T09 · Insecure Skill Coding Practices
Error
- Location
EXAMPLES.md:17- Finding
Decrypted secret values are returned directly to the agent context
- Content
View full analysis
- Remediation
View remediation
Security audit
1claw
Security checks for vulnerabilities and agentic risk
Overview
This is a real cloud vault integration, but it gives agents broad secret-handling authority and optional transaction-signing power with under-disclosed plaintext exposure risks.
Install only if you trust the 1Claw service and npm packages, and grant the agent the narrowest possible vault paths, permissions, token lifetimes, and transaction guardrails. Treat tool results as potentially visible to the agent/model, especially raw secrets and env bundles, and avoid enabling transaction signing or broad policy creation unless you need them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
EXAMPLES.md:86- Finding
Environment bundles expose multiple plaintext credentials in one tool response
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:101- Finding
Unpinned MCP package is downloaded and executed through npx
- Content
View full analysis
" } } } } ``` ### Technical Analysis The recommended MCP configuration invokes `npx -y @1claw/mcp` without pinning an exact package version or verifying artifact integrity. This permits the package resolved from the registry to change after the skill has been reviewed. The `-y` option also suppresses the normal installation confirmation. The executed MCP process receives `ONECLAW_AGENT_API_KEY` in its environment. A compromised package release, maintainer account, registry response, or transitive dependency could therefore execute arbitrary code with the agent process's operating-system privileges and read the vault credential. Other unpinned dependency instructions appear at `SKILL.md:94`, `SKILL.md:131`, `SKILL.md:501`, and `SKILL.md:508`, increasing the supply-chain exposure. ### Attack Path 1. An attacker compromises the package publisher, registry distribution path, or a transitive dependency. 2. A malicious version is published under the expected package name. 3. On MCP startup, `npx -y` retrieves and executes the currently resolved package without an exact version or integrity check. 4. The malicious process reads `ONECLAW_AGENT_API_KEY` and other accessible environment variables. 5. The attacker authenticates to 1Claw and performs operations allowed by the agent's vault policies, or executes arbitrary local actions available to the compromised process. ### Impact Assessment The malicious package would run with the privileges of the user launching the agent. It could access local files available to that user, steal environment credentia ...[truncated 445 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (74)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Granting read access to all API keys under a wildcard path is a broad permission change, yet the example frames it as routine and safe. Without an explicit warning and confirmation of scope, users may authorize overbroad access that enables credential harvesting or lateral movement by the recipient agent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The examples add transaction simulation, signing, and broadcast flows to a skill described as secret management. That expands the apparent authority of the agent from storing secrets to moving blockchain assets, which can normalize high-risk financial actions and lead integrators or downstream agents to invoke dangerous capabilities under the banner of a vault tool.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Executing blockchain transactions is unjustified in the context of a vault skill and violates least privilege. If an agent using this skill can submit transactions, compromise, prompt injection, or user confusion could turn secret access into direct asset loss.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Example 8: Agent discovers it lacks permission
User: "Read the SSH key at
keys/prod-server"text → get_secret(path: "keys/prod-server")
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md Enterprise opt-in feature (Business tier and above). A human generates a 256-bit AES key in the dashboard — the key never leaves their device. Only its SHA-256 fingerprint is stored on the server. - Enable: `POST /v1/vaults/{id}/cmek` with `{ fingerprint }` - Disable: `DELETE /v1/vaults/{id}/cmek` - Rotate: `POST /v1/vaults/{id}/cmek-rotate` (server-assisted, batched in 100s) - Secrets stored in a CMEK vault have `cmek_encrypted: true` in responses
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `social_engineering_detection` | object | Detect urgency, authority claims, secrecy requests, bypass attempts | | `encoding_detection` | object | Detect base64, hex, Unicode escapes that may hide payloads | | `network_detection` | object | Detect blocked domains, IP URLs, data exfiltration patterns | | `filesystem_detection` | object | Detect sensitive paths (/etc/passwd, .ssh/, .env, etc.) | | `sanitization_mode` | string | `"block"` (reject threats), `"sanitize"` (strip), `"warn"` (log) | | `threat_logging` | boolean| Log detected threats for audit (default: true) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | `social_engineering_detection` | object | Detect urgency, authority claims, secrecy requests, bypass attempts | | `encoding_detection` | object | Detect base64, hex, Unicode escapes that may hide payloads | | `network_detection` | object | Detect blocked domains, IP URLs, data exfiltration patterns | | `filesystem_detection` | object | Detect sensitive paths (/etc/passwd, .ssh/, .env, etc.) | | `sanitization_mode` | string | `"block"` (reject threats), `"sanitize"` (strip), `"warn"` (log) | | `threat_logging` | boolean| Log detected threats for audit (default: true) |
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The security model claims the agent never sees its own credentials, yet earlier sections describe self-enrollment and direct API-key/JWT flows intended for agent use. This contradiction can cause unsafe deployment assumptions, leading operators to believe credentials are isolated in the MCP layer when the documented flow also supports direct credential handling by the agent or surrounding tooling.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Agents cannot create email-based shares** (prevents unsolicited email sharing). - **Intents API is opt-in.** When enabled, raw key reads are blocked. - **Transaction guardrails are human-controlled and server-enforced.** - **Token revocation:** `DELETE /v1/auth/token` (or SDK `auth.logout()`) revokes the current Bearer token; revoked tokens return 401. - **Request body limit:** 5MB max; larger requests return 413. ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file instructs users to obtain agent IDs, API keys, and JWTs, including a curl example that transmits credentials, but it does not include any warning about treating these values as secrets, avoiding shell history/log exposure, or not committing them to source control. Because the document covers sensitive credentials directly, a user-facing warning about secure handling is expected under the missing user warnings criterion for markdown files.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Exchange the agent credentials for a JWT:
bash curl -X POST https://api.1claw.xyz/v1/auth/agent-token \ -H "Content-Type: application/json" \ -d '{"agent_id":"<uuid>","api_key":"ocv_..."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Exchange the agent credentials for a JWT:
bash curl -X POST https://api.1claw.xyz/v1/auth/agent-token \ -H "Content-Type: application/json" \ -d '{"agent_id":"<uuid>","api_key":"ocv_..."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Exchange the agent credentials for a JWT:
bash curl -X POST https://api.1claw.xyz/v1/auth/agent-token \ -H "Content-Type: application/json" \ -d '{"agent_id":"<uuid>","api_key":"ocv_..."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Exchange the agent credentials for a JWT:
bash curl -X POST https://api.1claw.xyz/v1/auth/agent-token \ -H "Content-Type: application/json" \ -d '{"agent_id":"<uuid>","api_key":"ocv_..."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
- Exchange the agent credentials for a JWT:
bash curl -X POST https://api.1claw.xyz/v1/auth/agent-token \ -H "Content-Type: application/json" \ -d '{"agent_id":"<uuid>","api_key":"ocv_..."}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The storage example presents handling of a raw API key without any warning about sensitivity, retention, or who may later access it. This can encourage casual secret submission and sharing patterns by users or agent authors without informed consent about exposure and access implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Loading an environment bundle into a deploy script can expose secrets to subprocesses, logs, crash reports, shell history, or inherited environments. The example omits that risk, which may lead operators to treat secret injection as harmless when it often expands exposure surface significantly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The self-enrollment example sends personal data and agent registration details to an external API and then instructs storage of issued credentials in environment variables, but it does not disclose the privacy and credential-handling risks. This can lead users to expose identity data or store powerful agent credentials insecurely.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The example performs an outbound HTTP POST containing human_email and agent registration data to an external service. External transmission of identifying or provisioning data is security-relevant and should be explicit because it can create privacy, trust-boundary, and account-enrollment risks.
- Content
Agent thinking: I don't have 1Claw credentials yet. I'll self-enroll using the user's email.
text → (HTTP) POST https://api.1claw.xyz/v1/agents/enroll Body: {"name":"cursor-assistant","human_email":"user@example.com"} Response: {"agent_id":"abc123...","message":"Enrollment processed."}
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest presents the skill as secret management, but the document exposes substantially broader capabilities including auth, org management, billing, audit, chain lookup, IP-rule management, and transaction operations. This scope mismatch can mislead reviewers and users into granting or enabling a much more powerful skill than its stated purpose suggests, increasing risk of over-privileged use.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
If you don't have credentials yet, self-enroll — this sends them to your human:
bash # curl curl -s -X POST https://api.1claw.xyz/v1/agents/enroll \ -H "Content-Type: application/json" \ -d '{"name":"my-agent","human_email":"human@example.com"}'
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md Store a new secret or update an existing one. Each call creates a new version. | Parameter | Type | Required | Default | Description | | ------------------ | ------ | -------- | --------- | ---------------------------------------------------------------------------------------------------- | | `path` | string | yes | | Secret path | | `value` | string | yes | | The secret value |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md Store a new secret or update an existing one. Each call creates a new version. | Parameter | Type | Required | Default | Description | | ------------------ | ------ | -------- | --------- | ---------------------------------------------------------------------------------------------------- | | `path` | string | yes | | Secret path | | `value` | string | yes | | The secret value |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md Store a new secret or update an existing one. Each call creates a new version. | Parameter | Type | Required | Default | Description | | ------------------ | ------ | -------- | --------- | ---------------------------------------------------------------------------------------------------- | | `path` | string | yes | | Secret path | | `value` | string | yes | | The secret value |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md Store a new secret or update an existing one. Each call creates a new version. | Parameter | Type | Required | Default | Description | | ------------------ | ------ | -------- | --------- | ---------------------------------------------------------------------------------------------------- | | `path` | string | yes | | Secret path | | `value` | string | yes | | The secret value |
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- EXAMPLES.md:27