Security audit

clawpage-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a real Clawpage publishing helper, but it needs Review because it runs mutable npm code while handling long-lived account tokens and published web content.

Before installing, treat this as a tool that can execute npm code, create an account, store a long-lived owner token, publish pages, and mutate Clawpage data. Pin and review `@clawpage.ai/cli` before use, avoid putting confidential files into blob uploads or generated pages, require explicit approval for account setup and destructive actions, and rotate the Clawpage token if it appears in logs or chat transcripts.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:97
Finding: Unpinned npm Package Is Downloaded and Executed Automatically
Content: View full analysis
`. The CLI ships scripts + templates from npm; no plugin-relative paths needed, no permission prompts on `~/.claude/...`. ``` The same unpinned invocation pattern is repeated throughout the operational sub-skills, including initialization: ```bash npx -y @clawpage.ai/cli init ``` ### Technical Analysis The Skill directs the agent to run `npx -y @clawpage.ai/cli` without an exact version or integrity constraint. `npx` may retrieve the package selected by the npm registry at execution time and immediately execute it. The `-y` option suppresses the interactive package-install confirmation. The executable CLI is not included in this repository, so its implementation and transitive dependencies cannot be verified by auditing the Skill package. The effective executable payload can change after this Skill has been reviewed. This behavior is necessary only insofar as the Skill delegates its runtime functionality to the external CLI. Automatic execution of a mutable package version is not the minimum privilege or minimum-trust method required to provide that functionality. ### Attack Path 1. An attacker compromises the npm publisher account, release workflow, package contents, or a relevant dependency. 2. The attacker publishes a modified version under `@clawpage.ai/cli`. 3. A user invokes any operational sub-skill. 4. The agent runs `npx -y @clawpage.ai/cli ...`. 5. `npx` downloads and executes the modified package without an install-confirmation prompt. 6. The malicious package executes with the local privileges of the agent process a ...[truncated 636 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/clawpage-skill/use-sdk/SKILL.md:42
Finding: Stored Cross-Site Scripting in Public Comments Recipe
Content: View full analysis
`
${new Date(r.value.at).toLocaleString()}: ${r.value.text}
`) .join(""); ``` ### Technical Analysis The recipe reads comment records from a publicly writable table and interpolates `r.value.text` directly into an HTML string. The resulting string is assigned to `innerHTML` without contextual escaping or sanitization. A value such as the following would be interpreted as markup rather than displayed as text: ```html ``` Because comments are stored server-side, the payload can execute for every visitor who subsequently loads the page. The recipe is especially dangerous because it is intended to be copied into generated pages and is presented as the standard implementation for public comments. ### Attack Path 1. A generated page creates or uses the public `comments` table shown in the recipe. 2. An unauthenticated attacker submits a comment containing malicious HTML or an event-handler payload. 3. The backend stores the attacker-controlled comment. 4. A visitor opens or refreshes the page. 5. `comments.list()` returns the malicious record. 6. The page interpolates `r.value.text` into an HTML string and assigns it to `innerHTML`. 7. The browser parses the injected markup and executes the attacker-controlled script in the page's origin context. ### Impact Assessment Successful exploitation may allow an attacker to: - Modify the visible page or present phishing interfaces - Read non-HttpOnly data accessible to scripts in the page origin - Perform requests available to the victim's browser session - Capture user input entered into the affected page - Redirect visitors or load additiona ...[truncated 304 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/clawpage-skill/create-page/SKILL.md:68
Finding: Dynamic Values Are Interpolated into Shell Command Templates Without Required Safe Escaping
Content: View full analysis
Remediation: View remediation
- publish - --page-dir - - --title - ``` 2. Prohibit constructing a single shell command string from user- or metadata-derived values. 3. Validate page IDs, pagecodes, usernames, and slugs against strict allowlists. 4. Canonicalize paths and enforce allowed parent directories before execution. 5. If a shell is unavoidable, use a proven shell-escaping routine for every dynamic argument rather than manual quoting. 6. Add adversarial tests for spaces, quotes, semicolons, newlines, `$()`, backticks, glob characters, and leading hyphens. 7. Apply the same correction to create, update, management-page, template, data, blob, link, and statistics command examples. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: skills/clawpage-skill/create-management-page/SKILL.md:68
Finding: Long-Lived Owner Token Is Inserted Directly into a curl Command Line
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: skills/clawpage-skill/use-sdk/SKILL.md:25
Finding: Generated Pages Execute Mutable Remote SDK Code Without Integrity Verification
Content: View full analysis
``` The ESM alternative is also loaded from a mutable URL: ```javascript import Clawpage, { ClawpageError } from "https://clawpage.ai/sdk.mjs"; ``` ### Technical Analysis Generated pages load JavaScript from a non-versioned remote URL. No Subresource Integrity hash, immutable version identifier, or restrictive Content Security Policy is required. As a result, the code executed by a generated page can change after that page and the Skill have been reviewed. Compromise of the SDK distribution path, hosting account, deployment pipeline, or DNS/TLS trust chain could affect every page that references the mutable resource. Loading an SDK may be necessary for interactive functionality, but granting a mutable remote resource continuing script-execution authority is not the minimum-trust deployment model. ### Attack Path 1. An attacker compromises the SDK host, release process, deployment credentials, or serving infrastructure. 2. The attacker replaces `sdk.js` or `sdk.mjs` with modified JavaScript. 3. A visitor opens any generated page containing the remote SDK reference. 4. The browser downloads the modified resource. 5. The browser executes it with the privileges of the embedding page's origin and DOM context. 6. The malicious SDK reads or modifies page data and communicates with attacker-controlled infrastructure. ### Impact Assessment A compromised SDK could: - Read and modify the generated page DOM - Capture user interactions and form input - Read browser storage available to page scripts - Make requests available from the page context - Alter data ...[truncated 286 chars]
Remediation: View remediation
``` 2. Pin generated pages to a reviewed SDK version. 3. Use Subresource Integrity for classic scripts where deployment architecture permits it. 4. Consider self-hosting the reviewed SDK with each published page. 5. Apply a restrictive Content Security Policy with explicit script sources and without unnecessary inline-script permissions. 6. Establish a controlled upgrade process that regenerates integrity hashes and requires review. 7. Document the SDK's dependency tree and release provenance. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: skills/clawpage-skill/references/prompt-contracts.md:52
Finding: Protected Page Access Secrets Are Mandated in Persistent Conversation Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (132)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description says to trigger proactively for broad cases like converting long or complex responses into a web URL or dashboard, which widens activation beyond explicit user intent. In practice this can cause the agent to publish or manage web content, invoke external tooling, and potentially create externally accessible URLs when the user only wanted a textual response.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is described as a Clawpage router, but this file expands capability into automatic account registration and writing tokens to ./keys.local.json. That is a privilege and scope expansion beyond routing, increasing the chance an agent performs sensitive state-changing actions and persists credentials without clear, informed user approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description says the skill will initialize or set up the skill and register an account automatically, but it does not clearly warn that credentials will be saved to a local file. Omitting this disclosure undermines informed consent and can lead users or orchestrators to authorize secret persistence without understanding the security consequences.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow explicitly authorizes automatic account creation and credential persistence despite the parent skill's stated routing purpose. This mismatch makes the skill more dangerous because a user or orchestrator invoking a seemingly harmless router may instead trigger identity creation and local secret storage.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · skills/clawpage-skill/references/prompt-contracts.md (reported line 3)May include surrounding context.
md
# Clawpage Prompt Contracts Use this file as the single source for shared prompt contracts across router/create/update skills. ## 1. Placeholder Ownership & Localization Contract

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The view-counter example shows browser-side code constructing new Clawpage({ token: "REDACTED" }) immediately after stating that owner-token operations must not be shipped in public pages. Even with a placeholder token, this pattern teaches users to embed privileged credentials in client-side JavaScript, which would let any visitor extract the token and use owner APIs such as analytics or other account-scoped operations.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · AGENTS.md (reported line 8)May include surrounding context.
md
This repo is a **Claude Code plugin** (with `.claude-plugin/plugin.json`). It contains only LLM-facing instructions; the executable runtime ships separately as the [`@clawpage.ai/cli`](https://www.npmjs.com/package/@clawpage.ai/cli) npm package. - `.claude-plugin/plugin.json` — plugin manifest. - `skills/clawpage-skill/SKILL.md` — top-level router for all workflows. - `skills/clawpage-skill/<sub-skill>/SKILL.md` — operational sub-skills: `init`, `create-page`, `update-page`, `create-management-page`, `create-template`, `update-template`, `manage-data`, `manage-links`, `manage-blobs`, `view-stats`, `use-sdk`. - `skills/clawpage-skill/references/` — shared docs (API quickref, prompt contracts, design guidelines) — read-only references for the LLM, not executed.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
md
This repo is a **Claude Code plugin** (with `.claude-plugin/plugin.json`). It contains only LLM-facing instructions; the executable runtime ships separately as the [`@clawpage.ai/cli`](https://www.npmjs.com/package/@clawpage.ai/cli) npm package. - `.claude-plugin/plugin.json` — plugin manifest. - `skills/clawpage-skill/SKILL.md` — top-level router for all workflows. - `skills/clawpage-skill/<sub-skill>/SKILL.md` — operational sub-skills: `init`, `create-page`, `update-page`, `create-management-page`, `create-template`, `update-template`, `manage-data`, `manage-links`, `manage-blobs`, `view-stats`, `use-sdk`. - `skills/clawpage-skill/references/` — shared docs (API quickref, prompt contracts, design guidelines) — read-only references for the LLM, not executed.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 54)May include surrounding context.
md
This repo is a **Claude Code plugin** (with `.claude-plugin/plugin.json`). It contains only LLM-facing instructions; the executable runtime ships separately as the [`@clawpage.ai/cli`](https://www.npmjs.com/package/@clawpage.ai/cli) npm package. - `.claude-plugin/plugin.json` — plugin manifest. - `skills/clawpage-skill/SKILL.md` — top-level router for all workflows. - `skills/clawpage-skill/<sub-skill>/SKILL.md` — operational sub-skills: `init`, `create-page`, `update-page`, `create-management-page`, `create-template`, `update-template`, `manage-data`, `manage-links`, `manage-blobs`, `view-stats`, `use-sdk`. - `skills/clawpage-skill/references/` — shared docs (API quickref, prompt contracts, design guidelines) — read-only references for the LLM, not executed.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · docs/README.zh-CN.md (reported line 36)May include surrounding context.
md
This repo is a **Claude Code plugin** (with `.claude-plugin/plugin.json`). It contains only LLM-facing instructions; the executable runtime ships separately as the [`@clawpage.ai/cli`](https://www.npmjs.com/package/@clawpage.ai/cli) npm package. - `.claude-plugin/plugin.json` — plugin manifest. - `skills/clawpage-skill/SKILL.md` — top-level router for all workflows. - `skills/clawpage-skill/<sub-skill>/SKILL.md` — operational sub-skills: `init`, `create-page`, `update-page`, `create-management-page`, `create-template`, `update-template`, `manage-data`, `manage-links`, `manage-blobs`, `view-stats`, `use-sdk`. - `skills/clawpage-skill/references/` — shared docs (API quickref, prompt contracts, design guidelines) — read-only references for the LLM, not executed.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · docs/README.zh-CN.md (reported line 44)May include surrounding context.
md
This repo is a **Claude Code plugin** (with `.claude-plugin/plugin.json`). It contains only LLM-facing instructions; the executable runtime ships separately as the [`@clawpage.ai/cli`](https://www.npmjs.com/package/@clawpage.ai/cli) npm package. - `.claude-plugin/plugin.json` — plugin manifest. - `skills/clawpage-skill/SKILL.md` — top-level router for all workflows. - `skills/clawpage-skill/<sub-skill>/SKILL.md` — operational sub-skills: `init`, `create-page`, `update-page`, `create-management-page`, `create-template`, `update-template`, `manage-data`, `manage-links`, `manage-blobs`, `view-stats`, `use-sdk`. - `skills/clawpage-skill/references/` — shared docs (API quickref, prompt contracts, design guidelines) — read-only references for the LLM, not executed.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The document repeatedly instructs use of npx -y @clawpage.ai/cli without pinning an exact package version. That causes the agent/runtime to fetch and execute whatever the latest published package is at execution time, creating a supply-chain risk if the package is compromised, replaced, or a malicious version is published.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This instruction references an unpinned npm package invocation, which allows remote code execution from a mutable package registry artifact. In an agent skill context, that is especially dangerous because users may follow or automate the command with elevated local permissions and credential access.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · AGENTS.md (reported line 18)May include surrounding context.
md
- **Auth** — `~/.clawpage/keys.local.json` (auto-created by `npx -y @clawpage.ai/cli init`). Project-scoped `./keys.local.json` in cwd takes precedence. - **Pages** — default `~/.clawpage/pages/<page-name>/` (bare-name input to `--page-dir`). Path-like input (`./...`, `~/...`, absolute) is honored as-is for project-scoped storage. - **Skill install dir** — read-only. The plugin must never be configured to write into `~/.claude/plugins/cache/` or wherever the runtime puts the install. All page projects belong under `~/.clawpage/pages/` or user CWD. ## Build, Test, and Development Commands

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx against an unpinned package in sample commands exposes consumers to arbitrary code changes over time. If the npm account, package, or dependency tree is compromised, the skill becomes a delivery mechanism for attacker-controlled code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This dry-run example still downloads and runs the latest CLI package, so it carries the same supply-chain execution risk even if no authentication is used. 'Dry-run' reduces application-side effects but does not reduce the risk of malicious code in the downloaded tool itself.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Publishing workflows often run in environments that contain credentials, project files, and network access. An unpinned npx package in that context can lead to credential theft, file exfiltration, or tampering if the package or dependencies become malicious.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The auth setup command is particularly sensitive because it creates credential material and likely handles account registration secrets. Fetching and executing an unpinned remote package during authentication magnifies the impact of compromise, enabling theft or misuse of generated keys.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The style guidance normalizes exclusive use of unpinned npx -y @clawpage.ai/cli commands, institutionalizing a dangerous pattern across the skill. This increases blast radius because future contributors are encouraged to keep adding mutable remote execution points.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Although this line appears in a security-oriented section, it still blesses CLI invocations using an unpinned package as an acceptable location for sensitive owner tokens. That creates a contradiction: tokens are protected from browser exposure, but still exposed to potential theft by mutable npm-fetched code.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · AGENTS.md (reported line 48)May include surrounding context.
md
- All page-side JS that hits Clawpage APIs (data tables, atomic incr, short links, stats, blobs, `/api/me`) MUST use the Browser SDK: `https://clawpage.ai/sdk.js` (IIFE) or `https://clawpage.ai/sdk.mjs` (ESM). Raw `fetch('/api/...')` in page HTML/JS is forbidden. - CLI scope (`@clawpage.ai/cli`'s Node scripts) may keep using raw `fetch`/`curl` — the SDK is browser-targeted. - Owner `sk_*` tokens must NEVER appear in **any** browser-shipped page JS — including pagecode-protected pages. Pagecodes are not a token container: they can be shared, the page source can be inspected via DevTools, and browser caches persist. The only acceptable contexts for an `sk_*` token are CLI invocations (`npx -y @clawpage.ai/cli ...`) and server-side processes you control. - See `skills/clawpage-skill/use-sdk/SKILL.md`. ## Testing Guidelines

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The security/configuration guidance tells the LLM to direct users toward an unpinned auth command, reinforcing execution of mutable third-party code in a privileged context. Because this is framed as best practice, users and agents are more likely to trust and automate it without scrutiny.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 6)May include surrounding context.
md
English docs. Chinese version: [docs/README.zh-CN.md](docs/README.zh-CN.md). `clawpage-skill` turns long text into interactive Clawpage web apps. You can ask for a page in natural language, and the skill routes to page/template create or update workflows, then publishes a URL. Official website: `https://clawpage.ai`

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The README explicitly instructs users to execute npx -y @clawpage.ai/cli without a pinned version, which causes the latest package code from npm to run on the host at invocation time. Even though the document includes a supply-chain warning and mentions provenance, this remains a real supply-chain risk because a compromised maintainer account, malicious release, or dependency hijack would lead to arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This occurrence again recommends npx -y @clawpage.ai/cli without version pinning, resulting in execution of whatever package version npm resolves at runtime. In the context of a plugin that shells out automatically, this is especially dangerous because users may trigger remote code execution indirectly through normal skill usage rather than consciously installing audited software.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.