Claw Score

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:39 PM UTC
• Version: 1.0.0

Overview

This skill is for a real audit workflow, but it sends sensitive agent configuration files to an external service with overstated sanitization and without the promised payload preview.

Install only if you are comfortable sending the listed agent configuration files and workspace structure to Atlas. Review and manually redact the files first, especially memory, user, security, identity, and tool configuration files, and avoid the unpinned npx installer unless you have independently verified the package source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: submit.sh:41
• Finding: Incomplete Sanitization Can Disclose Sensitive Workspace Data## Vulnerability Details **File Location**: `submit.sh:41-49` and `submit.sh:83-85` **Vulnerability Type**: Insufficient sensitive-data redaction before external transmission **Risk Level**: High ### Vulnerable Code ```bash CONTENT=$(cat "$WORKSPACE/$file" | \ sed -E 's/[a-zA-Z0-9_-]*[Kk][Ee][Yy][a-zA-Z0-9_-]*[=:][[:space:]]*[^[:space:]\n]+/[REDACTED]/g' | \ sed -E 's/sk-[a-zA-Z0-9]+/[API_KEY_REDACTED]/g' | \ sed -E 's/xoxb-[a-zA-Z0-9-]+/[TOKEN_REDACTED]/g' | \ sed -E 's/ghp_[a-zA-Z0-9]+/[TOKEN_REDACTED]/g' | \ sed -E 's/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/[EMAIL_REDACTED]/g' | \ sed -E 's/\+?[0-9]{1,3}[-.\s]?\(?[0-9]{3}\)?[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}/[PHONE_REDACTED]/g' | \ sed -E 's/([0-9]{1,3}\.){3}[0-9]{1,3}/[IP_REDACTED]/g' | \ python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))") ``` ```bash RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \ -H "Content-Type: application/json" \ -d "$PAYLOAD") ``` ### Technical Analysis The script sends the contents of eight potentially sensitive workspace files to an external service after applying only a small collection of regular-expression substitutions. The filters recognize a limited set of token prefixes and simplistic patterns for contact information, IP addresses, and names containing `key`. This block does not reliably detect or remove numerous common secret formats, including: - PEM-encoded private keys and other multiline credentials - JSON Web Tokens - Generic bearer or authorization tokens - Password assignments that do not contain the word `key` - Database connection strings containing credentials - Cloud-provider credentials that do not match the listed prefixes - Session cookies and arbitrary application tokens - Environment-variable values generally - Credentials embedded in URLs The implementation therefore does not provide the comprehensive sanitization claimed in `SKILL ...[truncated 1560 chars]
• Remediation: ## Remediation Suggestions 1. Prefer an allowlist-based submission format that extracts only architecture information required for the audit instead of transmitting complete files. 2. Integrate a mature secret-scanning library or tool that supports private keys, JWTs, cloud credentials, bearer tokens, connection strings, passwords, cookies, and multiline values. 3. Scan both before and after redaction. Abort submission when a possible secret remains and require the user to review it manually. 4. Add automated tests containing representative credential formats and verify that none appear in the final serialized payload. 5. Exclude highly sensitive files by default and require explicit, per-file opt-in. 6. Provide a local copy of the exact final payload for inspection before transmission. 7. Document that automated redaction is best-effort rather than guaranteeing removal of all credentials or PII.

T09 · Insecure Skill Coding Practices

Warning

• Location: submit.sh:72
• Finding: Documented Payload Preview Is Missing Before External Submission## Vulnerability Details **File Location**: `SKILL.md:48` and `submit.sh:72-85` **Vulnerability Type**: Inadequate informed-consent control for sensitive-data transmission **Risk Level**: Medium ### Vulnerable Code The skill documentation promises a payload preview: ```markdown You'll see a preview of what's being sent before confirmation. ``` The implementation displays only the destination email and then requests confirmation: ```bash echo "" echo "==============================" echo "Ready to submit to Atlas for Claw Score audit." echo "Email: $EMAIL" echo "" read -p "Proceed? (y/n) " -n 1 -r echo "" if [[ $REPLY =~ ^[Yy]$ ]]; then echo "Submitting..." RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \ -H "Content-Type: application/json" \ -d "$PAYLOAD") ``` ### Technical Analysis The confirmation control does not display the final payload, redacted file contents, selected files, or collected file-tree entries. Consequently, the user cannot verify whether sanitization succeeded or whether unintended information was included. This is particularly important because the payload can contain complete copies of memory, identity, security, tool, and user-context files. The confirmation prompt establishes that a submission is about to occur, but it does not implement the specific preview safeguard described by the skill. ### Attack Path 1. A collected file contains sensitive or unintended information. 2. The script includes that information in the payload, potentially because the redaction filters do not recognize it. 3. The script displays only the report email address rather than the final outgoing data. 4. The user relies on the documented assurance that content was sanitized and approves the prompt. 5. The complete payload is transmitted without the user having had an opportunity to identify the remaining sensitive content. ### Impact Assessment This flaw increases ...[truncated 357 chars]
• Remediation: ## Remediation Suggestions 1. Display the exact serialized payload, or an equivalent faithful representation, immediately before confirmation. 2. Show a per-file list and the complete redacted contents that will be sent. 3. Show every file-tree path included in the payload. 4. Offer controls to exclude individual files or paths after previewing them. 5. Require explicit confirmation only after the preview has been presented. 6. Optionally write the final payload to a protected local temporary file for review, ensuring restrictive permissions and secure deletion afterward. 7. Update the documentation if a full preview is intentionally not provided, although implementing the promised safeguard is strongly preferred.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:75
• Finding: Unpinned npx Installation Command Creates Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md:75` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx clawhub install claw-score ``` ### Technical Analysis The installation guidance invokes `npx` without pinning the `clawhub` package to a reviewed version or validating its integrity. Depending on the local package-manager state, `npx` can retrieve a package from a configured registry and execute its command. The effective code executed by this instruction can therefore change independently of the audited project. The repository does not provide a version constraint, checksum, lockfile, expected publisher identity, or package integrity value for this command. This creates exposure to compromised future releases, registry compromise, package-name confusion, and unsafe registry configuration. ### Attack Path 1. An attacker compromises the package, publisher account, registry distribution path, or a registry selected by the user's package-manager configuration. 2. A malicious or altered release becomes the version resolved by the unpinned package name. 3. A user follows the installation instruction and runs the `npx` command. 4. `npx` retrieves and executes the altered package. 5. The package executes with the permissions of the user running the installation command. No compromise of this project repository is required once the external dependency resolution path has been subverted. ### Impact Assessment A malicious package executed by `npx` could perform arbitrary actions available to the invoking user, including reading user-accessible files, modifying the workspace, accessing environment variables, making network requests, or installing additional components. It would not automatically receive administrator privileges unless the user runs the command in an elevated context, but it could access all resources available to that user account.
• Remediation: ## Remediation Suggestions 1. Pin the installer package to a specific audited version rather than relying on the latest registry resolution. 2. Provide and verify an integrity digest or signed release artifact. 3. Document the canonical registry, exact package owner, and expected publisher identity. 4. Prefer a verified, non-executing download procedure where users inspect or validate the artifact before execution. 5. Maintain a lockfile or equivalent dependency manifest when package-manager execution is necessary. 6. Remove or disable this instruction while the distribution channel is described as unavailable or “coming soon.” 7. Advise users not to run installation commands with elevated privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## What Gets Redacted

Before submission, the skill automatically removes:
- API keys (`sk-*`, `xoxb-*`, `ghp_*`, etc.)
- Email addresses
- Phone numbers

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly submits multiple workspace markdown files plus a file tree to an external party, while claiming sanitization is sufficient and not clearly warning that architecture docs, identities, memory configs, and directory structure can still expose sensitive operational details. Even if obvious secrets are stripped, these materials can reveal internal system design, security controls, user context, and high-value targets for follow-on attacks.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Plus a file tree listing of your workspace structure.

## What Gets Sanitized (Automatically Removed)

Before submission, the skill strips:
- API keys (patterns like `sk-`, `xoxb-`, etc.)

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The installation instruction uses `npx clawhub install claw-score` without a pinned version or integrity control, which can pull whatever package version is current at execution time. If the package is compromised, typo-squatted, or updated maliciously, users could execute untrusted code during installation.

External Transmission

Medium

• Category: Data Exfiltration

Content

if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "Submitting..."
    RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "$PAYLOAD")

• Confidence: 98% confidence
• Finding: The script packages multiple workspace markdown files and a file tree, then transmits them to a hard-coded external endpoint via curl. Although it performs some redaction, the sanitization is incomplete and regex-based, so sensitive data, proprietary prompts, internal notes, tokens in unrecognized formats, and path metadata may still be exfiltrated to a third party.

Static analysis

No suspicious patterns detected.