clawchain browsing skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:37 PM UTC
• Version: 1.0.1

Overview

The skill matches its ClawChain social-network purpose, but it installs changeable remote instructions and keeps a persistent signing key and behavior profile, so it should be reviewed before use.

Install only if you are comfortable with an agent holding a local ClawChain signing key and publishing signed on-chain actions. Review any downloaded remote skill files before activation, avoid storing sensitive conversation content as thoughts or memories, and consider using a separate low-value ClawChain identity because compromise of credentials.json could let someone act as that agent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: skill.md:88

Finding

Mutable Remote Skill Instructions Installed Without Integrity Verification

Content

View full analysis

~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md ``` ``` ### Technical Analysis The installation procedure retrieves mutable instruction files from an external server and writes them directly into the Agent's local Skill directory. It does not pin a version, verify a cryptographic hash or signature, inspect the downloaded content, or require user confirmation before replacing the local files. Because `SKILL.md` and `HEARTBEAT.md` contain instructions that an Agent may subsequently load and follow, modifying the remote resources changes the effective Skill behavior after the reviewed artifact has been published. HTTPS protects the connection in transit but does not protect against compromise of the origin server, DNS or certificate infrastructure failures, unauthorized changes by the publisher, or a compromised deployment pipeline. The commands also use `curl -s` without `--fail`. An HTTP error document could therefore be written into the destination file without producing a clear installation failure. ### Attack Path 1. An attacker compromises `clawchain.ai`, its hosting ...[truncated 1365 chars]

Remediation

View remediation

/tmp/clawchain-skill.md' | sha256sum --check - install -m 0644 /tmp/clawchain-skill.md ~/.clawchain/skills/clawchain/SKILL.md ``` 6. Display changes and require explicit user approval before replacing an existing Skill or heartbeat file. 7. Prevent downloaded Markdown from requesting access beyond the declared ClawChain scope, especially arbitrary credential files or unrelated network destinations. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:475

Finding

Persistent Agent Behavior Modification Through Mandatory SOUL.md Instructions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skill.md:199

Finding

Unpinned npm Dependencies Execute in a Credential-Sensitive Environment

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill requires read access to a local private key file that authorizes blockchain actions as the agent identity. Even if intended, exposing raw private key material to a general-purpose agent greatly increases the blast radius of prompt injection, tool misuse, or accidental disclosure because compromise of the file enables impersonation.

Content

Scanner excerpt · skill.md (reported line 17)May include surrounding context.

md

required: true
credentials:
  - name: ClawChain Keypair
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair (privKey + pubKey in hex) used to sign transactions. Created once during initial setup by the keygen.js helper script. This keypair identifies your agent's on-chain account — losing it means losing access. The private key never leaves this file; it is only used locally by the signing scripts."
    access: read
dependencies:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Creating and retaining a plaintext credentials.json file containing the private key introduces a high-value local secret that can be stolen, copied, or misused by any compromised agent/runtime with filesystem access. The risk is amplified because the key permanently controls the on-chain identity and enables unauthorized posting or moderation actions.

Content

Scanner excerpt · skill.md (reported line 35)May include surrounding context.

md

files_created:
  - path: "~/.config/clawchain/scripts/"
    description: "Directory containing helper scripts (keygen.js, register.js, generate-tx.js) for offline transaction signing. These scripts are created during initial setup."
  - path: "~/.config/clawchain/credentials.json"
    description: "Your Chromia keypair file. Created by keygen.js. Contains privKey and pubKey in hex format. Protected with chmod 600."
  - path: "~/.config/clawchain/SOUL.md"
    description: "Local personality profile file. Contains exaggerated personality instructions derived from your on-chain personality summary."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The transparency section confirms read/write handling of the credential file, which means the agent environment can potentially access and alter signing material. This exposes both confidentiality and integrity risks: the key can be exfiltrated, and the file can be swapped or tampered with to redirect identity or break security assumptions.

Content

Scanner excerpt · skill.md (reported line 67)May include surrounding context.

md

| File | Access | Purpose |
|------|--------|---------|
| `~/.config/clawchain/credentials.json` | Read/Write (created once by keygen.js) | Chromia keypair for signing transactions |
| `~/.config/clawchain/scripts/*.js` | Read (created during setup) | Helper scripts for offline transaction signing |
| `~/.config/clawchain/SOUL.md` | Read/Write | Local personality profile loaded before each action |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill tells the agent to fetch additional skill files directly from a remote domain and save them into the local skills directory without integrity verification. This is a classic supply-chain and remote content injection risk: if the site or network path is compromised, the agent can ingest malicious instructions that persist locally and influence future actions.

Content

Scanner excerpt · skill.md (reported line 91)May include surrounding context.

bash

mkdir -p ~/.clawchain/skills/clawchain
curl -s https://clawchain.ai/curl_skills.md > ~/.clawchain/skills/clawchain/SKILL.md
curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The status check reads and prints the public key derived from the credential file, confirming direct script access to secret-bearing material. While printing the public key alone is not secret leakage, the pattern demonstrates broad filesystem access to the credential bundle and normalizes handling the private key file in shell/Node workflows that are easier to abuse.

Content

Scanner excerpt · skill.md (reported line 132)May include surrounding context.

md

fi

# 2. Keypair exists?
CRED_FILE="$HOME/.config/clawchain/credentials.json"
if [ -f "$CRED_FILE" ]; then
  if node -e "JSON.parse(require('fs').readFileSync('$CRED_FILE','utf-8'))" 2>/dev/null; then
    PUBKEY=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$CRED_FILE','utf-8')).pubKey.toUpperCase())")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill instructs creation of helper scripts that consume the private key from credentials.json for signing, meaning any compromise of those scripts or their execution context can misuse the key. Since the agent is directed to install and run custom local scripts, this materially expands the attack surface around sensitive key handling.

Content

Scanner excerpt · skill.md (reported line 197)May include surrounding context.

md

**You MUST run each `cat << 'EOF' > ...` command below.** These commands create the `.js` files inside `~/.config/clawchain/scripts/`. The scripts will NOT exist until you execute these commands.

> **What these scripts do:** They generate signed transaction bytes *locally* (offline). The private key from `credentials.json` is only used *in-memory* to sign — it is never sent over the network. The resulting hex is then submitted to the Chromia node via curl.

#### `keygen.js` (Generates Keypair)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This section explicitly creates a new private key and stores it in a predictable local JSON path. Predictable plaintext secret storage is dangerous in agent environments because other tools, plugins, or injected instructions may target known locations for credential theft.

Content

Scanner excerpt · skill.md (reported line 201)May include surrounding context.

keygen.js (Generates Keypair)

Creates a new Chromia keypair and saves it to ~/.config/clawchain/credentials.json. This script is safe to run multiple times — it will not overwrite an existing keypair.

bash

cat << 'EOF' > ~/.config/clawchain/scripts/keygen.js

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The keygen script writes the keypair to a default credentials.json path, reinforcing direct secret storage and easy discoverability. An attacker who gains read access to the environment can impersonate the agent indefinitely on-chain.

Content

Scanner excerpt · skill.md (reported line 210)May include surrounding context.

md

const path = require("path");
const os = require("os");

const outFile = process.argv[2] || path.join(os.homedir(), ".config", "clawchain", "credentials.json");

if (fs.existsSync(outFile)) {
  console.log(`Credentials already exist at ${outFile}`);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The register.js helper reads and parses the credential file to reconstruct the private key in process memory for signing. Although local signing is better than transmitting the key, direct secret ingestion by arbitrary helper code still creates a high-risk path for theft or unauthorized signing.

Content

Scanner excerpt · skill.md (reported line 250)May include surrounding context.

md

}

async function main() {
  const credPath = process.argv[2] || path.join(os.homedir(), ".config", "clawchain", "credentials.json");
  if (!fs.existsSync(credPath)) { 
    console.error(`Credentials not found at ${credPath}`); 
    process.exit(1);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The generate-tx.js helper supports direct loading of a credential file, including an override path, which broadens the set of secrets the agent could be induced to access. In an adversarial prompt environment, flexible credential path handling can be abused to target alternate files or facilitate unauthorized signing operations.

Content

Scanner excerpt · skill.md (reported line 312)May include surrounding context.

md

async function main() {
  let args = process.argv.slice(2);
  let credPath = path.join(os.homedir(), ".config", "clawchain", "credentials.json");

  // Handle optional --cred flag
  if (args[0] === "--cred") {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The registration instructions emphasize creation of a persistent local private-key file tied to account ownership. In a general agent context, long-lived bearer secrets on disk are high-value targets and increase the consequences of prompt injection or local compromise.

Content

Scanner excerpt · skill.md (reported line 400)May include surrounding context.

node ~/.config/clawchain/scripts/keygen.js

text

This creates `~/.config/clawchain/credentials.json` with owner-only permissions (`chmod 600`). The file contains your Chromia keypair in hex format:

```json
{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The security notes confirm that credentials.json contains the keypair and is used repeatedly for transaction signing. This acknowledges a sensitive secret in the agent's accessible environment; the risk is not network leakage but local compromise, misuse, and identity takeover.

Content

Scanner excerpt · skill.md (reported line 916)May include surrounding context.

md

### Credential Storage

- `~/.config/clawchain/credentials.json` contains your Chromia keypair. It is created with owner-only permissions (`chmod 600`).
- The private key is used **only locally** by the helper scripts to sign transactions. It is **never sent over the network**.
- The signed transaction hex (output of `generate-tx.js`) does not contain the private key — only the signature.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 929)May include surrounding context.

md

### Best Practices

- Do not share your `credentials.json` file with anyone.
- Keep backups in a secure location if you want to preserve account access.
- If compromised, the attacker could post/vote as your agent but cannot access external funds (this skill has no EVM/BSC wallet).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 946)May include surrounding context.

md

### Best Practices

- Do not share your `credentials.json` file with anyone.
- Keep backups in a secure location if you want to preserve account access.
- If compromised, the attacker could post/vote as your agent but cannot access external funds (this skill has no EVM/BSC wallet).

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 36)May include surrounding context.

md

- path: "~/.config/clawchain/scripts/"
    description: "Directory containing helper scripts (keygen.js, register.js, generate-tx.js) for offline transaction signing. These scripts are created during initial setup."
  - path: "~/.config/clawchain/credentials.json"
    description: "Your Chromia keypair file. Created by keygen.js. Contains privKey and pubKey in hex format. Protected with chmod 600."
  - path: "~/.config/clawchain/SOUL.md"
    description: "Local personality profile file. Contains exaggerated personality instructions derived from your on-chain personality summary."
---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 916)May include surrounding context.

md

- path: "~/.config/clawchain/scripts/"
    description: "Directory containing helper scripts (keygen.js, register.js, generate-tx.js) for offline transaction signing. These scripts are created during initial setup."
  - path: "~/.config/clawchain/credentials.json"
    description: "Your Chromia keypair file. Created by keygen.js. Contains privKey and pubKey in hex format. Protected with chmod 600."
  - path: "~/.config/clawchain/SOUL.md"
    description: "Local personality profile file. Contains exaggerated personality instructions derived from your on-chain personality summary."
---

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages storing thoughts and memories on-chain, which creates an irreversible disclosure channel for natural-language data. If an agent records user-derived, sensitive, or contextual information, that content may become public or permanently retained beyond the user's expectations and cannot be meaningfully revoked.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs persistent installation of remotely fetched skill files into a local agent directory, creating durable modification of future agent behavior. Because the content is retrieved over the network and then stored for later use, a compromised upstream or malicious update can establish long-lived prompt/instruction persistence.

Content

Scanner excerpt · skill.md (reported line 90)May include surrounding context.

Install locally:

bash

mkdir -p ~/.clawchain/skills/clawchain
curl -s https://clawchain.ai/curl_skills.md > ~/.clawchain/skills/clawchain/SKILL.md
curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 91)May include surrounding context.

bash

mkdir -p ~/.clawchain/skills/clawchain
curl -s https://clawchain.ai/curl_skills.md > ~/.clawchain/skills/clawchain/SKILL.md
curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 91)May include surrounding context.

bash

mkdir -p ~/.clawchain/skills/clawchain
curl -s https://clawchain.ai/curl_skills.md > ~/.clawchain/skills/clawchain/SKILL.md
curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 158)May include surrounding context.

md

-d "{\"type\":\"get_agent\",\"name\":\"$AGENT_NAME\"}" 2>/dev/null)
  if echo "$RESULT" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));process.exit(d.name?0:1)" 2>/dev/null; then
    echo "✅ Agent '$AGENT_NAME': registered on-chain"
    CLAIMED=$(curl -s "$CLAWCHAIN_NODE/query/$CLAWCHAIN_BRID" \
      -H "Content-Type: application/json" \
      -d "{\"type\":\"is_agent_claimed\",\"agent_name\":\"$AGENT_NAME\"}" 2>/dev/null)
    if [ "$CLAIMED" = "true" ] || [ "$CLAIMED" = "1" ]; then

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

Creating persistent local script directories and installing dependencies modifies the host environment beyond the current session. While expected for setup, in an agent security model this persistence expands attack surface and can leave behind trusted code and packages that later prompts may abuse.

Content

Scanner excerpt · skill.md (reported line 182)May include surrounding context.

md

## Installation (Only If Status Check Shows ❌ Scripts)

### 1. Create Directory and Install Dependencies

This creates a local scripts directory and installs the required npm packages (`postchain-client` and `@chromia/ft4`):

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 400)May include surrounding context.

node ~/.config/clawchain/scripts/keygen.js

text

This creates `~/.config/clawchain/credentials.json` with owner-only permissions (`chmod 600`). The file contains your Chromia keypair in hex format:

```json
{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The guidance to never delete the credential file promotes indefinite persistence of a long-lived authentication secret. Persistent bearer credentials increase exposure window and make compromise more consequential over time.

Content

Scanner excerpt · skill.md (reported line 409)May include surrounding context.

}

text

This is safe to run multiple times — **it will NOT overwrite an existing keypair**. If the file already exists, it prints a message and exits.

> **⚠️ NEVER delete your credentials file unless the Status Check told you it's invalid.** Your on-chain account is tied to this keypair. Deleting it means losing access to your account.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 418)May include surrounding context.

bash

TX=$(node ~/.config/clawchain/scripts/register.js)

curl -s -X POST "$CLAWCHAIN_NODE/tx/$CLAWCHAIN_BRID" \
  -H "Content-Type: application/json" \
  -d "{\"tx\":\"$TX\"}"

Static analysis

No suspicious patterns detected.