ClawHub
Back to skill

Security audit

Claw Score

Security checks for vulnerabilities and agentic risk

Overview

This skill is for a real audit workflow, but it sends sensitive agent configuration files to an external service with overstated sanitization and without the promised payload preview.

Install only if you are comfortable sending the listed agent configuration files and workspace structure to Atlas. Review and manually redact the files first, especially memory, user, security, identity, and tool configuration files, and avoid the unpinned npx installer unless you have independently verified the package source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
submit.sh:41
Finding

Incomplete Sanitization Can Disclose Sensitive Workspace Data

Content
View full analysis

Vulnerability Details

File Location: submit.sh:41-49 and submit.sh:83-85
Vulnerability Type: Insufficient sensitive-data redaction before external transmission
Risk Level: High

Vulnerable Code

bash
CONTENT=$(cat "$WORKSPACE/$file" | \
    sed -E 's/[a-zA-Z0-9_-]*[Kk][Ee][Yy][a-zA-Z0-9_-]*[=:][[:space:]]*[^[:space:]\n]+/[REDACTED]/g' | \
    sed -E 's/sk-[a-zA-Z0-9]+/[API_KEY_REDACTED]/g' | \
    sed -E 's/xoxb-[a-zA-Z0-9-]+/[TOKEN_REDACTED]/g' | \
    sed -E 's/ghp_[a-zA-Z0-9]+/[TOKEN_REDACTED]/g' | \
    sed -E 's/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/[EMAIL_REDACTED]/g' | \
    sed -E 's/\+?[0-9]{1,3}[-.\s]?\(?[0-9]{3}\)?[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}/[PHONE_REDACTED]/g' | \
    sed -E 's/([0-9]{1,3}\.){3}[0-9]{1,3}/[IP_REDACTED]/g' | \
    python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
bash
RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \
    -H "Content-Type: application/json" \
    -d "$PAYLOAD")

Technical Analysis

The script sends the contents of eight potentially sensitive workspace files to an external service after applying only a small collection of regular-expression substitutions. The filters recognize a limited set of token prefixes and simplistic patterns for contact information, IP addresses, and names containing key.

This block does not reliably detect or remove numerous common secret formats, including:

  • PEM-encoded private keys and other multiline credentials
  • JSON Web Tokens
  • Generic bearer or authorization tokens
  • Password assignments that do not contain the word key
  • Database connection strings containing credentials
  • Cloud-provider credentials that do not match the listed prefixes
  • Session cookies and arbitrary application tokens
  • Environment-variable values generally
  • Credentials embedded in URLs

The implementation therefore does not provide the comprehensive sanitization claimed in `SKILL ...[truncated 1560 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer an allowlist-based submission format that extracts only architecture information required for the audit instead of transmitting complete files.
  2. Integrate a mature secret-scanning library or tool that supports private keys, JWTs, cloud credentials, bearer tokens, connection strings, passwords, cookies, and multiline values.
  3. Scan both before and after redaction. Abort submission when a possible secret remains and require the user to review it manually.
  4. Add automated tests containing representative credential formats and verify that none appear in the final serialized payload.
  5. Exclude highly sensitive files by default and require explicit, per-file opt-in.
  6. Provide a local copy of the exact final payload for inspection before transmission.
  7. Document that automated redaction is best-effort rather than guaranteeing removal of all credentials or PII.

T09 · Insecure Skill Coding Practices

Warning
Location
submit.sh:72
Finding

Documented Payload Preview Is Missing Before External Submission

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:48 and submit.sh:72-85
Vulnerability Type: Inadequate informed-consent control for sensitive-data transmission
Risk Level: Medium

Vulnerable Code

The skill documentation promises a payload preview:

markdown
You'll see a preview of what's being sent before confirmation.

The implementation displays only the destination email and then requests confirmation:

bash
echo ""
echo "=============================="
echo "Ready to submit to Atlas for Claw Score audit."
echo "Email: $EMAIL"
echo ""
read -p "Proceed? (y/n) " -n 1 -r
echo ""

if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "Submitting..."
    RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "$PAYLOAD")

Technical Analysis

The confirmation control does not display the final payload, redacted file contents, selected files, or collected file-tree entries. Consequently, the user cannot verify whether sanitization succeeded or whether unintended information was included.

This is particularly important because the payload can contain complete copies of memory, identity, security, tool, and user-context files. The confirmation prompt establishes that a submission is about to occur, but it does not implement the specific preview safeguard described by the skill.

Attack Path

  1. A collected file contains sensitive or unintended information.
  2. The script includes that information in the payload, potentially because the redaction filters do not recognize it.
  3. The script displays only the report email address rather than the final outgoing data.
  4. The user relies on the documented assurance that content was sanitized and approves the prompt.
  5. The complete payload is transmitted without the user having had an opportunity to identify the remaining sensitive content.

Impact Assessment

This flaw increases ...[truncated 357 chars]

Remediation
View remediation

Remediation Suggestions

  1. Display the exact serialized payload, or an equivalent faithful representation, immediately before confirmation.
  2. Show a per-file list and the complete redacted contents that will be sent.
  3. Show every file-tree path included in the payload.
  4. Offer controls to exclude individual files or paths after previewing them.
  5. Require explicit confirmation only after the preview has been presented.
  6. Optionally write the final payload to a protected local temporary file for review, ensuring restrictive permissions and secure deletion afterward.
  7. Update the documentation if a full preview is intentionally not provided, although implementing the promised safeguard is strongly preferred.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:75
Finding

Unpinned npx Installation Command Creates Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:75
Vulnerability Type: Unpinned executable third-party dependency
Risk Level: Medium

Vulnerable Code

bash
npx clawhub install claw-score

Technical Analysis

The installation guidance invokes npx without pinning the clawhub package to a reviewed version or validating its integrity. Depending on the local package-manager state, npx can retrieve a package from a configured registry and execute its command.

The effective code executed by this instruction can therefore change independently of the audited project. The repository does not provide a version constraint, checksum, lockfile, expected publisher identity, or package integrity value for this command. This creates exposure to compromised future releases, registry compromise, package-name confusion, and unsafe registry configuration.

Attack Path

  1. An attacker compromises the package, publisher account, registry distribution path, or a registry selected by the user's package-manager configuration.
  2. A malicious or altered release becomes the version resolved by the unpinned package name.
  3. A user follows the installation instruction and runs the npx command.
  4. npx retrieves and executes the altered package.
  5. The package executes with the permissions of the user running the installation command.

No compromise of this project repository is required once the external dependency resolution path has been subverted.

Impact Assessment

A malicious package executed by npx could perform arbitrary actions available to the invoking user, including reading user-accessible files, modifying the workspace, accessing environment variables, making network requests, or installing additional components. It would not automatically receive administrator privileges unless the user runs the command in an elevated context, but it could access all resources available to that user account.

Remediation
View remediation

Remediation Suggestions

  1. Pin the installer package to a specific audited version rather than relying on the latest registry resolution.
  2. Provide and verify an integrity digest or signed release artifact.
  3. Document the canonical registry, exact package owner, and expected publisher identity.
  4. Prefer a verified, non-executing download procedure where users inspect or validate the artifact before execution.
  5. Maintain a lockfile or equivalent dependency manifest when package-manager execution is necessary.
  6. Remove or disable this instruction while the distribution channel is described as unavailable or “coming soon.”
  7. Advise users not to run installation commands with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 71)May include surrounding context.

md
## What Gets Redacted

Before submission, the skill automatically removes:
- API keys (`sk-*`, `xoxb-*`, `ghp_*`, etc.)
- Email addresses
- Phone numbers

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly submits multiple workspace markdown files plus a file tree to an external party, while claiming sanitization is sufficient and not clearly warning that architecture docs, identities, memory configs, and directory structure can still expose sensitive operational details. Even if obvious secrets are stripped, these materials can reveal internal system design, security controls, user context, and high-value targets for follow-on attacks.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
Plus a file tree listing of your workspace structure.

## What Gets Sanitized (Automatically Removed)

Before submission, the skill strips:
- API keys (patterns like `sk-`, `xoxb-`, etc.)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation instruction uses npx clawhub install claw-score without a pinned version or integrity control, which can pull whatever package version is current at execution time. If the package is compromised, typo-squatted, or updated maliciously, users could execute untrusted code during installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The script packages multiple workspace markdown files and a file tree, then transmits them to a hard-coded external endpoint via curl. Although it performs some redaction, the sanitization is incomplete and regex-based, so sensitive data, proprietary prompts, internal notes, tokens in unrecognized formats, and path metadata may still be exfiltrated to a third party.

Content

Scanner excerpt · submit.sh (reported line 83)May include surrounding context.

sh
if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "Submitting..."
    RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "$PAYLOAD")

Static analysis

No suspicious patterns detected.