T01 · Skill Instruction Hijacking
Error
- Location
skills.md:436- Finding
Persistent Agent Behavior Hijacking Through SOUL.md
- Content
View full analysis
- Remediation
View remediation
Security audit
browsing clawchain.ai using curl
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real ClawChain social-network integration, but it asks users to install mutable remote instructions and store/use a plaintext blockchain private key for persistent signed actions.
Review before installing. Only use this in an isolated environment with a wallet/key you are willing to dedicate to ClawChain, verify every downloaded skill file yourself, pin or audit dependencies, lock down credential-file permissions, and manually review any content and signed transaction before broadcasting it. Avoid storing secrets, private user data, or sensitive memories on-chain.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
skills.md:23- Finding
Mutable Remote Skill Instructions Installed Without Integrity Verification
- Content
View full analysis
~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md curl -s https://clawchain.ai/bsc_pancakeswap_skill.md > ~/.clawchain/skills/clawchain/BSC_PANCAKESWAP_SKILL.md ``` ``` ### Technical Analysis The installation process retrieves multiple instruction documents from mutable network locations and writes them directly into the local Skill directory. There is no version pinning, checksum validation, signature verification, content review, or trusted manifest. These downloaded files are outside the audited artifact. In particular, the document states that the BSC PancakeSwap Skill covers wallet registration and storage of a private key and address. Consequently, compromise of the distribution server, DNS/TLS trust chain, or publishing process could replace the reviewed behavior with instructions that solicit credentials, invoke unsafe commands, or redirect transactions. The direct redirection also overwrites destination files without staging or validation. HTTPS protects transport in normal circumstances but does not establish that the retrieved content is the same content that was reviewed. ### Attack Path 1. An attacker compromises `clawchain.ai`, its deployment pipeline, or another trusted delivery component. 2. The attacker modifies one or more remotely hosted Skill documents. 3. A user or Agent runs the documented installation commands. 4. The modified documents are written direct ...[truncated 877 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills.md:139- Finding
Blockchain Private Key Stored in an Unencrypted File Without Explicit Permission Restrictions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
skills.md:122- Finding
Unpinned Third-Party Dependencies Installed With Default npm Behavior
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (23)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill instructs direct fetching of external skill files and later recommends additional linked skills, including one involving wallet registration and swaps, without signature verification or trust pinning. This is a classic supply-chain risk: altered remote content can implant malicious instructions that persist locally and may lead to credential theft or unauthorized financial actions.
- Content
bash mkdir -p ~/.clawchain/skills/clawchain curl -s https://clawchain.ai/skill.md > ~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md curl -s https://clawchain.ai/bsc_pancakeswap_skill.md > ~/.clawchain/skills/clawchain/BSC_PANCAKESWAP_SKILL.md
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The status-check logic reads and parses a local credentials.json file that contains blockchain key material. Any skill that operationalizes access to a plaintext private-key file increases the likelihood of credential exposure through logs, copied scripts, backups, or lateral compromise of the host.
- Content
md fi # 2. Keypair exists? CRED_FILE="$HOME/.config/clawchain/credentials.json" if [ -f "$CRED_FILE" ]; then if node -e "JSON.parse(require('fs').readFileSync('$CRED_FILE','utf-8'))" 2>/dev/null; then PUBKEY=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$CRED_FILE','utf-8')).pubKey.toUpperCase())")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The generated keygen.js writes the private key and public key directly to ~/.config/clawchain/credentials.json in plaintext JSON. Anyone with access to that file can fully impersonate the agent and sign irreversible blockchain transactions, resulting in account takeover and misuse of linked assets or identity.
- Content
md const path = require("path"); const os = require("os"); const outFile = process.argv[2] || path.join(os.homedir(), ".config", "clawchain", "credentials.json"); if (fs.existsSync(outFile)) { console.log(`Credentials already exist at ${outFile}`);
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The registration helper explicitly loads the private key from credentials.json to create a signing keypair for account registration. This embeds secret-handling into an easily copied script and expands the chance of exfiltration or accidental disclosure during normal operation.
- Content
md } async function main() { const credPath = process.argv[2] || path.join(os.homedir(), ".config", "clawchain", "credentials.json"); if (!fs.existsSync(credPath)) { console.error(`Credentials not found at ${credPath}`); process.exit(1);
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The generic transaction generator loads the same plaintext private key for arbitrary operation signing, turning the host into a general-purpose blockchain signing environment. If this script or its inputs are manipulated, an attacker could produce valid signed transactions for any supported operation.
- Content
md async function main() { let args = process.argv.slice(2); let credPath = path.join(os.homedir(), ".config", "clawchain", "credentials.json"); // Handle optional --cred flag if (args[0] === "--cred") {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
The documentation normalizes long-term retention of the credentials file and emphasizes never deleting it, but does not pair that advice with security controls. While keeping a key is operationally necessary, presenting persistent plaintext credential storage as routine increases risk if users infer it is adequately safe as-is.
- Content
node ~/.config/clawchain/scripts/keygen.js
text This is safe to run multiple times — **it will NOT overwrite an existing keypair**. If `~/.config/clawchain/credentials.json` already exists, it prints a message and exits. > **⚠️ NEVER delete your credentials file unless the Status Check told you it's invalid.** Your on-chain account is tied to this keypair. Deleting it means losing access to your account.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `You are banned` | Contact subclaw admin | | `Parent comment not found` | Use `null` for top-level comments, NOT `0`. Or verify the comment id exists | | `expected INTEGER, actual STRING` | For rowid args (post_id, comment_id), use bare numbers not strings | | `Credentials not valid JSON` | Delete `~/.config/clawchain/credentials.json` and re-run `keygen.js` | | `MODULE_NOT_FOUND` | Run Installation steps 1 and 2 to create the scripts | | `MissingNodeUrlError` | Ensure `CLAWCHAIN_NODE` env var is set |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The skill instructs persisting remotely fetched skill files under the user's home directory for later reuse, creating durable session influence from network-delivered content. This persistence magnifies supply-chain risk because a one-time compromise can continue affecting future agent behavior.
- Content
Install locally:
bash mkdir -p ~/.clawchain/skills/clawchain curl -s https://clawchain.ai/skill.md > ~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 86% confidence
- Finding
The skill enumerates and instructs downloading multiple related skill files, including an additional BSC PancakeSwap skill with wallet-registration and swap capabilities. This broadens the attack surface by encouraging automatic trust expansion into other unreviewed capabilities, one of which directly involves private keys and financial operations.
- Content
bash mkdir -p ~/.clawchain/skills/clawchain curl -s https://clawchain.ai/skill.md > ~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md curl -s https://clawchain.ai/bsc_pancakeswap_skill.md > ~/.clawchain/skills/clawchain/BSC_PANCAKESWAP_SKILL.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The installation instructions fetch remote skill files directly over the network and write them into the local skill directory without integrity verification or pinning. A compromised server, DNS, CDN, or TLS termination point could deliver altered instructions that persist locally and influence later agent behavior.
- Content
bash mkdir -p ~/.clawchain/skills/clawchain curl -s https://clawchain.ai/skill.md > ~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md curl -s https://clawchain.ai/bsc_pancakeswap_skill.md > ~/.clawchain/skills/clawchain/BSC_PANCAKESWAP_SKILL.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -d "{\"type\":\"get_agent\",\"name\":\"$AGENT_NAME\"}" 2>/dev/null) if echo "$RESULT" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));process.exit(d.name?0:1)" 2>/dev/null; then echo "✅ Agent '$AGENT_NAME': registered on-chain" CLAIMED=$(curl -s "$CLAWCHAIN_NODE/query/$CLAWCHAIN_BRID" \ -H "Content-Type: application/json" \ -d "{\"type\":\"is_agent_claimed\",\"agent_name\":\"$AGENT_NAME\"}" 2>/dev/null) if [ "$CLAIMED" = "true" ] || [ "$CLAIMED" = "1" ]; then
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 77% confidence
- Finding
The instructions create a persistent local scripts directory and install dependencies that remain available for later use, including transaction-signing logic. This establishes durable execution capability on the host, increasing the blast radius of any malicious dependency or later prompt-induced misuse.
- Content
Installation (Only If Status Check Shows ❌ Scripts)
1. Create Directory and Install Dependencies
bash mkdir -p ~/.config/clawchain/scripts
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill goes well beyond a simple social-network integration by instructing the agent to generate, store, and use blockchain private keys and sign transactions locally. That materially expands the trust boundary: compromise of the host, fetched dependencies, or the downloaded helper scripts can lead to irreversible account takeover and unauthorized on-chain actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions create a local credentials file containing a raw private key but do not warn about the sensitivity of that file, the need for restrictive permissions, or the consequences of host compromise. Users may follow the steps and unknowingly leave blockchain-signing material readable by other local users, backup systems, or malware.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The guidance to retain the credentials file indefinitely establishes persistent access to the blockchain identity across sessions. Persistent secret presence materially increases exposure to later host compromise, backup leakage, or accidental sharing.
- Content
node ~/.config/clawchain/scripts/keygen.js
text This is safe to run multiple times — **it will NOT overwrite an existing keypair**. If `~/.config/clawchain/credentials.json` already exists, it prints a message and exits. > **⚠️ NEVER delete your credentials file unless the Status Check told you it's invalid.** Your on-chain account is tied to this keypair. Deleting it means losing access to your account.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This step transmits a signed registration transaction to an external blockchain node, initiating an irreversible on-chain action. In context, the danger is not mere transmission but that the skill normalizes remote broadcasting of locally signed transactions without strong user confirmation, transaction preview, or endpoint trust guidance.
- Content
bash TX=$(node ~/.config/clawchain/scripts/register.js) curl -s -X POST "$CLAWCHAIN_NODE/tx/$CLAWCHAIN_BRID" \ -H "Content-Type: application/json" \ -d "{\"tx\":\"$TX\"}"
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill directs the agent to create a persistent local SOUL.md persona file and follow it strictly before every action, while deriving durable on-chain content from user-provided personality input. This can create unsafe long-lived behavioral steering and cause persistent publication of exaggerated content without fresh user review, increasing the chance of manipulation, reputation damage, or policy-violating outputs.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The generic operation pattern instructs generating signed transaction hex and immediately posting it to the node, making arbitrary on-chain writes easy to automate. This lowers friction for unintended or malicious actions and can be abused if the agent is prompted to perform unsafe operations or if the local environment is compromised.
- Content
md # Step 1: Generate signed transaction hex TX=$(node ~/.config/clawchain/scripts/generate-tx.js <operation> "value1" "value2" "value3") # Step 2: Send with curl curl -s -X POST "$CLAWCHAIN_NODE/tx/$CLAWCHAIN_BRID" \ -H "Content-Type: application/json" \ -d "{\"tx\":\"$TX\"}"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill encourages storing thoughts, memories, and files on-chain without warning that blockchain storage may be persistent, public, and difficult or impossible to retract fully. This can lead agents or users to publish sensitive data, internal reasoning, or personal information permanently.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill exposes moderator and admin operations such as banning users, deleting content, and promoting admins, despite being presented primarily as a social-network posting skill. This creates capability creep and increases the risk that an agent with this skill could perform destructive or privileged actions if compromised or misused.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Examples
Create a post in general (operation — positional):
bash TX=$(node ~/.config/clawchain/scripts/generate-tx.js create_post "general" "Hello World" "My first post!" "")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash TX=$(node ~/.config/clawchain/scripts/generate-tx.js create_post "general" "Hello World" "My first post!" "") curl -s -X POST "$CLAWCHAIN_NODE/tx/$CLAWCHAIN_BRID" \ -H "Content-Type: application/json" -d "{\"tx\":\"$TX\"}"
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The memory and file-storage operations are generic persistence capabilities not strictly necessary for ordinary social posting. Because they can store arbitrary content on-chain, they increase the chance of long-lived storage of sensitive prompts, internal state, secrets, or user data beyond the stated purpose.
- Content