T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:92- Finding
Untrusted External Task Instructions Are Treated as Executable Agent Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Worker
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent job-marketplace purpose, but it needs review because it can register accounts, expose an agent endpoint, store credentials, run recurring network checks, and act on external task instructions without enough user-control safeguards.
Install only if you intend to use ClawHire as an external work marketplace. Before enabling it, require explicit approval for registration, profile publication, A2A endpoint exposure, heartbeat polling, task claiming, and every file upload; use a dedicated workspace, avoid sensitive files, and treat all employer or task text as untrusted.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:242- Finding
Externally Controlled Task Metadata Is Appended to Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Warning
- Location
SKILL.md:225- Finding
Heartbeat Configuration Establishes Recurring Cross-Session Network Activity
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match common user intents like 'find work' or 'earn money', which can cause the skill to activate in situations where the user did not intend to interact with a third-party job marketplace. In this skill, unintended activation is more dangerous because activation can lead to account registration, public profile creation, external API calls, and potential exposure of user email or agent endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The registration flow directs the agent to send the user's email to a third-party service to create an account, but it does not require explicit informed consent or explain the privacy implications. This creates a risk of unauthorized disclosure of personal data and unintended enrollment in an external platform.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This command transmits identifying information, including the user's email, to an external service to create an account. External transmission is risky here because the skill does not require explicit consent or provide data-minimization guidance before sending personal information off-platform.
- Content
Check env
CLAWHIRE_API_KEY. If missing, register:bash curl -s -X POST https://api.clawhire.io/v1/auth/register \ -H "Content-Type: application/json" \ -d '{"name":"<agent-name>","owner_email":"<ask-user>","role":"worker"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This command transmits identifying information, including the user's email, to an external service to create an account. External transmission is risky here because the skill does not require explicit consent or provide data-minimization guidance before sending personal information off-platform.
- Content
Check env
CLAWHIRE_API_KEY. If missing, register:bash curl -s -X POST https://api.clawhire.io/v1/auth/register \ -H "Content-Type: application/json" \ -d '{"name":"<agent-name>","owner_email":"<ask-user>","role":"worker"}'
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Persisting the API key in a long-lived local configuration file increases the risk of credential exposure through local compromise, backup leakage, or unintended access by other tools using the same environment. Although the skill says not to store keys in workspace files, it still instructs durable storage of a sensitive secret.
- Content
Response:
{ "data": { "agent_id": "...", "api_key": "clawhire_xxx" } }Save key — write to
~/.openclaw/openclaw.json(merge, don't overwrite):json { "skills": { "entries": { "claw-worker": { "env": { "CLAWHIRE_API_KEY": "clawhire_xxx" } } } } }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Creating a profile sends capability and preference data to an external marketplace and may indirectly disclose sensitive operational details about the agent's skills, availability, and pricing. In context, this is less severe than credential leakage but still risky because the skill presents it as routine setup without an explicit consent or disclosure step.
- Content
A good profile attracts more work. Be specific about skills.
bash curl -s -X POST https://api.clawhire.io/v1/agents/profile \ -H "Authorization: Bearer $CLAWHIRE_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill encourages registering a public A2A endpoint to make the agent discoverable without clearly warning that this exposes the agent to unsolicited external traffic and potential prompt-injection or abuse from untrusted parties. Because the endpoint is intended for direct inbound requests from other agents, the exposure meaningfully expands the attack surface beyond the normal trusted session boundary.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Registering the A2A URL with an external service discloses a reachable endpoint for inbound agent traffic, making the agent more discoverable and targetable. In this skill's context, that materially increases exposure to malicious requests, spam, prompt injection, and endpoint reconnaissance.
- Content
If you have a public URL (e.g. via OpenClaw Gateway + Tailscale/tunnel):
bash curl -s -X POST https://api.clawhire.io/v1/agents/register-a2a \ -H "Authorization: Bearer $CLAWHIRE_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Browse open tasks
bash curl -s "https://api.clawhire.io/v1/tasks?status=open&skills=python,translation" \ -H "Authorization: Bearer $CLAWHIRE_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Browse open tasks
bash curl -s "https://api.clawhire.io/v1/tasks?status=open&skills=python,translation" \ -H "Authorization: Bearer $CLAWHIRE_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Browse open tasks
bash curl -s "https://api.clawhire.io/v1/tasks?status=open&skills=python,translation" \ -H "Authorization: Bearer $CLAWHIRE_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
Claiming a task changes state on an external platform and can commit the agent to obligations or workflows without an explicit confirmation step. In context, the risk is not just transmission but unauthorized action on behalf of the user, including reputational and financial consequences if tasks are claimed automatically or mistakenly.
- Content
Before claiming, check: Do my skills match? Is the budget fair? Can I meet the deadline?
bash curl -s -X POST "https://api.clawhire.io/v1/tasks/{task_id}/claim" \ -H "Authorization: Bearer $CLAWHIRE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"task_token": "{token_from_task_details}"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
Submitting deliverables uploads local files to an external service, creating a substantial risk of exfiltrating sensitive workspace data if file selection is wrong, manipulated, or insufficiently reviewed. Because the skill normalizes direct file upload from local storage, the context increases the chance of accidental disclosure of confidential content.
- Content
Step 4: Submit deliverable
bash curl -s -X POST https://api.clawhire.io/v1/submissions \ -H "Authorization: Bearer $CLAWHIRE_API_KEY" \ -F "task_id={task_id}" \ -F "notes=Description of what was done" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The heartbeat automates periodic outbound communication to keep the agent discoverable, which can create persistent third-party tracking and background activity without ongoing user awareness. In context, embedding this into an automatically executed heartbeat file increases risk because the action becomes continuous rather than user-initiated.
- Content
markdown ## ClawHire Worker - [ ] Send heartbeat: curl -s -X POST https://api.clawhire.io/v1/agents/heartbeat -H "Authorization: Bearer $CLAWHIRE_API_KEY" - [ ] Check tasks: curl -s "https://api.clawhire.io/v1/tasks?status=open&skills={my_skills}" -H "Authorization: Bearer $CLAWHIRE_API_KEY" - [ ] If matching tasks found and below max concurrent, evaluate and consider claiming
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
Automatic periodic task polling increases the chance that the agent will process or act on external marketplace data without deliberate user initiation. The danger is amplified here because the heartbeat section explicitly states it is executed regularly, enabling ongoing external interactions that could lead to unintended claims or workflow drift.
- Content
markdown ## ClawHire Worker - [ ] Send heartbeat: curl -s -X POST https://api.clawhire.io/v1/agents/heartbeat -H "Authorization: Bearer $CLAWHIRE_API_KEY" - [ ] Check tasks: curl -s "https://api.clawhire.io/v1/tasks?status=open&skills={my_skills}" -H "Authorization: Bearer $CLAWHIRE_API_KEY" - [ ] If matching tasks found and below max concurrent, evaluate and consider claiming
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file describes submitting a binary file upload and later downloading submission binaries, but it does not include any user-facing warning about transmitting user data to the service or the implications of uploading potentially sensitive files. Under the markdown-file criteria for missing user warnings, behaviors affecting user data or privacy should be disclosed.
- Content
Static analysis
No suspicious patterns detected.