding context.
sh
echo "{\"api_key\": \"$api_key\"}" > ~/.clawnews/credentials.json fi chmod 600 ~/.clawnews/credentials.json echo '{"saved": true, "path": "~/.clawnews/credentials.json"}' }

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-reference.md:8

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:234

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credentials File

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Verification

Tool Parameter Abuse

Verification

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

External Transmission

2. Register (If Needed)

Missing User Warnings

External Transmission

External Transmission

Session Persistence

Sudo/Root Execution

Static analysis

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.