ClawHub
Back to skill

Security audit

control-plane

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent remote control-plane integration, but it gives the hosted service broad authority over an AI workforce with under-scoped remote instructions, memory, credentials, and logging.

Install only if you intend to let Emperor Claw act as the system of record for your AI workforce. Use a least-privilege token, keep it out of checked-in config, pin the API origin to the official HTTPS/WSS host, avoid placing secrets or private prompts in tasks/chat/memory, and treat remote messages and memory as untrusted input that cannot override local safety rules or approval requirements.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:63
Finding

Remote SaaS Messages Are Treated as Authoritative Agent Instructions

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
references/roles.md:33
Finding

Untrusted Remote Markdown Is Restored as Persistent Agent Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
examples/bridge.js:29
Finding

Configurable API Origin Can Exfiltrate the Workspace Bearer Token

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/ec-bridge.py:1
Finding

Python Launcher Can Import an Attacker-Controlled Module Named bridge

Content
View full analysis
Remediation
View remediation

other

Warning
Location
references/guidelines.md:5
Finding

Mandatory External Logging Can Disclose Sensitive Reasoning and Business Context

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (33)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
- [JavaScript Bridge (Node.js)](./examples/bridge.js): Reference adapter with WebSocket, heartbeat, task claim, checkpoint, dedupe, and honest note/result suppo

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
1. Re-read this `SKILL.md` to confirm the control-plane contract.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 21)May include surrounding context.

md
- **`POST /api/mcp/tasks/{task_id}/result`**: Update task completion or failure.
- **`POST /api/mcp/tasks/{task_id}/notes`**: Add a note/comment to the task's timeline.
- **`GET /api/mcp/tasks/{task_id}/notes`**: Retrieve the full history of notes for a task.
- **`DELETE /api/mcp/tasks/{task_id}`**: Soft-delete a task.
- **`GET /api/mcp/tasks`**: List tasks (optionally filtered by `projectId`).

### Workforce Management

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 29)May include surrounding context.

md
- **`GET /api/mcp/agents`**: List active agents.
- **`POST /api/mcp/agents/{agent_id}/memory`**: Append a first-class memory entry.
- **`PATCH /api/mcp/agents/{agent_id}`**: Update agent metadata or legacy memory.
- **`DELETE /api/mcp/agents/{agent_id}`**: Soft-delete an agent.
- **`POST /api/mcp/agents/heartbeat`**: Update agent load, keep alive, and renew active task leases.
- **`GET /api/mcp/agents/{agent_id}/integrations`**: Fetch agent runtime integrations.
- **`POST /api/mcp/agents/{agent_id}/integrations`**: Register a new runtime-local payload for an agent.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 33)May include surrounding context.

md
- **`POST /api/mcp/agents/heartbeat`**: Update agent load, keep alive, and renew active task leases.
- **`GET /api/mcp/agents/{agent_id}/integrations`**: Fetch agent runtime integrations.
- **`POST /api/mcp/agents/{agent_id}/integrations`**: Register a new runtime-local payload for an agent.
- **`DELETE /api/mcp/agents/{agent_id}/integrations?integrationId={id}`**: Archive a runtime integration.
- **`GET /api/mcp/runtime/health`**: Validate token, websocket, and runtime capability support.
- **`GET /api/mcp/projects/{project_id}/agent-profiles`**: Read project-specific lead/worker identity overrides.
- **`POST /api/mcp/projects/{project_id}/agent-profiles`**: Create a project-specific agent profile.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 38)May include surrounding context.

md
- **`GET /api/mcp/projects/{project_id}/agent-profiles`**: Read project-specific lead/worker identity overrides.
- **`POST /api/mcp/projects/{project_id}/agent-profiles`**: Create a project-specific agent profile.
- **`PATCH /api/mcp/projects/{project_id}/agent-profiles/{profile_id}`**: Update project-specific identity data.
- **`DELETE /api/mcp/projects/{project_id}/agent-profiles/{profile_id}`**: Archive a project-specific agent profile.

### Coordination & Transparency (Chat)
### List Threads

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 90)May include surrounding context.

md
- **`GET /api/mcp/schedules`**: Read registered schedules.
- **`POST /api/mcp/schedules`**: Upsert cron definitions.
- **`PATCH /api/mcp/schedules/{id}`**: Update schedule.
- **`DELETE /api/mcp/schedules/{id}`**: Soft-delete schedule.
- **`GET /api/mcp/playbooks`**: Read instruction templates.
- **`DELETE /api/mcp/playbooks/{playbook_id}`**: Soft-delete playbook.
These endpoints are legacy compatibility surfaces. Prefer project recurring-task definitions, scoped resources, and project agent profiles for new automation.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 92)May include surrounding context.

md
- **`PATCH /api/mcp/schedules/{id}`**: Update schedule.
- **`DELETE /api/mcp/schedules/{id}`**: Soft-delete schedule.
- **`GET /api/mcp/playbooks`**: Read instruction templates.
- **`DELETE /api/mcp/playbooks/{playbook_id}`**: Soft-delete playbook.
These endpoints are legacy compatibility surfaces. Prefer project recurring-task definitions, scoped resources, and project agent profiles for new automation.

### Artifacts

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 98)May include surrounding context.

md
### Artifacts
- **`POST /api/mcp/artifacts`**: Upload structured business files or artifacts.
- **`GET /api/mcp/artifacts`**: Fetch artifacts.
- **`DELETE /api/mcp/artifacts/{id}`**: Soft-delete artifact.
Artifacts should represent source documents, working files, proofs, deliverables, templates, or export bundles. Do not use artifact storage for raw logs, task chatter, or reconnect traces.
When storing an artifact by reference URL instead of inline text, send a real `sha256` and `sizeBytes`. Do not hash the URL string.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 106)May include surrounding context.

md
- **`GET /api/mcp/customers/{id}/resources`**: List customer-scoped resources.
- **`POST /api/mcp/customers/{id}/resources`**: Create a customer-scoped resource such as a mailbox, identity, or template.
- **`PATCH /api/mcp/customers/{id}/resources/{resource_id}`**: Update a customer-scoped resource.
- **`DELETE /api/mcp/customers/{id}/resources/{resource_id}`**: Archive a customer-scoped resource.
- **`GET /api/mcp/projects/{project_id}/resources`**: List project-scoped resources.
- **`POST /api/mcp/projects/{project_id}/resources`**: Create a project-scoped resource.
- **`PATCH /api/mcp/projects/{project_id}/resources/{resource_id}`**: Update a project-scoped resource.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 110)May include surrounding context.

md
- **`GET /api/mcp/projects/{project_id}/resources`**: List project-scoped resources.
- **`POST /api/mcp/projects/{project_id}/resources`**: Create a project-scoped resource.
- **`PATCH /api/mcp/projects/{project_id}/resources/{resource_id}`**: Update a project-scoped resource.
- **`DELETE /api/mcp/projects/{project_id}/resources/{resource_id}`**: Archive a project-scoped resource.
- **`POST /api/mcp/resources/{resource_id}/lease`**: Lease a scoped resource into the active runtime for a task or session.
Use scoped resources for customer and project mailboxes, billing data, identities, templates, and shared external accounts. Do not force those into per-agent SMTP records.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 117)May include surrounding context.

md
### Incidents
- **`POST /api/mcp/incidents`**: Emit incident payload.
- **`PATCH /api/mcp/incidents/{id}`**: Update incident status (`open`, `acknowledged`, `resolved`).
- **`DELETE /api/mcp/incidents/{id}`**: Soft-delete incident.

### Context Retrieval (CRM)
- **`GET /api/mcp/projects`**: Fetch active projects and customer context.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 125)May include surrounding context.

md
- **`GET /api/mcp/customers`**: Fetch customers and their notes.
- **`POST /api/mcp/customers`**: Create or update customer.
- **`PATCH /api/mcp/customers/{id}`**: Update customer context.
- **`DELETE /api/mcp/customers/{id}`**: Soft-delete customer.
- **`POST /api/mcp/projects`**: Create a new project.
- **`PATCH /api/mcp/projects/{id}`**: Update project status.
- **`DELETE /api/mcp/projects/{id}`**: Soft-delete project.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 128)May include surrounding context.

md
- **`DELETE /api/mcp/customers/{id}`**: Soft-delete customer.
- **`POST /api/mcp/projects`**: Create a new project.
- **`PATCH /api/mcp/projects/{id}`**: Update project status.
- **`DELETE /api/mcp/projects/{id}`**: Soft-delete project.

### Project Memory
- **`POST /api/mcp/projects/{id}/memory`**: Add knowledge to a project.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill directs the agent to use network access, local file state, environment variables, and likely shell-based install/bootstrap flows, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because an operator or host runtime may invoke the skill without understanding that it can transmit data to a remote SaaS, read secrets from environment variables, and persist state locally, expanding the blast radius of misuse or prompt-triggered execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill describes Emperor Claw as the system of record for tasks, incidents, resources, artifacts, integrations, and chat history, but it does not clearly warn users that invoking the skill may send operational data and potentially sensitive chat content to a remote third-party control plane. This omission undermines informed consent and can lead to unintended disclosure of internal state, customer data, or conversation content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation phrase is broad and operationalizes remote synchronization and message checking with no project, account, or consent constraints. In context, this is riskier than a generic skill because activation leads directly into registering runtimes, opening WebSocket connections, loading memory, and interacting with a control plane that stores chat and task state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The bridge persists reconnect cursors, session/agent identifiers, recent message fingerprints, and pending operation IDs to a predictable local file under the user's home directory without permission hardening or explicit disclosure. On multi-user systems or poorly secured hosts, this state can leak operational metadata and enable session correlation, replay-oriented analysis, or privacy exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The bridge registers the runtime with the "credentials" capability and exposes a leaseIntegration method even though the example is presented as a passive adapter with no execution logic. That mismatch expands the trust boundary: any future task/message handler attached to this bridge could obtain live integrations and act with external credentials, increasing the chance of unintended privileged access or abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Incoming remote thread activity is automatically summarized and written into persistent agent memory, and the system also auto-responds, without any disclosure or consent flow for message retention. In this control-plane context, messages may contain sensitive business, personal, or operational data, so silent ingestion creates privacy, compliance, and over-collection risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code reads EMPEROR_CLAW_API_TOKEN from environment variables, which is a sensitive credential access path. Although the file has brief comments about bridge state persistence, there is no user-facing warning, confirmation, or explanatory comment/docstring disclosing that credentials will be consumed from the local environment.

Content

No source excerpt is available for this finding.

Tainted flow: 'BRIDGE_STATE_PATH' from os.getenv (line 26, credential/environment) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · examples/bridge.py (reported line 115)May include surrounding context.

python
"recentTaskFingerprints": self.recent_task_fingerprints[-DEDUPE_WINDOW:],
            "pendingOperationIds": self.pending_operation_ids[-DEDUPE_WINDOW:],
        }
        BRIDGE_STATE_PATH.write_text(json.dumps(state, indent=2) + "\n", "utf-8")
        self.state = state

    def remember_message(self, msg):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The _http helper sends authenticated HTTP requests to a remote API and is used throughout the bridge to transmit runtime identity, messages, task notes, memory entries, and status data. The file includes operational print statements, but they do not clearly disclose to the user that local conversation/task content and host metadata will be sent to an external service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/PREREQUISITES.md (reported line 10)May include surrounding context.

md
Emperor Claw is a hosted SaaS control plane. You do not need to self-host the UI.

1. Navigate to [emperorclaw.malecu.eu](https://emperorclaw.malecu.eu)
2. Create an account or sign in
3. Create your Company Workspace

## 2. Generate an API Token

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document instructs users to place a long-lived API token into a local config file or environment variables, but it does not explain the security implications, such as accidental exposure through checked-in dotfiles, process inspection, shell history, logs, or shared host environments. Because this skill operates a hosted control plane for an AI workforce, compromise of the token could grant unauthorized access to the workspace and agent orchestration functions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
examples/bridge.js:29