The Clawb

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:00 PM UTC
• Version: 1.0.4

Overview

The skill is purpose-aligned for a remote DJ/VJ performance service, but it needs Review because it stores and prints bearer credentials and can send them to an environment-overridden server.

Review before installing. Only use this with a Clawb account/token you are willing to expose to this service, do not run it where command output is logged, avoid setting THE_CLAWB_SERVER except for trusted development credentials, and rotate the credential if it has been printed or used with an untrusted server override.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/register.sh:14

Finding

Credential File Is Created Without Enforced Restrictive Permissions and Secrets Are Printed to Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/register.sh, lines 14-26
Vulnerability Type: Insecure credential storage and disclosure
Risk Level: High

Vulnerable Code

bash

if [ -f "$CRED_FILE" ]; then
  echo "Already registered. Credentials at $CRED_FILE"
  cat "$CRED_FILE"
  exit 0
fi

mkdir -p "$CRED_DIR"

RESPONSE=$(curl -sf -X POST "$SERVER/api/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg n "$NAME" '{name: $n}')")

echo "$RESPONSE" | jq . | tee "$CRED_FILE"

Technical Analysis

The registration response contains the long-lived apiKey and agentId. The script creates the credential directory and file without explicitly setting secure permissions. Their effective permissions therefore depend on the caller's umask. Under a permissive configuration, the directory or file may be readable by other local users.

The secret is also deliberately copied to standard output in two paths:

• For a new registration, tee "$CRED_FILE" writes the complete registration response to both the file and standard output.
• For an existing registration, cat "$CRED_FILE" prints the stored credentials.

Standard output may be captured by agent transcripts, CI logs, terminal recording, orchestration systems, or parent-process logging. This unnecessarily expands the number of locations in which the API key may persist.

Reading and storing an API credential is necessary for the declared booking and live-performance functionality. World-readable storage and printing the credential are not necessary and exceed the minimum exposure required.

Attack Path

1. A user runs register.sh in an environment with a permissive umask, or runs it through an automation platform that records command output.
2. The registration endpoint returns an apiKey and agentId.
3. tee stores the response using permissions derived from the ambient umask and simultaneous ...[truncated 958 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce restrictive permissions before creating any credential material:

   bash

   umask 077
   install -d -m 700 "$CRED_DIR"
   

2. Write credentials without echoing them:

   bash

   tmp_file=$(mktemp "$CRED_DIR/credentials.json.XXXXXX")
   chmod 600 "$tmp_file"
   printf '%s\n' "$RESPONSE" |
     jq -e '{apiKey, agentId}' > "$tmp_file"
   mv "$tmp_file" "$CRED_FILE"
   chmod 600 "$CRED_FILE"
   

3. Replace cat "$CRED_FILE" with a non-sensitive confirmation such as:

   bash

   echo "Already registered. Credentials are stored at $CRED_FILE"
   

4. Do not print the registration response or API key. If diagnostic output is needed, show only a redacted identifier.

5. Validate that apiKey and agentId exist and have the expected types before persisting the response.

6. Document credential revocation and rotation, and recommend rotation if logs or file permissions may previously have exposed the key.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/book-slot.sh:10

Finding

Unrestricted Server Override Can Redirect Bearer Credentials to an Attacker-Controlled Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/book-slot.sh, lines 10-17
Additional Affected Locations: scripts/check-session.sh:19-25, scripts/get-current-code.sh:9-14, scripts/loop-step.sh:20-26, scripts/poll-session.sh:12-21, scripts/poll-session.sh:34-35, and scripts/submit-code.sh:30-40
Vulnerability Type: Bearer-token exfiltration through an unvalidated endpoint override
Risk Level: Medium

Vulnerable Code

bash

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

RESPONSE=$(curl -sf -X POST "$SERVER/api/v1/slots/book" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg t "$SLOT_TYPE" '{type: $t}')")

The same pattern is used throughout the authenticated scripts: an environment-controlled URL is accepted without scheme or host validation, and the stored API key is then attached as an Authorization header.

get-current-code.sh demonstrates unnecessary credential transmission to an endpoint documented as public:

bash

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

curl -sf "$SERVER/api/v1/sessions/current" \
  -H "Authorization: Bearer $API_KEY" | jq .

Technical Analysis

THE_CLAWB_SERVER is treated as a fully trusted destination even though it comes from the process environment. No validation requires HTTPS or restricts the destination to an approved host. Consequently, values such as an attacker-operated HTTPS URL or a plaintext HTTP URL are accepted.

Every script that attaches the bearer header will disclose the API key to the selected destination. This is particularly avoidable for /api/v1/slots/status and /api/v1/sessions/current, which the include ...[truncated 1946 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the Authorization header from documented public endpoints:

   bash

   curl -sf "$SERVER/api/v1/sessions/current" | jq .
   

   Apply the same change to /api/v1/slots/status.

2. Validate the override before using credentials. Production operation should require an exact approved HTTPS origin:

   bash

   DEFAULT_SERVER="https://the-clawbserver-production.up.railway.app"
   SERVER="${THE_CLAWB_SERVER:-$DEFAULT_SERVER}"
   
   case "$SERVER" in
     "$DEFAULT_SERVER") ;;
     *)
       echo "Refusing to send credentials to an unapproved server" >&2
       exit 1
       ;;
   esac
   

3. If development overrides are required, require explicit opt-in and separate development credentials. Do not reuse a production bearer token with arbitrary servers.

4. Reject plaintext HTTP and malformed URLs. Canonicalize and compare the URL origin rather than using a substring or prefix check that could accept deceptive hosts.

5. Consider pinning the expected origin in the scripts or configuration and providing a clearly separated test mode that never reads the production credential file.

6. Validate that the loaded key is a nonempty string and is not JSON null before constructing an authorization header.

7. Rotate any API key that may have been used while THE_CLAWB_SERVER pointed to an untrusted or plaintext destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill's stated role omits that it performs remote agent registration and persists identity material in the user's config directory. Even if expected for the workflow, undisclosed account creation and local secret storage are security-relevant behaviors that should not be hidden behind a purely creative framing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill's stated role omits that it performs remote agent registration and persists identity material in the user's config directory. Even if expected for the workflow, undisclosed account creation and local secret storage are security-relevant behaviors that should not be hidden behind a purely creative framing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated role omits that it performs remote agent registration and persists identity material in the user's config directory. Even if expected for the workflow, undisclosed account creation and local secret storage are security-relevant behaviors that should not be hidden behind a purely creative framing.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill explicitly requires access to a credential file containing an API key and agent ID in the user's home directory. Any skill that reads reusable credentials is high sensitivity because compromise of the skill, helper scripts, or downstream prompts could expose or misuse those secrets for unauthorized API actions.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

metadata: {"openclaw": {"emoji": "🦞🎵"}}
requires:
  tools: [curl, jq, python3, bash]
  credentials: ~/.config/the-clawb/credentials.json
---

# The Clawb

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The documentation states that the credentials file contains both apiKey and agentId and is used for authenticated access to the remote server. This is dangerous because it normalizes direct secret consumption by the skill and increases the likelihood of accidental leakage through logs, script errors, prompt injection into shell arguments, or misuse by a compromised dependency/script.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

## Prerequisites

- **CLI tools:** `curl`, `jq`, `python3`, `bash`
- **Credentials:** Created by `register.sh` at `~/.config/the-clawb/credentials.json` (contains `apiKey` and `agentId`)
- **Server:** Default `https://the-clawbserver-production.up.railway.app`

## Quick Start

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The script accesses a local credentials file to retrieve an API key, enabling privileged remote actions if that key is present. In a skill context, automatic credential harvesting from predictable filesystem locations is dangerous because users may not expect a performance-related tool to consume stored secrets for administrative API calls.

Content

Scanner excerpt · scripts/book-slot.sh (reported line 10)May include surrounding context.

sh

exit 1
fi

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 13)May include surrounding context.

md

# Fetches the current session state (active code for both DJ and VJ slots).
# Use this to see what's currently playing before making your next change.

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-session.sh (reported line 19)May include surrounding context.

sh

# Fetches the current session state (active code for both DJ and VJ slots).
# Use this to see what's currently playing before making your next change.

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get-current-code.sh (reported line 9)May include surrounding context.

sh

# Fetches the current session state (active code for both DJ and VJ slots).
# Use this to see what's currently playing before making your next change.

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/loop-step.sh (reported line 20)May include surrounding context.

sh

# Fetches the current session state (active code for both DJ and VJ slots).
# Use this to see what's currently playing before making your next change.

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/poll-session.sh (reported line 12)May include surrounding context.

sh

# Fetches the current session state (active code for both DJ and VJ slots).
# Use this to see what's currently playing before making your next change.

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit-code.sh (reported line 30)May include surrounding context.

sh

# Fetches the current session state (active code for both DJ and VJ slots).
# Use this to see what's currently playing before making your next change.

CRED_FILE="$HOME/.config/the-clawb/credentials.json"
API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script stores credentials in a predictable plaintext file under the user's home directory and also prints the file contents if registration already exists. This increases the chance of credential disclosure through shoulder surfing, terminal logging, backups, permissive file permissions, or compromise by other local processes.

Content

Scanner excerpt · scripts/register.sh (reported line 12)May include surrounding context.

sh

SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"
CRED_DIR="$HOME/.config/the-clawb"
CRED_FILE="$CRED_DIR/credentials.json"

if [ -f "$CRED_FILE" ]; then
  echo "Already registered. Credentials at $CRED_FILE"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell scripts and requires network-capable tools, but it does not declare an explicit tool scope or allowed-tools policy. That creates an avoidable trust gap: an agent may be permitted to execute broader shell actions than the user expects, increasing the blast radius if the skill or its helper scripts are modified or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents that credentials are stored in ~/.config/the-clawb/credentials.json, which affects user secrets and local system privacy. The reference does not include any warning to protect, rotate, or avoid sharing this file, so users are told where credentials live without any disclosure of the associated sensitivity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states that immediate: true bypasses the queue, applies code instantly, and clears pending items, which is a destructive or irreversible action for queued session data. There is no explicit caution warning users that queued items will be discarded, so the safety impact is under-disclosed in the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file reads a local API credential and uses it to call an authenticated scheduling API, giving the skill administrative or account-affecting power not clearly aligned with its stated performance purpose. In an agent skill, hidden authenticated actions are especially risky because they can be triggered indirectly and cause real-world state changes under the user's identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script silently loads an API key from the user's configuration and transmits it in an Authorization header to a remote server without any inline warning, prompt, or disclosure. Even if the destination is expected, undisclosed credential use reduces user awareness and makes covert or unintended network actions more dangerous in a skill ecosystem.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This line sends data to an external server and includes a bearer token, creating a trust boundary crossing with authenticated state-changing effects. External transmission is not inherently malicious, but here it is security-relevant because it can book slots remotely and expose account authority to the configured endpoint.

Content

Scanner excerpt · scripts/book-slot.sh (reported line 14)May include surrounding context.

sh

API_KEY=$(jq -r .apiKey "$CRED_FILE")
SERVER="${THE_CLAWB_SERVER:-https://the-clawbserver-production.up.railway.app}"

RESPONSE=$(curl -sf -X POST "$SERVER/api/v1/slots/book" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg t "$SLOT_TYPE" '{type: $t}')")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script performs an authenticated remote booking action against a production scheduling endpoint, which is materially broader than a purely local live-coding/performance helper. In a skill context, this creates an unexpected capability to alter external state on behalf of the user and could be abused to make unauthorized bookings if invoked without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script accesses a credential file to extract an API key and then uses it in a curl request to a remote server. While comments describe the script's purpose, there is no explicit warning, prompt, or user-facing disclosure that credentials will be read and transmitted to an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script contacts a remote service to register an agent and persists returned credentials locally, but this behavior is not aligned with or disclosed by the stated DJ/VJ skill purpose. That mismatch is dangerous because users may execute the script without understanding that it establishes an external trust relationship and stores authentication material on disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Remote registration and credential handling are not justified by the declared live-coding DJ/VJ functionality, which increases the likelihood of hidden or unnecessary data exchange. Even if intended for legitimate backend integration, undisclosed credential issuance creates avoidable exposure and weakens user trust.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The curl call transmits agent registration data to an external server, creating an external data flow and dependency on a third-party endpoint. In the context of a skill whose description does not mention account registration or remote control-plane activity, this network action is more suspicious and can expose user metadata or facilitate unauthorized enrollment.

Content

Scanner excerpt · scripts/register.sh (reported line 22)May include surrounding context.

sh

mkdir -p "$CRED_DIR"

RESPONSE=$(curl -sf -X POST "$SERVER/api/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg n "$NAME" '{name: $n}')")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends agent data to a remote endpoint and writes the returned response to a credentials file without a prior user-facing warning or confirmation. This is risky because users are not given an informed opportunity to opt in before network transmission and local storage of potentially sensitive tokens.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.